The internal reporting channel duty in Poland

2024-09-25 (Art. 64: three months after promulgation; promulgated 24 June 2024). Exception: Art. 5(4), Art. 25(1)(8) and the whole of Chapter 4 on external reporting entered into force six months after promulgation, i.e. 25 December 2024.

50 or more persons performing paid work for the legal entity, measured as at 1 January or 1 July of the given year (Art. 23(1)). The count (Art. 23(2)) includes employees converted to full-time equivalents plus persons providing work for remuneration on a basis other than an employment relationship, provided they do not themselves employ others for that kind of work, so B2B contractors and civil-law contractors count. NO THRESHOLD AT ALL (Art. 23(3)) for legal entities carrying on activity in the field of financial services, products and markets, prevention of money laundering and terrorist financing, transport safety, and environmental protection covered by the EU acts listed in Parts I.B and II of the Annex to Directive 2019/1937. Chapter 3 does not apply to organisational units of a commune or county with fewer than 10,000 inhabitants (Art. 23(5)).

No separate deadline exists. Poland transposed late, so the directive's 17 December 2023 date has no counterpart in Polish law: the internal-procedure duty applied to every covered entity, including the 50-249 band, from 25 September 2024 (Art. 64).

Optional, acceptance is not required. Art. 7(1): a legal entity, the Ombudsman and public authorities MAY accept anonymous reports ("mogą przyjmować zgłoszenia dokonane anonimowo"). There is no duty to accept or follow up. However Art. 25(1)(4) makes it a mandatory element of the internal procedure to state how anonymously reported information is dealt with, which includes stating that such reports are not accepted. Where they are accepted, Art. 7(3) applies the Act with listed exceptions, and Art. 7(2) gives the reporter full protection if their identity later emerges and they suffer retaliation.

Rzecznik Praw Obywatelskich (Commissioner for Human Rights / Ombudsman), the central body receiving external reports, conducting initial verification and forwarding them to the public authority competent to take follow-up action (Arts. 30-31). Sectoral public authorities (organy publiczne) take the follow-up action and must adopt their own external reporting procedures (Art. 33).

Failure to establish the internal reporting procedure: Art. 58, a person responsible for establishing the internal reporting procedure who fails to establish it, or establishes it in material breach of the Act's requirements, is liable to a fine (kara grzywny). Art. 59 routes the case through the Code of Procedure in Cases of Petty Offences, so the applicable petty-offence fine range is PLN 20 to PLN 5,000 (Art. 24 §1 of the Code of Petty Offences); DLA Piper states it as "up to PLN 5,000". Obstruction is a separate and far heavier criminal offence: Art. 54(1), whoever, wanting to stop another person from making a report, prevents it or materially hinders it is liable to a fine, restriction of liberty, or imprisonment for up to 1 year; Art. 54(2), up to 3 years' imprisonment where violence, unlawful threat or deception is used. Retaliation (Art. 55): up to 2 years, up to 3 years if persistent. Disclosing a whistleblower's identity (Art. 56): up to 1 year. Criminal fines under the Criminal Code reach PLN 1,080,000.

Yes, for intake. Art. 25(1)(1) expressly permits an external entity ("podmiot zewnętrzny") to be authorised to receive internal reports. Art. 28(1) requires a written contract entrusting receipt of reports, acknowledgement of receipt, provision of feedback and provision of information about the internal procedure, using technical and organisational measures ensuring compliance with the Act; Art. 28(2) requires GDPR Art. 28(3) processor terms. Art. 28(4): the contract does not relieve the legal entity of its own liability. Limit: the impartial unit or person taking follow-up action under Art. 25(1)(3) must sit within the legal entity's own organisational structure, so case assessment cannot be fully outsourced the way intake can.