The final deadline for setting up the internal reporting channels under the Reporting Persons Protection Act is approaching

Author: Nina Ličen

While private sector companies with 250 or more employees and public sector companies must already have internal reporting channels in place, this deadline is now approaching for private sector companies with up to 249 employees. They only have about a month left, namely until December 17, 2023, to set up internal reporting channels.

This deadline binds private sector companies, which are:

• entities with 50 or more employees;
• entities with fewer than 50 employees but at least 10 employees, if their main registered activity is in the specific fields of health, waste, sewage, water, secondary raw materials and environmental remediation; and
• entities with fewer than 50 employees, where such an obligation is imposed on them by laws or directly applicable regulations of the European Union relating to financial services, products and markets, the prevention of money laundering and terrorist financing, transport safety and environmental protection.

What are the requirements?

 Obliged entities must adopt an internal act prescribing the manner in which the report is to be submitted and the procedure for handling internal reports. The internal act must be easily accessible and transparent. It is essential that it sets out (i) the contact details for receiving reports; (ii) the measures to prevent unauthorised persons from gaining access to the information; and (iii) a trustee. The method of informing the internal organisational units responsible for remedying the breaches and the method of informing the management of the handling of the complaint should also be prescribed.

In order to protect the reporting person as much as possible, the obliged entity is required, among other things, to appoint a trustee whose role is to examine and deal with reports of infringements and to provide information to the reporting person, such as information on retaliation, protection, other procedures, etc. For the actual receipt and logging of the reports, the obliged entity may also designate administrative staff or an IT-based means of receiving and logging the reports.

For entities with fewer than 250 employees, these requirements are somewhat simplified, as they can share resources for receiving reports and investigating reported infringements.

The procedure for handling a report must ensure the completeness, integrity and confidentiality of the information and must prevent unauthorised persons of the obliged person from gaining access to the content of the report, the information about the reporting person and the persons concerned by the report.

For assistance in setting up the internal channel and drafting the internal act, and to avoid fines ranging from EUR 1,000 to EUR 6,000, feel free to contact us and we will be happy to assist you.