Poland's Whistleblower Protection Act, explained

Nearly three years late, and it cost real money before the law even existed

The EU Whistleblowing Directive — Directive (EU) 2019/1937 — requires companies with 50 or more staff across the EU to give employees a protected, internal way to report wrongdoing; see the Directive, explained for the full baseline every member state builds on.

Poland's Whistleblower Protection Act — the Ustawa o ochronie sygnalistów — didn't arrive until 25 September 2024, when most of its provisions took effect. That's almost three years after the Directive's own transposition deadline of 17 December 2021, and Poland paid for the delay before the law was even on the books. On 25 April 2024, the Court of Justice of the EU ruled against Poland for failing to transpose the Directive at all (Case C-147/23), ordering a €7 million lump sum plus a recurring penalty of €40,000 for every day the failure continued past the judgment. The Court explicitly rejected Poland's argument that the pandemic and the scale of Ukrainian refugee resettlement justified the delay. The law that finally followed carries over the Directive's core mechanics largely unchanged — the same 50-employee threshold (see the 50-employee threshold, explained), the same 7-day acknowledgement and 3-month feedback clock — but earns its own guide in the specifics: how the deadline actually landed, a penalty regime built from criminal law rather than an administrative fine schedule, and a competent-authority story that changed hands partway through drafting.

One deadline, not a staggered one

Unlike Germany or the Netherlands, Poland didn't split its rollout by company size. Article 23 applies the internal-procedure obligation to any legal entity on whose behalf at least 50 people perform paid work, counted as at 1 January or 1 July of a given year — full-time equivalents for employees, or individuals engaged on another paid basis (contractors, for instance) if that entity doesn't itself employ others to do the same kind of work. Every entity that crosses that line was covered from the same date the law took effect, 25 September 2024, with no extended runway for the 50–249 band the way the Directive's Art. 26(2) allows and several other member states used. A narrower group of entities — those active in financial services and markets, anti-money-laundering and counter-terrorist-financing, transport safety, or environmental protection, within the scope of the specific EU acts listed in the Directive's Annex — has to run an internal procedure regardless of headcount.

Consulting your trade union — or appointing someone to consult, if you don't have one

Before a Polish entity can put its internal reporting procedure in force, it has to consult on the draft first. Article 25(3)–(4) requires that consultation to run with the workplace trade union organisation — every one of them, if more than one operates at the entity — or, where none exists, with employee representatives chosen by whatever procedure the entity has adopted for that purpose. If there's no representative body of any kind, the entity has to either appoint one or put the draft to all employees directly. The consultation itself has to run for no less than 5 and no more than 10 days from the day the draft is presented. Once it's done, the procedure is announced to staff in whatever way is normal at that workplace, and takes effect 7 days after that announcement — not before. This is Poland's own implementation of the same baseline every member state has to meet: Article 8(1) of the Directive requires internal channels to be established following consultation with social partners, where national law provides for one (see what a compliant channel actually requires). Where Germany and the Netherlands route that requirement through an existing works-council law, Poland wrote the consultation duty directly into the whistleblower statute itself.

Where a violation actually costs you

The Act's penalty structure reads like a chapter of the criminal code, because in substance it is one — most violations carry a fine, restriction of liberty, or imprisonment, not a regulatory fine against the company:

• Obstructing a report (Art. 54). Preventing or substantially hindering someone from reporting carries a fine, restriction of liberty, or up to 1 year's imprisonment. If the obstruction involves violence, an unlawful threat, or deceit, the maximum rises to 3 years.
• Retaliation (Art. 55). Taking retaliatory action against a whistleblower, a facilitator, or a person associated with them carries a fine, restriction of liberty, or up to 2 years' imprisonment — rising to up to 3 years if the retaliation is persistent.
• Disclosing a whistleblower's identity (Art. 56). Revealing a whistleblower's identity in breach of the Act carries a fine, restriction of liberty, or up to 1 year's imprisonment.
• Knowingly making a false report (Art. 57). Reporting or publicly disclosing something the reporter knows didn't happen carries a fine, restriction of liberty, or up to 2 years' imprisonment.
• Not having a compliant procedure at all (Art. 58). This is the one exception to the criminal-law pattern — it's a wykroczenie (petty offence), punishable by a fine only. The Act sets no separate amount, so the general default under the Code of Petty Offences applies: up to PLN 5,000 (Art. 24 §1, Kodeks wykroczeń). It's the smallest penalty in the Act by a wide margin, and the one most companies would guess first.

