How to-guide: Understanding the legal protections for whistleblowers (UK)

Introduction

This how-to-guide provides information for in-house counsel, private practice lawyers and human resources professionals working in England, Wales and Scotland (GB) about how to encourage, support and manage whistleblowing. This guide does not apply to Northern Ireland, where employment law is devolved to the Northern Ireland Assembly.

This guide covers:

Definition of whistleblowing
Legal framework
The importance of whistleblowing in corporate governance
Identifying and receiving whistleblowing reports
Handling whistleblowing reports

This guide can be used in conjunction with How-to guides: Overview of employment law (UK) and How to investigate workplace harassment complaints (UK).

Employers should be aware that the Employment Rights Bill 2024, introduced on 10 October 2024, aims to significantly enhance worker protections in the UK. Key provisions include granting day-one rights for unfair dismissal, paternity, parental, and bereavement leave, changes to sick pay and flexible working rights, protections against zero-hours contracts and restrictions on the use of ‘fire and rehire’ practices. New legislation will be introduced throughout 2025 and 2026. Further information can be found at UK Parliament: Employment rights bill and Employment Rights Bill: factsheets.

Section 1 – Definition of whistleblowing

Whistleblowing refers to an individual reporting certain types of wrongdoing, typically occurring within or related to the workplace, to someone in authority or to an external entity.

The disclosure of wrongdoing must be in the public interest, meaning (generally) that the wrongdoing affects others, such as the general public, customers, or colleagues, rather than being a personal grievance (such as an individual’s complaint about a term of their contract of employment). The law provides specific definitions and protections for whistleblowers, primarily through the Public Interest Disclosure Act 1998 (PIDA), and its incorporation into the Employment Rights Act 1996 (ERA).

Understanding the legal framework surrounding whistleblowing is crucial in understanding how an organisation should implement effective whistleblowing policies and procedures.

Section 2 – Legal framework

PIDA was introduced to protect workers who make certain disclosures in the public interest from detrimental treatment by their employers. Its aim is to ensure that whistleblowers can disclose information without fear of retaliation, provided that the disclosure meets certain legal criteria. These criteria have changed over the years and have been consolidated into the ERA, but generally a disclosure is protected if it relates to specific types of wrongdoing, including:

criminal offences (eg, fraud or corruption);
failure to comply with legal obligations;
miscarriages of justice;
endangering the health and safety of individuals;
environmental damage; and
deliberate concealment of information about any of the above.

(section 43B(1), ERA, as amended by PIDA)

These categories are designed to cover a wide range of serious issues that could impact the public. Whistleblower protection does not cover personal grievances (eg, bullying or harassment) unless they also have a wider public interest element.

2.1 Key terminology: qualifying disclosures and protected disclosures

In the context of whistleblowing, there are two terms that are often confused but which need to be understood as they are wholly separate concepts:

qualifying disclosures – these are disclosures of information that, in the reasonable belief of the worker making the disclosure, tend to show one or more of the types of wrongdoing specified in section 43B(1), ERA (as listed above). The disclosure must be made in the public interest; and
protected disclosures – a qualifying disclosure becomes a protected disclosure if it is made in a way that meets the specific conditions regarding to whom the disclosure is made, such as the employer, a legal adviser, or an appropriate regulatory body. These conditions are listed at sections 43C–43H, ERA.

2.2 Protections for whistleblowers

Whistleblower protection under the ERA (as amended by PIDA) is a ‘day-one right’, meaning that there is no qualifying period of employment needed to obtain such protection. Individuals who make disclosures on the first day they start work are protected, as are those who make disclosures before they have started work but are engaged by the organisation. Protection also extends to after employment has ended.

The primary protections provided by PIDA are against dismissal (for employees) and detriment (for the wider category of workers).

2.2.1 Detriment

Detriment, in this context, refers to any unfavourable treatment a worker (as defined by section 43K, ERA) might experience as a result of making a protected disclosure. This can include a wide range of actions, such as harassment, denial of promotion or training opportunities, demotion, reduction in pay, or exclusion from meetings and activities. Under PIDA, if a worker suffers any form of detriment because they have made a protected disclosure, they have the right to bring a claim against their employer or the individual employee they accuse of inflicting the detriment on them, in an employment tribunal (section 47B, ERA).

