Internal Investigations in Poland: How to Do Them Without Creating New Risks

An internal investigation in Poland is a structured fact-finding process conducted by a company to verify suspected misconduct, regulatory breaches, workplace violations, fraud, corruption, data misuse, or other business risks within the organisation.

This is informational material, not legal advice. The correct approach depends on the facts, the legal status of the persons involved, the type of evidence, the sector, and whether public authorities are already active.

Why internal investigation Poland projects require legal structure?

Polish law does not provide one universal code for corporate internal investigations. Instead, several legal regimes apply at the same time. These usually include employment law, personal data protection, criminal law, whistleblower protection, civil law, professional secrecy, and sector-specific compliance rules.

For international businesses, the main risk is not only whether misconduct occurred. The investigation itself can create exposure. Poor evidence handling, unlawful access to employee communications, excessive data collection, or badly drafted findings may affect litigation, regulatory proceedings, employee disputes, and reputation.

A defensible investigation should therefore define the mandate, scope, decision-makers, data categories, interview rules, evidence preservation method, confidentiality level, and reporting line before substantial steps are taken.

Workplace investigation Poland legal issues: employment law boundaries

In workplace cases, the employer must consider the Polish Labour Code. Employees have duties including compliance with work organisation, following lawful instructions, protecting the employer’s interests, and keeping confidential information secure under Article 100 of the Labour Code [1]. These duties may justify requesting explanations or cooperation.

However, this does not give unlimited investigative powers. Interviews should not be coercive. The employee should know the general subject of the meeting, the role of the interviewers, and whether a record will be prepared. If disciplinary measures are considered, the employer must also observe statutory rules on employee liability and penalties, including Articles 108 and 109 of the Labour Code [1]. In cases of termination without notice due to employee fault, Article 52 of the Labour Code is particularly important, including the one-month deadline counted from the employer obtaining information justifying termination [1].

If the case concerns mobbing, discrimination, harassment, retaliation, or whistleblower treatment, the investigation should be especially balanced. The employer must protect the reporting person, the accused person, and witnesses from unnecessary exposure. Conclusions should distinguish confirmed facts from assessments.

Evidence handling Poland investigation: preservation without overreach

Evidence handling in Poland should be based on legality, necessity, proportionality, and traceability. GDPR principles under Article 5, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality, apply to personal data processed during an investigation [2].

Typical evidence may include emails, accounting files, access logs, CCTV recordings, contracts, invoices, chat records, HR documentation, and witness statements. Each category should be mapped to a legal basis. For ordinary personal data, Article 6 GDPR will usually be relevant. For special categories of data, Article 9 GDPR applies. For criminal offence data, Article 10 GDPR and relevant Polish legal provisions must be assessed [2], [3].

Monitoring is a frequent source of mistakes. Workplace CCTV is regulated by Article 22² of the Labour Code, and email monitoring by Article 22³ of the Labour Code [1]. These provisions require defined purposes and proper employee notification. Secret, broad, or retrospective searches of employee communications can create employment, privacy, and reputational risks.

Accessing private accounts, bypassing passwords, or obtaining information without authorisation may also create criminal law exposure, depending on the facts, including under Article 267 of the Polish Criminal Code concerning unlawful access to information [4].

Employee interviews Poland investigation: practical rules

Employee interviews should be prepared and documented carefully. The interview plan should identify the reason for the meeting, the topics, the documents to be shown, and whether the employee is a witness, reporting person, suspected participant, or manager with supervisory responsibility.

Good practice includes:

• using two interviewers where the matter is sensitive;
• avoiding leading questions where factual reconstruction is required;
• recording whether the interviewee received confidentiality instructions;
• allowing corrections to interview notes where appropriate;
• not promising full anonymity if legal, regulatory, or court proceedings may require disclosure;
• separating legal conclusions from factual statements.

Polish law does not generally require that every workplace interview be conducted with a lawyer present. However, legal participation is often important where criminal exposure, management liability, regulated activity, whistleblower retaliation, or future litigation is possible.

Privilege and confidentiality Poland: do not assume common law privilege

Privilege and confidentiality in Poland differ from common law concepts. Legal professional secrecy applies to advocates and attorneys-at-law under Article 6 of the Law on the Bar and Article 3 of the Act on Attorneys-at-Law [5], [6]. In criminal proceedings, additional rules apply, including Articles 178 and 180 of the Code of Criminal Procedure [7].

This means that investigation materials should be structured from the beginning. If the purpose is legal advice or defence strategy, the mandate, communication channels, document labels, circulation list, and storage rules should reflect that purpose. Not every document prepared by a company during an investigation will automatically be protected.

