Whistleblower Reports and Criminal Liability in Poland: Risks for Managers, Compliance Officers and In-House Counsel

The forthcoming Polish whistleblower protection act, implementing the EU Whistleblower Directive, will fundamentally reshape how organisations handle internal reports of irregularities. For managers, compliance officers and in-house counsel, the new framework is not only a matter of procedures and corporate governance. It also brings a very real risk of criminal liability – in particular for retaliation, obstructing reporting and mishandling personal data or evidence.

In Poland, criminal law already offers a number of instruments that may be applied in the context of whistleblower reports, even before full implementation of the new statute. Provisions on abuse of power, data protection, labour law offences, obstruction of justice and protection of personal rights can all become relevant when a whistleblower steps forward. Understanding this mosaic is essential for any organisation operating in Poland or managing cross‑border investigations involving Polish entities.

This article provides a structured overview of the key criminal-law risks faced by managers and compliance functions in Poland in connection with whistleblowing. Drawing on practical litigation experience in white-collar cases, it outlines how liability may arise, what conduct is particularly risky, and what governance and compliance measures can effectively mitigate exposure – both for the organisation and for individual decision‑makers.

How does Polish law define whistleblower reports and who is protected?

Under EU law, a whistleblower report is any disclosure of information about a breach of law obtained in a work-related context. The Polish whistleblower protection act, once fully enacted, will broadly follow this definition and protect not only employees, but also contractors, interns, members of management bodies and other persons in a similar position. In practice, this means that internal reporting mechanisms must be designed for a wide spectrum of potential reporters.

Currently, elements of protection are scattered across Polish labour law, anti‑discrimination regulations and data protection rules. For example, employees who report irregularities in good faith may already rely on the prohibition of discriminatory treatment under the Labour Code. However, there is still no single, comprehensive statute codifying the status and rights of a “whistleblower” in Poland, which increases legal uncertainty – especially in cross‑border matters.

For organisations, an important practical point is that criminal liability for retaliation or obstruction is not conditioned on the final qualification of the reporter as a “statutory whistleblower”. Courts and prosecutors will primarily assess whether the individual provided information on potential offences or breaches and whether subsequent actions of management or HR constituted unlawful pressure, intimidation or punishment.

What types of retaliation against whistleblowers may trigger criminal liability?

Retaliation against whistleblowers most commonly appears as termination of employment, demotion, transfer to a less favourable position, harassment or threats. While many of these behaviours are primarily addressed by civil law and labour law remedies, certain forms of retaliation may meet the thresholds of Polish criminal offences, particularly when they involve elements of coercion, threats or abuse of official authority.

For public officials, Article 231 of the Polish Penal Code (abuse of power) plays a central role. If a manager in a public entity or a person performing a public function abuses his or her authority to pressure or punish a whistleblower, this may constitute a criminal offence. In the private sector, provisions on unlawful threats, stalking, mobbing-like conduct or interference with workers’ rights can also be relevant, depending on the factual matrix.

In practice, the line between a “business decision” and criminally relevant retaliation will depend on documentation, proportionality and timing. Abrupt negative HR actions closely following a whistleblower report, without clear and well-documented justification, can be difficult to defend in criminal proceedings. This creates a particular risk for managers, compliance officers and in-house counsel participating in or approving personnel decisions.

Managers’ personal exposure: when does management oversight become criminal risk?

Polish criminal law is centred around individual liability. Legal persons may face financial penalties under the Act on Liability of Collective Entities, but it is individual managers, board members and decision-makers who are the primary focus of law enforcement. In the context of whistleblower reports, criminal risk arises not only from direct acts of retaliation, but also from omissions and failures of oversight.

If a manager knowingly tolerates unlawful pressure on a whistleblower or approves disciplinary measures that are essentially punitive for having made a report, prosecutors may argue complicity or instigation. Where the underlying irregularities involve white-collar crime – such as corruption, fraud, bid rigging or accounting offences – inaction in response to credible reports can also be interpreted as aiding and abetting the primary offence, or as failing to prevent a crime that one had a legal duty to avert.

From a risk management perspective, it is therefore crucial that management bodies implement robust compliance programmes, ensure proper documentation of decision-making in sensitive whistleblower cases, and seek independent legal advice before taking steps that could be interpreted as retaliatory. A transparent, traceable decision process is often the key element protecting managers from allegations of intentional wrongdoing.

Compliance officers under pressure: where does independence end and liability begin?

Compliance officers in Poland increasingly perform quasi‑investigative functions: receiving whistleblower reports, conducting fact-finding, advising management on remediation and sometimes coordinating with external counsel or law enforcement. This expanded role improves corporate governance, but also places compliance personnel closer to potential criminal-law fault lines.

