A Polish manufacturing company with 280 employees receives a tip-off that a procurement manager has been accepting kickbacks from a key supplier. The information arrives via a personal email to HR – not through any formal reporting channel. The company has no documented procedure, no confidentiality guarantee, and no acknowledgement protocol. Under Poland's whistleblower legislation, that gap is not a minor administrative shortcoming. It is a breach that can result in criminal liability for the persons responsible for establishing the channel.
Poland's Ustawa o ochronie sygnalistów (Whistleblower Protection Act, WPA) requires employers meeting the 50-employee threshold to establish an internal reporting channel that meets specific technical and procedural standards. The channel must guarantee confidentiality of the reporter's identity, deliver a written acknowledgement within 7 days of receipt, and produce a follow-up response within 3 months. Failure to establish a compliant channel constitutes a criminal offence punishable by a fine or restriction of liberty for the responsible manager.
This guide walks through the technical requirements step by step – from channel architecture and data protection obligations to the three most common implementation mistakes and a practical checklist for in-house teams. Three business scenarios illustrate how the requirements apply differently to a manufacturing group, a technology company, and a foreign investor's Polish subsidiary.
Who must comply and what does the WPA actually require?
The WPA applies to private-sector employers with at least 50 employees, all public-sector entities regardless of size, and certain regulated entities – including those subject to ustawa o przeciwdziałaniu praniu pieniędzy (Anti-Money Laundering Act, AML) obligations – irrespective of headcount. The 50-employee count includes full-time equivalents and civil-law contractors who perform work personally. Employers in the 50–249 range may share a channel with other employers in the same group, provided each employer remains individually responsible for follow-up actions. Entities above 250 employees must operate an independent channel.
The Act identifies three mandatory elements that any compliant channel must deliver. First, a secure method for receiving reports – oral or written, at the reporter's choice. Second, a confidentiality guarantee covering the reporter's identity, third parties named in the report, and the content of the report itself. Third, a documented follow-up procedure with defined response deadlines. The National Labour Inspectorate (Państwowa Inspekcja Pracy, PIP) and the Office for the Protection of Personal Data (Urząd Ochrony Danych Osobowych, UODO) both have audit powers under the Act. The PIP focuses on procedural compliance; the UODO examines data protection architecture.
The scope of reportable matters covers breaches of Polish and EU law across a wide range of areas: financial services, AML, environmental protection, public health, consumer protection, and public procurement. Employers may extend scope voluntarily to include internal policy breaches – a step that several Warsaw-based compliance teams have taken to align with CSRD Poland reporting requirements and broader ESG reporting frameworks.
- Threshold: 50 full-time equivalents (including civil-law contractors)
- Acknowledgement deadline: 7 calendar days from receipt
- Follow-up response deadline: 3 months from acknowledgement
- Channel format: written and/or oral, at reporter's choice
- Mandatory extension option: anonymous reporting (permitted, not required)
What are the technical architecture options for a compliant channel?
Channel architecture is the decision that most directly determines both compliance cost and operational sustainability. Polish law does not mandate a specific technology. It mandates outcomes: confidentiality, integrity, and documented response. That leaves three realistic architecture paths, each with different cost and risk profiles.
The first path is a dedicated software platform. Several providers offer SaaS solutions certified for GDPR compliance and WPA-aligned workflow management. Typical annual licensing costs for a 200-employee company range between PLN 8,000 and PLN 25,000. These platforms automate acknowledgement timestamps, generate audit trails, and support anonymous two-way communication – a feature that matters because a reporter who submits anonymously must still be able to receive follow-up questions from the compliance team. Without two-way anonymous capability, the channel cannot function effectively for the most sensitive reports.
The second path is an outsourced channel operated by an external compliance lawyer or specialist firm. The employer contracts a third party to receive, triage, and forward reports. This model suits smaller entities in the 50–100 employee range and foreign investors whose Polish subsidiary lacks a dedicated compliance function. Outsourced channels typically cost between PLN 500 and PLN 2,000 per month. The external operator acts as a data processor under a written data processing agreement – a document that UODO auditors will request first.