Confidentiality also has limits. Where permitted by law, three practical grounds should be documented before delaying notification, limiting access, or conducting discreet evidence preservation: (1) immediate notice would create a real risk of destruction or alteration of evidence; (2) immediate notice would create a real risk of witness coordination, retaliation, or intimidation; (3) immediate notice would undermine a legal duty or defensible regulatory/criminal strategy, for example preservation of secrecy in a pending notification or authority request.

These grounds are not blanket exemptions. They require factual justification and should be reviewed as the investigation progresses.

Whistleblowing, AML, anti-corruption, and regulatory risk

Where the investigation starts from a whistleblower report, the Polish Act on the Protection of Whistleblowers of 14 June 2024 may apply [8]. Companies covered by the Act must handle internal reports through proper channels, protect confidentiality, and prevent retaliation. The investigation report should not expose the whistleblower unless legally justified.

In AML-sensitive sectors, internal findings may also raise duties under the Act on Counteracting Money Laundering and Terrorist Financing [9]. In corruption, fraud, or market abuse cases, the company may need to assess whether a notification to public authorities is required or strategically advisable. Under Article 304 of the Code of Criminal Procedure, everyone has a social duty to notify authorities of an offence prosecuted ex officio, while state and local government institutions have a legal duty in specified circumstances [7]. For private companies, the obligation depends on the factual situation, sector-specific rules, and whether a separate mandatory reporting duty applies, including under Article 240 of the Polish Criminal Code for selected serious offences [4].

Reporting findings Poland: how to write a defensible report

The final report should be useful for management and defensible in later proceedings. It should state the scope, methodology, evidence reviewed, persons interviewed, limitations, confirmed facts, unresolved issues, and recommended actions.

Risky wording should be avoided. A report should not present assumptions as facts or criminal labels as conclusions unless there is a clear legal basis and sufficient evidence. For example, “fraud”, “bribery”, “defamation”, or “forgery” may carry specific legal consequences under the Polish Criminal Code or Civil Code [4], [10]. A safer approach is to describe conduct, evidence, and legal qualification separately.

Where reputation is at stake, external communication should be coordinated with legal risk. Polish civil law protects personal rights, including reputation and, for legal persons, business goodwill, under Articles 23, 24, and 43 of the Civil Code [10]. Public allegations made before facts are verified can trigger separate disputes.

Managing investigation outcomes

After findings are issued, the company should decide whether to take employment measures, remediate controls, notify authorities, recover losses, update compliance procedures, or prepare litigation. Data retention should also be reviewed. Investigation files should not be kept indefinitely without a documented purpose under GDPR storage limitation rules [2].

For international groups, cross-border transfers of investigation materials should be assessed under GDPR Chapter V, especially where data is sent outside the European Economic Area [2]. Group policy does not override Polish and EU legal requirements.

For case-specific support with an internal investigation Poland project, contact the law firm through Lawyersinpoland.com by Kopeć & Zaborowski.

FAQ: Internal investigations in Poland

Can an employer in Poland conduct an internal investigation?

Yes. Polish law does not prohibit internal investigations. The employer must, however, respect employment law, GDPR, privacy rights, whistleblower rules, and criminal law boundaries.

Can employee emails be reviewed during an investigation in Poland?

Yes, but only within legal limits. Email monitoring is regulated by Article 22³ of the Labour Code. The employer must have a lawful purpose, proper internal rules, and prior employee notification.

Are internal investigation reports privileged in Poland?

Not automatically. Legal professional secrecy may apply where advocates or attorneys-at-law provide legal advice or defence-related work. The scope depends on the mandate, document purpose, recipients, and procedural context.

Can employees refuse to participate in interviews?

It depends on the circumstances. Employees have duties under Article 100 of the Labour Code, but interviews cannot be coercive. Criminal exposure, personal rights, and procedural fairness must be considered.

Should the accused employee receive all evidence?

Not always. Disclosure depends on the stage, type of case, employment consequences, confidentiality duties, data protection rules, and risk to witnesses or evidence. The decision should be documented.

How long can investigation documents be retained?

There is no single retention period for all cases. Under GDPR, documents should be retained only as long as necessary for defined purposes, such as employment decisions, litigation defence, regulatory obligations, or remediation.

Bibliography

1. [1] Polish Labour Code of 26 June 1974.
2. [2] Regulation (EU) 2016/679 of the European Parliament and of the Council, General Data Protection Regulation.
3. [3] Polish Act on Personal Data Protection of 10 May 2018.
4. [4] Polish Criminal Code of 6 June 1997.
5. [5] Law on the Bar of 26 May 1982.
6. [6] Act on Attorneys-at-Law of 6 July 1982.
7. [7] Polish Code of Criminal Procedure of 6 June 1997.
8. [8] Polish Act on the Protection of Whistleblowers of 14 June 2024.
9. [9] Polish Act on Counteracting Money Laundering and Terrorist Financing of 1 March 2018.
10. [10] Polish Civil Code of 23 April 1964.