The transposition deadline for Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, commonly referred to as “whistleblowers”, expired on 17 December 2021. Although a draft bill on protecting individuals reporting breaches of law, the goal of which was to incorporate into national law provisions of the Directive, was published on the Government Legislation Centre’s website in October, it still has not been adopted by the government. According to the latest announcements, the draft bill is to be submitted before the Lower House of the Polish Parliament in Q1 2022. As per the applicable rules, the act is to enter into force 14 days after its publication in the Polish Journal of Laws.

Protocol ratification status

Pursuant to the whistleblower Directive, entities employing at least 50 workers will be obliged to develop and implement internal reporting regulations, serving as a basis for the internal procedure for reporting breaches of law and taking follow-up actions. According to the current version of the bill, legal entities in the private sector with 50 to 249 workers shall bring it into force by 17 December 2023. Entities employing at least 250 workers will be required to have an implemented whistleblower protection system at the time of the act’s entry into force.

The bill also stipulates that certain employers will be under an obligation to establish internal reporting rules regardless of the number of employees, by virtue of the business activities they pursue, including prevention of money laundering and terrorist financing (AML). Entities of such kind include:

  • accounting firms,
  • shared service centres,
  • holding companies.

Purpose of the Directive

The main purpose of the Directive (EU) 2019/1937 is to introduce a mechanism to protect individuals reporting or revealing information on law breaches obtained in the context of work they perform against negative consequences and possible acts of retaliation. The list of persons covered by the protection mechanism includes employees, but also individuals cooperating based on a legal ground other than contract of employment, entrepreneurs, persons belonging to a legal entity’s body and candidates for employment.

Scope of the new responsibilities

Apart from the requirement to establish and implement internal breach reporting procedures in consultation with employees or trade unions, the bill is also to introduce the obligation of keeping records of internal reports. Whistleblowers will be encouraged to first use internal reporting channels, i.e. provide information on the breach to a competent individual or unit within the organization. Confidentiality of the identity of the reporting person within the organization must be ensured. The whistleblower will have the right to be given feedback on the action taken as follow up. Any persecution of or retaliation against the whistleblowers will be prohibited. All the necessary steps must be taken to prohibit any form of retaliation against whistleblowers being the entity’s employees, including dismissal, reduction in wages, withholding of promotion or omission in granting it, demotion, suspension, and administering of any disciplinary measure, including a financial penalty or a similar action. It should be kept in mind that the obligations of entities that do not depend on the number of workers they employ, e.g., the prohibition of retaliation against the reporting person, will become generally applicable, meaning that each employer should comply with them.

Bill and the risks it brings to employers

The bill provides for a general prohibition of retaliation against the reporting persons (Article 10 thereof), in particular in the form of disadvantageous treatment of individuals reporting information on breaches or making public disclosures. Apart from such evident examples of disadvantageous treatment as the refusal to enter into an employment relationship or termination/termination without notice thereof, the list of adverse treatment forms includes more vague examples, including omission in granting work-related benefits other than remuneration or transfer to another employee of the existing employee duties. Consequently, there exists a real possibility that the broad catalogue of forms of disadvantageous treatment may be used by employees to abuse the existing law. Although the lawmaker provided a sanity clause under which employing entities have the right to demonstrate that such treatment of an employee is justified by objective reasons, the onus of proof remains with the employer.

Entrepreneurs employing staff should also bear in mind that the provisions of the Labour Code establishing the employer's liability for damages for violation of the principle of equal treatment in employment (Article 13 thereof), will be properly applied to the claims of a whistleblower in cases of unfavourable treatment. The amount of the compensation should not be lower than the minimum remuneration for work (in 2021 - PLN 2,800 gross). 

Consequently, any breach of the prohibition of retaliation in the form of  discrimination, disadvantageous or unfair treatment may take its toll on the employer’s finances. Importantly, the bill extends to the reporting persons that are not employees within the meaning of the Labour Code. Finally, under the bill, any unilateral legal act involving the termination of the legal relationship (other than the employment relationship) with respect to the reporting individual shall be ineffective. 

Actions to be taken

According to the Directive and the bill, entities covered by the relevant provisions must implement mechanisms ensuring legal protection of whistleblowers in form of an internal infringement reporting regulations and follow-up procedure, as well as to adjust the existing measures (e.g., those relating to reporting mobbing or violations of anti-money laundering regulations) to the new law.

The bill on whistleblower protection provides for a range of penalties, including fines, restriction of liberty/ imprisonment of up to three years for attempts to hinder reporting, acts of retaliation against the reporting individual, breach of confidentiality of identity of whistleblower or failure to establish an appropriate internal procedure. Therefore, the negative consequences of non-compliance with the whistleblower regulations may be suffered by the responsible persons in the employer's organization.


It must be kept in mind that the current version of the bill transposing the Directive provides for a relatively short period from the date of its announcement to its entry into force. Therefore, the issue of implementing or adjusting internal regulations to the requirements of the whistleblower provisions should be dealt with as soon as possible, especially in the case of entities with no dedicated compliance departments. Our recommendation for such entities is to determine which tasks could be entrusted to individual organizational units and to what extent the support of an external advisor could be used. Regardless of the final deadline of adoption of the Polish Whistleblower Act, we note that having a proper internal framework for ensuring protection of individuals reporting breaches of law in a work-related context is becoming a market standard. This is because having such a system in place gradually becomes one of the standard elements checked by business partners as part of customer screening and acceptance procedures, especially in cross-border dealings.

How can we assist you?

The vast array of services provided by KPMG includes:

  • carrying out an analysis to establish specific obligations in the field of whistleblower protection,
  • preparing a draft of internal reporting rules,
  • establishing and implementing follow-up procedures,
  • dispatching an IT tool providing for automation of the report handling procedure,
  • performing analyses of reports and internal investigations.