The third path is an internal channel built on existing infrastructure – a dedicated email address, a locked physical mailbox, or a telephone hotline. This path carries the highest compliance risk. A dedicated email address does not, by itself, satisfy the confidentiality requirement if the IT administrator has unrestricted access to the mailbox. The employer must implement technical access controls limiting visibility to the designated compliance officer or committee. We assisted a retail client in Małopolska (winter 2025) in restructuring an email-based channel that had been operational for six months but lacked access controls – a gap that would have been flagged immediately in any UODO audit.
How should data protection be integrated into channel design?
Data protection is not a separate workstream. It is an architectural constraint that shapes every design decision. The WPA operates alongside the General Data Protection Regulation (GDPR) and Poland's national data protection implementing legislation. Any personal data collected through the channel – the reporter's identity, the subject's identity, witness names, document metadata – constitutes special-category data in practice, even where the formal legal classification is ordinary personal data. That means the employer needs a lawful basis, a retention policy, and a deletion protocol before the channel goes live.
Retention periods under the WPA are fixed: personal data from a report must be deleted no later than 3 years after the end of the calendar year in which proceedings related to the report were concluded. That deadline runs from conclusion of proceedings, not from receipt of the report. For employers running parallel disciplinary and criminal proceedings, the 3-year clock may not start for several years after the initial report. Compliance teams must build this logic into their data management systems from day one.
The UODO has issued guidance confirming that a Data Protection Impact Assessment (DPIA) is required for whistleblower channels. The DPIA must address: the categories of data processed, the risk of re-identification of anonymous reporters, access control measures, and cross-border data flows where a shared group channel routes data to a parent company outside the European Economic Area. For a foreign investor's subsidiary using a group-level channel hosted outside Poland, this last point is not theoretical – it triggers standard contractual clauses or binding corporate rules obligations that must be documented before the channel accepts its first report.
To discuss how data protection requirements apply to your channel architecture, reach out to info@kordeckipartners.com.
For context on how these obligations interact with AML compliance duties, see our detailed analysis of AML compliance obligations for Polish companies.
What are the most common implementation mistakes – and how do you avoid them?
Three mistakes account for the majority of non-compliant channels identified in Polish practice to date. Understanding them in advance is cheaper than correcting them after a PIP inspection.
The first mistake is treating the channel as a one-time IT project rather than an ongoing compliance programme. A channel that meets technical requirements on launch but lacks a trained channel operator, a documented escalation procedure, and annual review cycles will drift out of compliance within 12 months. The WPA requires employers to review and update their internal reporting procedures whenever relevant circumstances change. That obligation is procedural, not merely advisory. A Whistleblower compliance programme requires the same governance discipline as an AML programme or an ESG reporting framework.
The second mistake is failing to consult the works council or employee representatives before finalising the internal reporting procedure. The WPA requires consultation before the procedure enters into force. Employers who skip this step face a specific criminal exposure: the Act treats failure to consult as a separate offence from failure to establish a channel. The consultation period is at least 5 days. In practice, experienced compliance lawyers in Warsaw budget 10–14 days to allow for meaningful dialogue and documented agreement.
The third mistake is scope ambiguity. Employers who define the channel's subject-matter scope too narrowly – limiting it to financial misconduct, for example – create a false sense of compliance while leaving large categories of reportable breach outside the system. Conversely, employers who extend scope to cover all internal policy breaches without updating their investigation procedures create an unmanageable intake volume. We helped a technology company in Mazowieckie (spring 2026) restructure its scope definition after an overly broad initial rollout generated 40 reports in the first quarter, most of which fell outside the statutory categories and overwhelmed the compliance team.
Three business scenarios: manufacturing, IT, and foreign investor
Implementation choices look different depending on the company's size, structure, and ownership. Three scenarios illustrate the range.
Manufacturing group, 600 employees, two Polish subsidiaries. The group operates a single shared channel at holding level, hosted on a SaaS platform. Each subsidiary has a designated local compliance officer who receives forwarded reports and manages follow-up. The data processing agreement between the holding company and each subsidiary treats the holding as data processor and each subsidiary as data controller – a structure that UODO guidance supports. The group's internal procedure extends scope to include environmental and occupational health breaches, aligning the channel with the group's CSRD Poland reporting obligations. Annual platform cost: approximately PLN 18,000 across both subsidiaries.