Anonymous reporting: your call, same as Germany's

Article 25(1)(4) requires an internal procedure to explain how anonymously reported information will be handled — but that's a requirement to have a stated approach, not a mandate to accept anonymous reports in the first place. Polish entities remain free to run a channel that only takes identified submissions, so long as the procedure says so. That leaves Poland in the same position as Germany's HinSchG — anonymity encouraged in the sense that the law makes you plan for it, but not required — which is exactly the position Art. 6(2) of the Directive leaves open for each member state to decide for itself. Provoxis doesn't treat that as a decision to leave open: anonymous reporting is always on for every reporter, with nothing to configure — see anonymous vs identified reporting, explained.

Can we just use an email address?

It can be part of the channel. Article 26 allows internal reports to be made orally or in writing, and written reports on paper or electronically. Article 27 requires the procedure to stop unauthorised people from reaching the information in a report and to protect the confidentiality of the reporter, the person concerned and anyone else named. A dedicated address that only the authorised handlers can open can meet that; a shared mailbox usually can't. Even with written reports only, a reporter can ask to make an oral report at a meeting in person, which has to take place within 14 days of the request (Art. 26(6)). See is an email inbox a compliant whistleblowing channel? for what an inbox needs to pass, and can you use Google Forms as a whistleblowing channel? for the form-based alternative.

Two authorities were in the running; only one got the job

Earlier drafts of Poland's bill, going back to 2021, pencilled in the Państwowa Inspekcja Pracy (PIP, the State Labour Inspectorate) as the central body for external whistleblower reports. That changed by the time the Act actually passed: ordinary labour-law breaches were removed from the Act's own list of reportable subject matter, and the general external-channel role went instead to the Rzecznik Praw Obywatelskich (RPO, the Ombudsman). Under Article 31, the RPO receives external reports on the areas listed in Article 3, carries out a preliminary check, and forwards each one to the public authority actually competent to act on it — within 14 days, under Article 32(2). The RPO also directly handles reports about breaches of constitutional rights and freedoms where no other public authority has jurisdiction. PIP didn't disappear from the picture, but its remaining role is narrower than the "external channel" label suggests: it's the body a whistleblower turns to specifically over retaliation at work, handled under PIP's ordinary labour-inspection powers rather than as a designated Art. 3 reporting channel, plus an information function — PIP runs dedicated information centres for signalists at its Warsaw headquarters and its regional inspectorate in Łódź. A report sent to PIP expecting it to investigate the underlying wrongdoing itself, rather than a retaliation complaint, is going to the wrong place.

What this means if you're comparing PL to another member state

Poland's headline penalty — up to 3 years' imprisonment — sounds heavier than Germany's up-to-€50,000 administrative fines, but the two aren't measuring the same thing any more than France's criminal penalties are: Poland's serious penalties attach to a person who actively retaliates, obstructs, or unmasks a reporter, not to a company that's merely slow to stand up a channel — that gap is covered instead by the much smaller PLN 5,000 petty-offence fine. The more distinctive fact for anyone comparing jurisdictions is the timeline itself: Poland is the one Tier-A country here that was still being fined by the CJEU for having no law at all in the months before this one took effect, which is worth knowing if a Polish subsidiary's compliance history looks thinner than a French or German one's — the underlying law is genuinely younger.

Legal basis

• Ustawa z dnia 14 czerwca 2024 r. o ochronie sygnalistów, Dz.U. 2024, poz. 928 — the Act's official text on Poland's own legislative database (ISAP).
• Art. 23 — the 50-person threshold, how it's counted, and the sectors carved out of the threshold entirely.
• Art. 25(1)(4) — the requirement for an internal procedure to state how anonymously reported information is handled.
• Art. 26 and Art. 27 — oral and written (paper or electronic) internal reports, and a meeting within 14 days on request (Art. 26(6)); no access for unauthorised people, and confidentiality for the reporter, the person concerned and third parties.
• Art. 25(3)–(4) — the trade-union/employee-representative consultation requirement and its 5–10 day window before the procedure can take effect.
• Art. 31 and Art. 32(2) — the Rzecznik Praw Obywatelskich's role as the general external channel, and its 14-day forwarding duty.
• Art. 54, 55, 56, 57 — the criminal penalties for obstructing a report, retaliation, disclosing a whistleblower's identity, and knowingly false reports.
• Art. 58 — the petty-offence fine for not establishing a compliant internal procedure.
• Art. 24 §1, Kodeks wykroczeń (Code of Petty Offences) — the default PLN 20–5,000 fine range that Art. 58 falls back on, since the Whistleblower Act itself sets no separate amount.
• Art. 8(1), Directive (EU) 2019/1937 — the EU-wide baseline requiring social-partner consultation, which Poland implements directly in the Act rather than through a separate labour-law mechanism.
• Case C-147/23, European Commission v Poland, judgment of 25 April 2024 — the CJEU ruling finding Poland had failed to transpose the Directive, and setting the €7 million lump sum and €40,000 daily penalty.