We implement a channel that protects the whistleblower's confidentiality, organizes communication, and guides the authorized team from report receipt through feedback. We deliver the ready-made AMODIT Whistleblower Protection module or a custom platform connected to a case management system.
The provisions governing internal reports have applied since September 25, 2024. As a general rule, they cover entities for which at least 50 people perform paid work as of January 1 or July 1. The Act provides exceptions to this threshold for certain regulated activities, while smaller entities may establish a procedure voluntarily.
The organization designates reporting channels, the people or units that receive reports, an impartial follow-up team, and the method for handling anonymous reports. The procedure also includes information about external reports.
The Act provides for acknowledgment of receipt within 7 days if the whistleblower provided a contact address and for feedback within no more than 3 months.
Only personnel with written authorization receive access to the information. The entity keeps a report register, protects participants' identities, and follows the statutory data retention rules.
We do not provide legal advice. The client's lawyer or compliance team defines the procedure's scope and content. We translate the approved rules into forms, roles, access, deadlines, communication, reports, integrations, and system maintenance.
We select the option based on the organization's procedure, accountability model, number of companies, security requirements, integrations, and environment.
The LITE version provides a form at a direct link, a standard process without customization, and a ready-made report. STANDARD adds form customization, process adaptation, custom reports, and a database in the cloud or on company servers. Database encryption is available as a STANDARD extension, and reports are routed to authorized users or a team according to the roles defined in the procedure.
Explore the AMODIT module's features →We build a separate portal for identified and anonymous reports, secure attachments, and confidential follow-up communication. The platform sends data to the case management system, supports separate organization configurations, and lets the whistleblower return to the conversation without creating an account.
View the completed solution →The technology controls access, information flow, and case history. Designated authorized personnel remain responsible for assessing reports and making decisions.
Specific roles, statuses, and deadlines follow the organization's procedure. The system maps them into a secure case-handling path.
The whistleblower describes the breach, attaches supporting materials, and selects a reporting method provided by the organization.
If the whistleblower provided a contact address, they receive acknowledgment of the report within 7 days.
An authorized person reviews and classifies the report according to the procedure and requests additional information when needed.
An impartial person or unit conducts the investigation, assigns tasks, and documents the findings.
The organization takes action based on its assessment of the report and records decisions, deadlines, and accountability.
The whistleblower receives information about planned or completed action and the reasons for it within the deadline set by the procedure and the Act.
The portal connects the whistleblower with the authorized team, while the integration transfers only the information required by the case management system, reports, and controlled notifications.
Confidential communication, access control, and case history.
We design the solution from the form and attachments through authorized personnel, further case handling, reporting, and maintenance.
We restrict access to authorized roles, separate organization data, and secure report content and attachments. We select the encryption scope for the chosen solution option.
We connect the portal to the system in which the authorized team conducts the investigation. The exchange includes report data, documents, statuses, and follow-up communication.
AMODIT STANDARD runs in the cloud or on the client's servers. For a custom platform, we define the architecture, hosting, backups, monitoring, updates, and maintenance responsibilities.
We do not start with the form alone. We establish who receives reports, who conducts follow-up action, what information each role can see, and where each system's responsibility ends.
We translate the approved procedure into forms, roles, permissions, deadlines, statuses, communication, the register, and retention.
We launch the portal, case-handling process, reports, environment, notifications, and connection to the case management system.
We test identified and anonymous scenarios, permissions, attachments, and communication. We train the case-handling team and maintain the solution after launch.
As a general rule, the provisions cover a legal entity for which at least 50 people perform paid work as of January 1 or July 1 of a given year. This number includes employees on a full-time-equivalent basis and certain people providing paid work under another legal basis. The Act provides exceptions to the threshold for certain regulated activities. A lawyer should assess the organization's exact obligation.
It does not impose a general requirement to accept anonymous reports. The procedure must, however, define how such information will be handled. Both AMODIT and the custom platform support anonymous reports if the organization provides for them in its procedure.
No. The platform supports a written electronic channel and actions performed in the system, but the Act requires reporting methods to include at least the option of oral or written reports. The organization also needs a procedure, designated personnel, confidentiality protection, follow-up action, a register, and information about external reports.
No. Since December 25, 2024, a whistleblower may make an external report without first making an internal report—to the Polish Commissioner for Human Rights or the competent public authority. The organization's procedure should provide clear and easily accessible information about this option.
The whistleblower receives a secure way to return to the case without creating an account or disclosing their identity. They can read the team's question, provide a response or additional file, and check the report status.
LITE provides a form at a direct link, a standard process without customization, and a ready-made report. STANDARD adds form customization, process adaptation, custom reports, and broader AMODIT platform capabilities. Our completed STANDARD scopes have also included a test environment.
Yes. We design separate addresses, forms, content, roles, and data for individual companies while maintaining a common group standard. A lawyer for the organization should confirm whether a shared procedure for the corporate group complies with the Act.
The Act specifies a 3-year period calculated according to rules linked to the end of the calendar year in which follow-up action was completed or proceedings initiated by that action ended. The client's lawyer defines the correct rule for the procedure, and we reflect it in the system's configuration and maintenance.
AMODIT STANDARD runs in the cloud or on the client's servers. For a custom platform, we define the environment based on security, integration, and maintenance requirements. The project also covers backups, monitoring, updates, and responsibility for operating the environment.
This catalog combines the scope of the AMODIT module and the custom reporting platform. The specific project follows the organization's procedure, security requirements, integrations, and environment.
Describe the approved procedure, number of companies, roles handling reports, required integrations, and hosting model. We will select AMODIT or a custom platform and define the implementation scope.
Describe your challenge