IT company, 80 employees, Warsaw. The company uses an outsourced channel operated by an external compliance lawyer. Reports are received by the external operator, stripped of identifying metadata, and forwarded to the CEO and legal counsel within 48 hours. The model suits the company's flat structure and the absence of a dedicated compliance function. The outsourcing contract includes a 7-day acknowledgement SLA and a quarterly review meeting. Monthly cost: PLN 1,200. The company's non-compete and confidentiality framework – relevant where whistleblower reports involve IP or trade secret allegations – has been reviewed for alignment with the WPA's anti-retaliation provisions. See also our analysis of non-compete clauses in Poland for the interaction between confidentiality obligations and whistleblower protections.
Foreign investor's Polish subsidiary, 120 employees, Lower Silesia. The German parent operates a group-level reporting channel hosted on servers in Frankfurt. The Polish subsidiary routes reports through the group channel. This structure requires: a data transfer mechanism (standard contractual clauses) for GDPR compliance, a Polish-language interface and procedure document, and a local contact point who can handle follow-up within Polish statutory deadlines. The subsidiary's compliance design also intersects with the parent's obligations under the German Supply Chain Due Diligence Act. For a broader view of compliance programme design in cross-border group structures, see our guide on compliance programme design for subsidiaries in Poland.
What should your implementation checklist include?
A compliant channel requires more than technology. It requires documented governance, trained personnel, and tested procedures. The following checklist covers the minimum viable scope for a private-sector employer in the 50–249 range.
- Written internal reporting procedure, consulted with employee representatives for at least 5 days before adoption
- Designated channel operator with documented authority and a named substitute
- Technical access controls limiting data visibility to authorised personnel only
- DPIA completed and filed before channel goes live
- Data processing agreement in place with any external operator or group-level channel provider
Beyond the checklist, employers should build in three operational safeguards. First, a test run: submit a fictitious report before launch and verify that the acknowledgement, routing, and response workflow functions correctly end to end. Second, staff communication: the WPA requires employers to make the reporting procedure available to employees and contractors. A procedure that exists only in the compliance officer's drawer does not satisfy this obligation. Third, annual review: schedule a formal review of the procedure and channel architecture each calendar year, timed to coincide with the employer's broader ESG reporting cycle where applicable.
A specific situation at your company may carry consequences that a general checklist cannot capture. For a tailored assessment of your channel design against current WPA and GDPR requirements, contact info@kordeckipartners.com.
Frequently asked questions
Q: Can a company use an anonymous email address as its sole reporting channel?
A: An anonymous email address can form part of a compliant channel, but it cannot function as the sole mechanism without additional controls. The channel must support two-way communication, meaning an anonymous reporter must be able to receive follow-up questions from the compliance team. A standard email address does not provide this without technical configuration. Additionally, the IT administrator's access to the mailbox must be restricted through documented access controls. Without these measures, the channel fails the confidentiality requirement under the Whistleblower Protection Act.
Q: How long does it take to implement a compliant channel, and what does it cost?
A: For a mid-size company using a SaaS platform, the full implementation timeline – from vendor selection through DPIA completion, employee representative consultation, and staff communication – typically runs 6 to 10 weeks. Costs vary by model: SaaS platforms for 50–250 employees range from PLN 8,000 to PLN 25,000 annually; outsourced channels cost approximately PLN 500 to PLN 2,000 per month. Legal advisory costs for drafting the internal procedure and DPIA add PLN 5,000 to PLN 12,000 as a one-time investment. Employers who attempt to implement without legal input frequently incur higher costs when remediation is required after a PIP inspection.
Q: Does the whistleblower channel need to accept reports about breaches that occurred before the WPA entered into force?
A: Yes. The Whistleblower Protection Act does not restrict the temporal scope of reportable breaches to conduct occurring after the Act's entry into force. A reporter may use the channel to report a breach that occurred years earlier, provided the underlying conduct falls within the Act's subject-matter scope. Employers sometimes assume that legacy conduct is outside the channel's remit – this is a common misconception that can lead to improper rejection of reports and potential liability for the person responsible for channel management.
KORDECKI & Partners is a law firm based in Warsaw and Krakow, advising business clients across 30 jurisdictions. Our team combines expertise in Polish and international law with a practical approach to ESG compliance, whistleblower channel design, and internal investigations. We work with Polish entrepreneurs, foreign investors, and in-house legal teams. To discuss your situation, contact info@kordeckipartners.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. KORDECKI & Partners assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@kordeckipartners.com.