2.2.2 Dismissal

In addition to protection against detriment, PIDA also provides robust protection for employees against dismissal (section 103A, ERA). If an employee is dismissed because they made a protected disclosure, that dismissal is automatically considered unfair (regardless of the length of service of the employee). The employment tribunal has the authority to order reinstatement or compensation, which can be significant, particularly as there is no cap on the amount of compensation that can be awarded for unfair dismissal under PIDA.

An employment tribunal also has the power to order the re-employment of the whistleblower before the final hearing, if the tribunal panel are satisfied it is likely the whistleblower will win at the final hearing. Such an award is rare, but has huge financial consequences for the organisation that has to pay the whistleblower’s salary and benefits until the final hearing, which could be up to two years after the dismissal. If the whistleblower goes on to lose their claim at the final hearing, the salary and benefits paid over that period are irrecoverable.

In summary, PIDA provides significant protections for whistleblowers against both detriment and dismissal. These protections are contingent on the disclosure meeting the criteria set out in PIDA, including being a qualifying disclosure, being made through the correct channels, and being made in the public interest. Employers must be vigilant in ensuring that whistleblowers are protected and that any disclosures are handled in compliance with the legal framework provided by PIDA.

2.3 Other legal duties of employers

In addition to the specific obligations detailed above, employers have other legal obligations that may impact on the handling of whistleblowing reports, including in particular compliance with Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR) and the Data Protection Act 2018. Additionally, if the disclosure relates to criminal activity, employers may have a duty to report the matter to the appropriate authorities.

Employers should seek legal advice when handling complex whistleblower cases to ensure that they meet all their legal obligations and avoid potential pitfalls. By doing so, they can protect the rights of the whistleblower while also safeguarding the organisation from legal risks.

Section 3 – The importance of whistleblowing in corporate governance

Whistleblowing plays a critical role in maintaining transparency, accountability, and ethical standards within organisations. In the context of corporate governance, it serves as a vital mechanism for identifying and addressing wrongdoing that may not be immediately visible through regular oversight processes. Understanding the significance of whistleblowing is essential for fostering a corporate culture that encourages employees to speak up about unethical or illegal activities without fear of retaliation.

3.1 Ethical considerations

Whistleblowing is an ethical act. It involves an individual taking a stand against wrongdoing, often at great personal risk, to protect the interests of others or the integrity of the organisation. For organisations, whistleblowing is about upholding the values of honesty, integrity, and responsibility. Encouraging whistleblowing helps to create an environment where ethical behaviour is expected and rewarded, rather than punished. When employees see that their concerns are taken seriously and addressed promptly, it reinforces the organisation’s commitment to ethical practices. This, in turn, can enhance the organisation’s reputation, build trust with stakeholders, and reduce the risk of serious legal and financial repercussions that may arise from unaddressed wrongdoing.

Whistleblowing can also act as an early warning system, alerting the organisation to potential issues before they escalate into more significant problems. By addressing concerns at an early stage, organisations can mitigate the impact of wrongdoing, protect their assets, and avoid damage to their reputation.

3.2 Legal obligations and protections

In addition to the ethical priorities, there are clear legal reasons to encourage and facilitate whistleblowing.

3.2.1 Liability to whistleblowers

PIDA imposes a duty on employers to protect whistleblowers from retaliation and ensure that their disclosures are handled appropriately. Failure to comply with these legal requirements can result in serious consequences, including claims for unfair dismissal and uncapped compensation awards in employment tribunals.

Employers have a defence available to them in certain tribunal claims brought by whistleblowers against them for detriments the whistleblower suffered at the hands of a fellow worker. This defence requires the employer to establish that they took all reasonable steps to prevent the other worker from causing the detriment (section 47B(1D), ERA). This includes clear evidence of policies and processes in place in the workplace.

