On 18 October 2021, a draft bill on protecting individuals reporting breaches of law, commonly referred to as whistleblowers, was published on the Government Legislation Center’s website. Its objective is to implement into Polish law the provisions of Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law. The new regulations are to impact operations of many companies. The private sector entities employing at least 50 individuals will have to, inter alia, establish internal procedures for accepting disclosures of irregularities from whistleblowers.

Main assumptions

The purpose of the bill is to introduce a protection mechanism for whistleblowers, meaning individuals reporting or revealing information on law breaches obtained in the context of work they perform.

Measures to protect whistleblowers against the negative consequences of their reports are to be introduced into the Polish legal system, along with adequate procedures for handling internal disclosures and follow-up, including, reporting channels to ensure the protection of the identity of the reporting persons mentioned therein, the obligation to appoint an impartial person or department competent for taking actions related the reports, or the obligation to undertake adequate follow-up actions by the designated person or department.

The draft bill on protection of whistleblowers deals with the following matters:

  • conditions for protection of employees and other individuals reporting or publicly disclosing information on breaches;
  • measures for the protection of employees and other individuals reporting or publicly disclosing information on breaches;
  • internal reporting rules that set out the employer's internal infringement reporting procedure;
  • reporting procedures to relevant competent authorities or at a central level;
  • rules for making public disclosures of breaches of law;
  • authorities competent for handling disclosures and providing support.

Breaches of law

Pursuant to the draft bill, breaches shall mean acts or omissions that are unlawful or aimed at circumventing the law in the areas listed in detail in the draft bill.

Importantly, the scope of the definition of a breach provided for by the draft bill is wider than the one set forth by the Directive. The draft bill is to apply to all instances of breaches in particular domains of law, e.g. regulations concerning public procurement, services, products and financial markets, anti-money laundering and counteracting the financing of terrorism, product safety, transport safety, environmental protection, food safety, animal health and welfare, public health, consumer protection, privacy and personal data protection, network and ICT system security, financial interests of the European Union and the EU internal market, including the rules of competition and granting state aid as well as corporate taxation.

Protected individuals

The draft bill is to relate to employees and other individuals. Pursuant to the proposed regulations, protection is to be granted to natural persons who report or publicly disclose information on breaches of law in the work-related context, including:

  • employees, but also persons whose work-based relationship has ended;
  • candidates for employment who acquire information on breaches during the recruitment process or another pre-contractual negotiation stage;
  • individuals cooperating based on a legal ground other than contract of employment, including civil law contracts;
  • entrepreneurs;
  • shareholders and partners;
  • persons belonging to a legal entity’s body;
  • any persons working under the supervision and direction of contractors, subcontractors and suppliers, including under a civil law contract;
  • volunteers and trainees.

Protection measures

The draft bill sets forth an overriding prohibition against any form of retaliation, meaning any direct or indirect act or omission prompted by internal or external reporting or by public disclosure, which causes or may cause unjustified detriment to the reporting person. Retaliation covers, in particular, any form of adverse treatment, especially in the context of employment.

Apart from the refusal to enter into an employment relationship or termination/termination without notice thereof, examples of adverse treatment include omission in granting work-related benefits other than remuneration or transfer to another employee of the existing employee duties, unless it finds ground in objective reasons.

Pursuant to the draft bill, the provisions of the Labor Code, which establish the employer's liability for damages for violation of the principle of equal treatment in employment, will be properly applied to the claims of a whistleblower in cases of unfavorable treatment. Reporting or making public disclosures shall not constitute grounds for the reporting individual's liability, including liability for damage, liability on account of violation of the rights of third parties or obligations specified in the law, including the obligation to protect the company’s trade secret, provided that such a person had reasonable grounds to believe that reporting or making a public disclosure were necessary to reveal a breach of law.

Internal reporting rules

Pursuant to the bill, as a rule, private sector entities employing at least 50 people will be obliged to implement the internal reporting regulations, which define the internal procedure for reporting breaches of law and taking follow-up actions, in accordance with the requirements set out in the bill. Entities employing

less than 50 people may implement such regulations on a voluntary basis.

The draft bill is to set forth minimum protection standards to be included in the regulations, as well as the obligation of confidentiality, protection of personal data and keeping records of internal reports. The record-keeping obligation is connected with an additional archiving obligation on the part of the employer (obligation to store internal reports for 5 years). 

Internal reporting and public disclosures

Irrespectively of internal reports, the draft bill also deals with the matter of making external disclosures. An external disclosure can be made without first making a report through internal channels. As a rule, the body competent in this respect will be the Ombudsman and the President of the Office of Competition and Consumer Protection (UOKiK), for issues related with competition and consumer protection rules.

An individual making a public disclosure will be protected, if they make internal and external reports first, or immediately after they make a public disclosure, but no appropriate action is taken in a timely manner in response to the report.


The draft bill provides for penalties applicable to natural or legal persons that:

  • hinder or attempt to hinder reporting;
  • retaliate against reporting or disclosing persons;
  • breach the duty of maintaining the confidentiality of the identity of reporting persons;
  • do not introduce an internal breach reporting and follow-up procedure, or implement a procedure in breach of the minimum scope requirements.

Importantly, enforcement measures will also be imposed in respect of reporting persons where it is established that they knowingly reported or publicly disclosed false information.

Entry into force

The draft bill is to enter into force 14 days after its publication. Currently, however, it is hard to assess how long the legislative process will take. Nevertheless, taking into account the short period of vacatio legis, it is worth launching works on the implementation of whistleblower protection measures as soon as possible, starting with a review of the regulations and procedures already existing in the organization in this regard.