Liability risks arise if a compliance officer manipulates or suppresses a report, selectively documents findings to shield senior management, or informs the alleged wrongdoers in a way that facilitates destruction of evidence. Such conduct may be qualified as obstruction of justice or assistance in the commission of the underlying offence. Even passive behaviour – such as unreasonably delaying an internal investigation into suspected white-collar crime – can be scrutinised, particularly in regulated sectors like finance.

Best practice therefore calls for clearly defined mandates, reporting lines and escalation procedures. Compliance officers should have documented independence and direct access to the supervisory board or audit committee, and they should be able to demonstrate that their handling of whistleblower reports followed pre‑established protocols, rather than ad hoc instructions aimed at minimising reputational exposure.

In-house counsel and legal privilege: protection or hidden exposure?

In-house counsel occupy a sensitive position at the intersection of legal advice, business strategy and internal investigations. On the one hand, legal privilege and confidentiality obligations protect communication between the company and its lawyers. On the other, in-house lawyers can be treated as participants in decision-making processes that may harm whistleblowers or impede criminal investigations.

Polish courts generally recognise professional secrecy of attorneys and legal advisers, but the scope of privilege for in-house lawyers is less absolute than for external counsel. Where in-house counsel engage in activities beyond pure legal advice – for example by actively designing HR strategies aimed at removing a troublesome whistleblower – their actions may be assessed not as legal services, but as managerial behaviour, with corresponding criminal liability risks.

From a governance perspective, organisations should clearly delineate the advisory role of in-house counsel in relation to whistleblowing cases and ensure that any potentially controversial decisions (e.g. termination of a reporting employee) are supported by robust, non-retaliatory business rationale. External counsel can play a crucial role in providing independent assessments and reinforcing the privileged nature of sensitive communications.

What does “criminal liability for retaliation” cover under Polish law?

There is, as yet, no single Penal Code provision titled “criminal liability for retaliation” against whistleblowers. Instead, prosecutors rely on a combination of existing offences. For public officials, the most important is abuse of power (Article 231), which can be used where an official acts to the detriment of a whistleblower in violation of law or internal regulations. For private-sector entities, offences involving coercion, unlawful threats, persistent harassment or violations of employee rights may be invoked.

Once the Polish whistleblower protection act is finalised, it is expected to introduce explicit sanctions for retaliatory actions or for hindering reporting. This will likely strengthen the position of whistleblowers as injured parties in criminal proceedings and increase the incentives for prosecutors to take up such cases, especially in high-profile or cross‑border investigations. Managers, compliance officers and in-house counsel should anticipate a more stringent environment and adapt internal controls accordingly.

It is also important to remember that retaliation can trigger both criminal and civil liability. Whistleblowers frequently pursue parallel claims for reinstatement, compensation for non-pecuniary harm and protection of personal rights. A criminal investigation or conviction significantly increases their bargaining power and reputational leverage, especially when dealing with multinational groups subject to ESG and governance scrutiny.

Data protection, confidentiality and evidence: where are the criminal-law red lines?

Internal investigations based on whistleblower reports often involve processing sensitive personal data, accessing email accounts, reviewing IT logs and collecting documents that may later become evidence in court. Mishandling such data can not only lead to administrative sanctions under the GDPR, but also engage criminal liability in Poland, particularly under provisions protecting privacy, correspondence and integrity of information systems.

Destroying or altering documents, instructing IT staff to “clean up” mailboxes, or pressuring employees to withdraw statements can be seen as obstruction of justice or aiding the perpetrators of the underlying offence. Likewise, disclosing the identity of a whistleblower in breach of statutory or contractual confidentiality may, once the new act is in force, constitute an independent criminal offence.

Organisations should therefore implement clear forensic and data-handling protocols for whistleblower cases, including chain-of-custody procedures, involvement of specialised external providers where appropriate, and rigorous access controls. Documenting every step not only ensures legal defensibility, but also protects individuals who take operational decisions from later allegations of intentional evidence tampering.

Sector-specific issues: public officials, financial institutions and listed companies

While the core principles of criminal liability for retaliation and obstruction are similar across sectors, certain industries face heightened expectations. Public officials and managers of state-owned companies are under particular scrutiny due to the application of offences related to abuse of power and corruption. In such environments, whistleblower reports frequently intersect with public procurement, state aid or regulatory violations.

