Whistleblowing system for a small company: a first channel with no IT department
The owner learns about the obligation from the accountant, and implementation sounds like a quarter of work and an invoice from a law firm. The Act requires less than it seems, but it requires it precisely: a procedure with prescribed content, consultation, announcement and a register from day one.
The situation
The company has crossed the headcount threshold and the owner learned of the obligation from the accountant. There is no IT department and no compliance function, and rolling out a system sounds like a quarter of work and an invoice from a law firm.
How it works
A wizard walks through the setup: logo, responsible people, the form, and procedural documents ready to adapt. The channel is live under the company's own domain the same day. The owner does not need to understand the act in detail, because the system handles the deadlines and the register.
- Legal compliance
- Statutory deadlines
- Multiple channels
In this scenario 4
What the Act says in this situation
The obligation arises when, on 1 January or 1 July, at least 50 people perform paid work, counting contractors and B2B associates who have no employees of their own (Article 23(1) and (2)). A company that on 1 July had 48 employees and 4 people on service contracts is covered by the Act from that day.
The procedure must contain the elements listed in Article 25(1): who receives reports, how they can be submitted (in writing and orally), who impartially conducts follow-up actions, acknowledgement of receipt within 7 days, feedback within 3 months, information on external reports. Before it is adopted it must be consulted with employee representatives for 5 to 10 days (Article 24(3) and (4)), and it enters into force 7 days after it is announced (Article 24(6)). The register is kept from that day (Article 29).
Liability for the absence of a procedure rests with the person obliged to establish it, which in a family business is usually the owner personally (Article 58).
What to watch when implementing
- Impartiality in a company where everyone knows everyone. The person handling a case cannot be someone the report may concern. In practice: two people from different departments, with cover, or an external law firm to receive reports (Article 28).
- Consultation, even without a union. The absence of a trade union does not remove the duty to consult: employee representatives must be selected in the manner adopted in the company, and the date the draft was presented must be documented.
- Announcement with proof of the date. An email to all staff, an intranet post or a list of acknowledgements. The 7 days to entry into force count from that date.
- Information for candidates when recruitment begins (Article 24(7)): a link to the procedure in the job advertisement.
Features that make the difference
- Onboarding wizard: logo, domain, receiving and handling persons, form, in a few steps, with no IT department (deployment and channels).
- Templates for procedural documents: the procedure, privacy notice and authorisations, adjusted in the panel and published on the reporting page in versions.
- Employee register with confirmation of acknowledgement: proof that the procedure was announced, without a binder.
- Deadlines counted by the system: the owner does not need to know the Act in detail to avoid breaching it (case handling).
- A package for companies with up to 49 people, for the time when the obligation does not yet apply but the channel is already useful (pricing).
Frequently asked questions
Is an email address such as "whistleblowers@company.com" enough?
No. An address is a channel, not a procedure. The procedure must specify the persons, the ways of reporting, the deadlines and the information on external reports, and it must be consulted and announced. An email inbox will not acknowledge receipt within 7 days, will not count the 3 months and will not prove to an inspector who read the report.
How long does it take to launch?
Configuring a channel in sygnadesk takes an hour. Consultation takes 5 to 10 days by law, and the procedure enters into force 7 days after it is announced. Realistically, three weeks pass from the decision to a working channel, most of which is statutory deadlines, not work.
More in the article Internal reporting procedure step by step.
From the knowledge base
- The Polish Whistleblower Protection Act: who it applies to and from when 50-person threshold on 1 January and 1 July, sectors with no threshold, small-municipality exemptions, who is a whistleblower and what the Act covers.
- The internal reporting procedure step by step What the internal reporting procedure must contain under Article 25, how to consult it in 5 to 10 days, when it takes effect and how to announce it.
- Penalties for not having an internal reporting procedure and for retaliation Fine for a missing or defective procedure, up to 3 years for obstruction and retaliation, a year for breaching confidentiality. Who is personally liable.
A procedure is a document. A channel is the system that carries it out.
sygnadesk counts the deadlines, keeps the register and protects the reporter’s identity the way the knowledge base describes. See how it would look in your organisation.