The Whistleblowers\u2019 Protection Act, adopted in Poland on 14 June 2024 to implement EU Directive 2019\/1937, provides protection for whistleblowers but lacks clear rules on how companies should conduct internal investigations.<\/p>\n
Scope beyond the Act<\/strong> Who conducts investigations?<\/strong> How are investigations conducted?<\/strong> Review documentation and company-owned devices<\/p>\n<\/li>\n Interview employees as witnesses<\/p>\n<\/li>\n Collect public information such as social media activity<\/p>\n<\/li>\n<\/ul>\n However, employers cannot access employees\u2019 private devices.<\/p>\n Confidentiality requirements<\/strong> Reporting outcomes<\/strong> <\/p>\n
The Act applies mainly to businesses with 50 or more employees, but other laws also require internal investigations, such as after workplace accidents or when mobbing or harassment is suspected. Therefore, even companies not covered by the Act often need to investigate internal issues.<\/p>\n
Companies should formally appoint individuals or teams to handle whistleblower reports and investigations. This role typically falls to compliance officers or in-house legal teams, but HR heads, internal audit departments, or external law firms can also be tasked with it. Their responsibilities should be set out clearly in internal policies.<\/p>\n
The Act itself provides no detailed investigation procedures. Companies may:<\/p>\n\n
Maintaining confidentiality is essential. Under the Act, disclosing a whistleblower\u2019s identity to unauthorised persons may be a criminal offence. Only those specifically authorised can access data and handle investigations.<\/p>\n
Although not legally required, preparing a written report after an investigation is recommended. Such reports should summarise findings and suggest preventive or corrective measures for the company.<\/p>\n