Financial institutions and listed companies, in turn, operate within dense regulatory frameworks that already mandate internal reporting channels, market abuse controls and anti-money laundering systems. In these sectors, a failure to respond appropriately to a whistleblower report may also be considered a breach of supervisory obligations, attracting attention from financial regulators and stock exchange authorities in addition to criminal prosecutors.

Cross‑border groups must also consider the interaction between Polish rules and foreign enforcement regimes, such as the US FCPA or UK Bribery Act, where whistleblowers play a central role in investigations. Missteps in handling a report in Poland can have consequences in multiple jurisdictions, including personal exposure of managers, compliance officers and in-house counsel to foreign proceedings.

How can organisations minimise criminal risk linked to whistleblower reports?

Effective risk mitigation starts with a clear, well-communicated whistleblowing policy that defines internal and external reporting channels, guarantees confidentiality, and explicitly prohibits retaliation. Procedures must be supported by training for managers and HR, focusing on practical scenarios in which legitimate performance management or restructuring decisions could be misinterpreted as punitive measures against a reporter.

Secondly, organisations should establish independent investigation protocols with predefined steps: initial triage, conflict-of-interest assessment, involvement of internal or external experts, documentation standards and criteria for escalation to law enforcement. Aligning these protocols with the forthcoming whistleblower protection act will ensure that internal processes remain defensible if scrutinised by prosecutors or courts.

Finally, legal oversight is essential. Early engagement of experienced white-collar crime counsel can help identify criminal-law touchpoints, structure investigations to preserve privilege and prevent inadvertent obstruction. Proper advice is particularly important where there is tension between data protection, labour law, corporate disclosure obligations and the rights of accused individuals.

Why specialised legal support is critical in whistleblower-related criminal matters

The intersection of whistleblower reports and criminal liability in Poland involves a complex blend of penal, labour, corporate, data protection and regulatory norms. Misjudging this landscape can expose organisations and their decision-makers to long‑lasting legal and reputational consequences, both domestically and in cross‑border contexts.

In such high‑risk matters, specialised representation by a law firm with deep experience in white-collar crime and protection of personal rights is indispensable. Kancelaria Kopeć Zaborowski Adwokaci i Radcowie Prawni regularly advises boards, compliance departments and in-house counsel on designing whistleblowing frameworks, conducting sensitive internal investigations and defending individuals in criminal proceedings arising from alleged retaliation or obstruction.

Engaging seasoned practitioners at an early stage allows organisations not only to correct procedural weaknesses, but also to demonstrate to prosecutors and regulators that they acted diligently and in good faith. This can significantly reduce the risk of personal charges against managers, compliance officers and in-house lawyers, and mitigate the overall impact of whistleblower-related disputes.

Key takeaways for managers, compliance officers and in-house counsel

For decision-makers operating in or with Poland, the core lessons can be summarised as follows:

• Whistleblower reports are no longer a purely HR or reputational issue; they are a central trigger for potential criminal proceedings.
• Retaliation, obstruction and evidence tampering can expose individuals – not only organisations – to prosecution, even under current law.
• The upcoming whistleblower protection act will further strengthen the criminal-law dimension of whistleblowing, especially regarding identity protection and anti‑retaliation standards.
• Documented, protocol-based handling of reports is the best defence for managers, compliance officers and in-house counsel against allegations of intentional wrongdoing.
• Early involvement of specialised white-collar crime counsel, such as Kopeć Zaborowski Adwokaci i Radcowie Prawni, is a critical component of any serious risk management strategy.

In an environment of increasing enforcement and public scrutiny, organisations that treat whistleblowing as a core element of their compliance architecture – rather than an inconvenient necessity – will be best positioned to avoid or manage criminal liability risks in Poland.

Bibliography / Sources

• Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (EU Whistleblower Directive).
• Polish Penal Code (Kodeks karny), consolidated text: Dz.U. 1997 nr 88 poz. 553 z późn. zm.
• Polish Labour Code (Kodeks pracy), consolidated text: Dz.U. 1974 nr 24 poz. 141 z późn. zm.
• Act of 28 October 2002 on the liability of collective entities for acts prohibited under penalty (Ustawa o odpowiedzialności podmiotów zbiorowych za czyny zabronione pod groźbą kary), Dz.U. 2002 nr 197 poz. 1661 z późn. zm.
• Regulation (EU) 2016/679 (GDPR) and Polish Personal Data Protection Act of 10 May 2018.
• European Commission, “Transposition of the Whistleblower Protection Directive” – country fiches and implementation reports.
• Selected case law of the Supreme Court of Poland (Sąd Najwyższy) regarding abuse of power (Art. 231 Penal Code) and protection of employees reporting irregularities.