The Whistleblowers’ Protection Act, adopted in Poland on 14 June 2024 to implement EU Directive 2019/1937, provides protection for whistleblowers but lacks clear rules on how companies should conduct internal investigations.

Scope beyond the Act
The Act applies mainly to businesses with 50 or more employees, but other laws also require internal investigations, such as after workplace accidents or when mobbing or harassment is suspected. Therefore, even companies not covered by the Act often need to investigate internal issues.

Who conducts investigations?
Companies should formally appoint individuals or teams to handle whistleblower reports and investigations. This role typically falls to compliance officers or in-house legal teams, but HR heads, internal audit departments, or external law firms can also be tasked with it. Their responsibilities should be set out clearly in internal policies.

How are investigations conducted?
The Act itself provides no detailed investigation procedures. Companies may:

• Review documentation and company-owned devices

• Interview employees as witnesses

• Collect public information such as social media activity

However, employers cannot access employees’ private devices.

Confidentiality requirements
Maintaining confidentiality is essential. Under the Act, disclosing a whistleblower’s identity to unauthorised persons may be a criminal offence. Only those specifically authorised can access data and handle investigations.

Reporting outcomes
Although not legally required, preparing a written report after an investigation is recommended. Such reports should summarise findings and suggest preventive or corrective measures for the company.

The article was published on the Chambers website. Click HERE to read the full article.