Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Key takeaways of the Polish whistleblowing law:
As Poland prepares to implement its new whistleblowing law on September 25, 2024, businesses across the country are grappling with the implications of this sweeping legislation. The law, which aligns with the EU Whistleblowing Directive, is designed to protect individuals who report illegal activities in their workplace. While the intent behind the law is clear, fostering transparency and accountability, the path to compliance presents several challenges for Polish businesses.
- Mandatory Whistleblowing Systems: Organizations with 50 or more employees are required to establish internal procedures for whistleblowing. This includes setting up secure channels for reporting, appointing impartial units or persons to handle reports, and ensuring that whistleblowers’ identities are protected. This can be resource-intensive, especially for small to medium-sized enterprises (SMEs) that may lack the infrastructure to quickly implement these systems.
- Data Protection Compliance: Given that whistleblowing reports will often contain sensitive personal data, businesses must ensure compliance with the General Data Protection Regulation (GDPR). This includes conducting Data Protection Impact Assessments (DPIAs) and updating data processing agreements. Failure to manage this data correctly could result in significant penalties, adding another layer of complexity to compliance efforts.
- Employee Relations: The law also requires that these new procedures be developed in consultation with employee representatives or trade unions. This could potentially lead to tensions within organizations, especially if employees feel that the processes are intrusive or not adequately protective.
- Legal Risks and Retaliation Concerns: Businesses must be cautious to avoid any actions that could be perceived as retaliation against whistleblowers. The law prohibits any form of retaliation, including demotion, dismissal, or even subtle forms of workplace discrimination. Ensuring that all managerial staff are trained to handle whistleblower complaints appropriately will be crucial to mitigate legal risks.
Concerns among Polish businesses:
- Short Implementation Timeline: One of the most pressing concerns is the tight timeline for implementation. With the new whistleblowing law coming into effect on September 25, 2024, many businesses feel unprepared to meet the requirements, particularly those that have not previously dealt with similar regulations.
- Costs of Compliance: The financial burden of setting up compliant whistleblowing systems is another major concern. For smaller businesses, the costs associated with creating secure reporting channels, training staff, and maintaining compliance with data protection laws can be significant.
- Operational Disruptions: The introduction of new procedures may disrupt existing workflows and require businesses to divert resources from other important areas. The need to frequently update policies and engage with legal and data protection experts adds to this operational strain.
- Reputational Risks: Businesses are also worried about the potential reputational damage that could arise from whistleblowing cases. Even unfounded allegations could lead to public scrutiny, affecting customer trust and market reputation.
Implications of new whistleblowing law in Poland:
While Poland’s new whistleblowing law aims to enhance transparency and protect whistleblowers, it brings a host of challenges for businesses. Companies will need to invest time, money, and effort to ensure compliance, all while navigating potential operational and reputational risks. As the September deadline approaches, proactive planning and thorough employee engagement will be key to mitigating these challenges and turning compliance into a competitive advantage.
At Trusty, we make it simple and painless for businesses to comply with whistleblowing laws. Trusty includes a compliant whistleblowing policy localized to the Polish legislation.
Frequently asked questions
Organisations with 50 or more employees must establish internal whistleblowing procedures: secure reporting channels, an impartial unit or person to handle reports, and protection of the whistleblower's identity.
On 25 September 2024, aligned with the EU Whistleblowing Directive.
Reports often contain sensitive personal data, so businesses must comply with the GDPR, including Data Protection Impact Assessments and updated data processing agreements.
Yes. Any form of retaliation is prohibited, including demotion, dismissal or subtler workplace discrimination, so managers need training on how to handle reports.
Related reading: the penalties for violating the Polish whistleblowing law, how the Whistleblowing Directive was transposed across the EU, and Trusty whistleblowing software with a policy localized to Polish law.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.