Currently, authorisation is required for persons:

• processing special categories of personal data (article 221b § 3 of the Labour Code),
• handling internal reports and taking follow-up action (article 27(2) of the Whistleblower Protection Act).

The proposed amendment abolishes the requirement for authorisations to be in writing, permitting them to be documented in any form, provided that accountability is maintained in accordance with the GDPR.