Applicable Act and scope of the duty
The Act of 14 June 2024 was published on 24 June 2024 as Journal of Laws 2024, item 928. Most provisions have applied since 25 September 2024, and specified provisions and Chapter 4 since 25 December 2024. As a rule, the procedure applies to an entity for which at least 50 people perform paid work as at 1 January or 1 July. Sectoral exceptions and organisational units of a municipality or county below 10,000 residents require a separate legal assessment.
Who the Act protects and when a procedure is required
First confirm the conditions for reporter protection and the method for calculating the threshold and statutory exceptions.
Conditions for protection
Protection applies to a person who obtained information in a work-related context and had reasonable grounds to believe it was true and concerned a breach of law.
Threshold of at least 50 people
The position is assessed on 1 January or 1 July. It includes employees by full-time equivalent and specified people performing paid work on another basis.
Exceptions to the threshold
The threshold does not apply to activities covered by the Act, including specified financial, AML/CFT, transport-safety and environmental areas.
Confidentiality and prohibition of retaliation
Access is limited to authorised people; identity remains confidential outside statutory exceptions, and retaliation is prohibited.
Procedure: deadlines, channels and responsibility
The organisation approves the requirements and procedure after legal review. The technical team configures the channel, MFA, permissions, logs and backup and performs acceptance testing. The tool does not replace organisational decisions or the person responsible for the process.
Consultation and effective date
The draft is consulted with a trade union or representatives for 5 to 10 days. The procedure takes effect 7 days after it is communicated.
Acknowledgement and feedback
Receipt is acknowledged within 7 days unless no contact address is available. Feedback is provided within no more than 3 months.
Channels and anonymity
The channel supports oral or written reports; a meeting is arranged on request within 14 days. The entity decides whether to accept anonymous reports, and the procedure defines their handling.
Authorisations, register and retention
Cases are handled by people with written authorisation. Register data and information are retained for 3 years after the end of the calendar year specified by the Act.
What the procedure and channel should organise
The document and system must form one process. Before configuring a tool, define roles, authorisations, report scope, acknowledgements, follow-up, feedback, record keeping and data-protection rules.
- Procedure owner, report recipients, separation of duties and handling of conflicts of interest.
- A channel supporting at least oral or written reports and a decision on accepting anonymous reports and how to handle them.
- Acknowledgement within 7 days and feedback within no more than 3 months, subject to statutory exceptions.
- Restricted access to content and identity, named authorisations, an operations log and secure authentication.
- Case classification, follow-up, escalation, closure and documented decisions without excessive data copying.
- Agree register retention for three years after the end of the relevant calendar year, deletion, backups and incidents with legal counsel and the data protection officer (DPO), where appointed.
An implementation plan that does not confuse law and configuration
The organisation defines the process, roles and procedure with legal support. The technical team translates the approved rules into channel configuration, access, logs, backup, monitoring and acceptance testing. Review legal requirements and system operation separately.
- Confirm the duty, entity scope and legal decisions against the current text of the Act.
- Map roles, authorisations, deputies, conflicts of interest and escalation paths.
- Configure the channel, encryption, MFA, least privilege, activity records and secure communication.
- Test a report from submission through feedback, including the absence of the primary case handler.
- Record the acceptance protocol, risks, owner decisions and next review date.
Related Virtline areas
Virtline can support the technical and organisational implementation layer after legal requirements have been approved. The scope should clearly separate legal, process, information-security and system-operation responsibilities.
Statlook
A reporting module used as part of the organisation's wider approved process.
ISO 27001 gap assessment
Review of roles, permissions, evidence, incidents and information protection within a management system.
Cybersecurity
Access control, MFA, logs, monitoring, backup and incident response for the reporting channel.
