A whistleblowing channel in a corporate group: one person, five companies
In a corporate group each company is a separate employer with its own duty, but responsibility for the whole usually lands on one team at head office. The channel must give that team a view of every company’s deadlines without five logins and without a shared database someone could peek into.
The situation
A compliance officer at head office is responsible for five subsidiaries. Each is a separate employer, so each must have its own channel and its own register. Today that means five logins, five inboxes and no view of which company is about to miss the 7 days for acknowledging a report.
How it works
Each company is a separate account with its own register, form and domain. The company’s administrator invites the person from head office, who switches between companies from one login and sees overdue cases in each of them on one screen. The reporter always files in their own company.
- Statutory deadlines
- Audit log
- Legal compliance
In this scenario 4
What the Act says in this situation
The duty to have an internal reporting procedure rests on each legal entity separately: every company with at least 50 people performing paid work on 1 January or 1 July establishes its own procedure and keeps its own register of reports (Article 23(1), Article 24(1) and Article 29 of the Whistleblower Protection Act). A parent company does not “cover” its subsidiaries with a single channel; in its 2021 positions the European Commission found such a reading contrary to the Directive.
A group may have a common procedure (Article 28(8)), and companies with 50 to 249 people may share resources for receiving reports and conducting proceedings (Article 28(3)), with separate data controllers and no mutual access beyond what is necessary. A person from head office who receives and verifies reports in a subsidiary needs a written authorisation from that subsidiary (Article 27(2)). The whistleblower must always be able to report in their own company.
This is a description of how the system reflects the law, not legal advice; the details of the procedure are set by the organisation with its own lawyer.
What to watch when implementing
- A separate account for each company, not “branches” in one account. Each company has its own register, form, reporting page under its own domain, team and authorisations. There is no shared case database, so no question of who at head office could have seen a subsidiary’s case “in passing”.
- One person, one login. The person at head office has one main account (e-mail, password, 2FA). The administrator of each company invites them and sets the role; they accept the invitation and from then on switch companies from the panel bar.
- The “My organisations” screen instead of five inboxes. For each company it shows open cases, cases past 7 days without acknowledgement, missed feedback deadlines, cases assigned to that person and unread messages. No need to go in one by one.
- An authorisation in each company. Each company’s authorisation repository keeps the same person’s written authorisation separately. That is exactly the document an inspector asks for.
- The decision stays with the company. A company administrator can detach the head-office person with one click; access ends at once, and the invitation, acceptance, every switch and detachment are in the log on both sides.
Features that make the difference
- One login, many companies and Every deadline on one screen (corporate groups, law firms and DPOs).
- Safe switching: 30 minutes after the last 2FA code, switching asks for a new code, a login from a new device sends an alert, an invitation expires after 14 days.
- Authorisation repository in each company (compliance and permissions).
- Immutable audit log with an entry for every switch between companies.
- Partner model, if the group wants to bill its companies from one card with a volume discount (for partners).
Frequently asked questions
Can a group have one common channel for all companies?
A common procedure, yes; a common register, no. Each company covered by the duty keeps its own register and is the controller of the data in it. In sygnadesk each company has a separate account, and only the login of the person serving several of them is shared.
What does a group with five companies pay?
Each company has its own plan sized to its headcount. People from head office need no extra accounts. If the group wants to bill its companies from one place, the parent company or the law firm serving it can be a partner with a discount that grows with the number of companies, from 15% at the first one.
More in the article The Polish Whistleblower Protection Act: who it applies to.
From the knowledge base
- The Polish Whistleblower Protection Act: who it applies to and from when 50-person threshold on 1 January and 1 July, sectors with no threshold, small-municipality exemptions, who is a whistleblower and what the Act covers.
- The internal reporting procedure step by step What the internal reporting procedure must contain under Article 25, how to consult it in 5 to 10 days, when it takes effect and how to announce it.
From a procedure to a working channel
sygnadesk counts the deadlines, keeps the register and protects the reporter’s identity the way the knowledge base describes. See how it would look in your organisation.