3.2.2 Corporate liability

Having an effective whistleblowing mechanism may also protect the organisation from other legal liabilities. For example, the Economic Crime and Corporate Transparency Act 2023 (ECCT) has just come into effect, and is poised to bring about considerable changes in UK corporate crime legislation. One key change under this law is the creation of a strict liability corporate criminal offence known as ‘failure to prevent fraud’. This will simplify the process of prosecuting organisations in instances where an employee or agent commits fraudulent activities. There is a defence to this strict liability offence where there the organisation has reasonable procedures in place to prevent fraud. Clear policies and channels for concerns to be raised will be at the heart of this defence.

Section 4 – Identifying and receiving whistleblowing reports

Identifying and dealing with whistleblowing reports is a key aspect of an organisation’s ability to effectively manage and address wrongdoing or unethical behaviour. This includes establishing robust procedures for recognising and handling whistleblowing.

Employers must ensure that whistleblowers are protected from any form of detriment or dismissal as a result of making a disclosure. Organisations should have clear, accessible policies and procedures in place for workers to report concerns, and these procedures must be communicated effectively to all staff.

Maintaining confidentiality is also an important part of a whistleblowing process, and employers must take steps to protect the identity of the whistleblower, unless disclosure is required by law or the whistleblower consents to their identity being revealed. Breaching confidentiality can lead to a loss of trust and may deter others from coming forward in the future.

4.1 Recognising whistleblowing disclosures

The first step in identifying whistleblowing disclosures is understanding what constitutes a whistleblowing disclosure (see 2.1 above). Organisations should ensure that all employees are aware of what qualifies as whistleblowing and what types of concerns they should report. This can be achieved through training programmes, clear communication, and accessible whistleblowing policies that outline the types of wrongdoing that should be reported and the procedures for making a disclosure.

Employees may express concerns or raise issues that, on the surface, may not appear to be whistleblowing but could in fact involve serious wrongdoing. Managers should be trained to flag such concerns and refer them to the appropriate department or individual responsible for handling whistleblowing reports.

4.2 Establishing and maintaining reporting channels

It is essential that the organisation has effective channels in place for employees to report their concerns. These reporting channels should be clearly defined, accessible, and well-communicated to all employees. They are the primary means by which employees can report wrongdoing, and their effectiveness can significantly impact whether employees feel comfortable coming forward with their concerns.

4.2.1 Internal vs. external reporting

When establishing reporting channels, organisations must decide whether to focus on internal reporting, external reporting, or a combination of both.

Internal reporting channels

Internal reporting channels are typically the first point of contact for whistleblowers within an organisation and allow employees to report concerns directly to their employer. Internal reporting is generally preferred because it enables the organisation to address issues quickly and discreetly, minimising the risk of public exposure and potential damage to the organisation’s reputation.

Internal reporting mechanisms include the following.

Dedicated whistleblowing hotlines: These can be telephone lines or digital platforms that are available 24/7. It is crucial that these hotlines are managed by trained personnel who understand the sensitive nature of whistleblowing disclosures and can handle them appropriately.
Designated whistleblowing officers: Appointing specific individuals or teams responsible for receiving and investigating whistleblower reports can streamline the process and ensure that reports are handled consistently and with the necessary level of expertise. These officers should be independent of the line management structure to ensure impartiality.
Online reporting systems: These platforms allow for anonymous reporting and can be particularly useful in encouraging employees who fear retaliation to come forward. Online systems can also provide employees with updates on the status of their reports, which can help build trust in the process.

External reporting channels

Easy access to external reporting channels is essential for cases where the whistleblower either feels uncomfortable reporting internally or believes that internal reporting would not be effective. This might involve disclosures to regulatory bodies, law enforcement, or even the media, depending on the nature of the wrongdoing, eg:

regulatory bodies, such as the Financial Conduct Authority (FCA) or the Health and Safety Executive (HSE) – these bodies have the authority to investigate and take action, which can provide an additional layer of accountability;
legal advisors – whistleblowers may seek advice from legal professionals before making a disclosure, particularly if they are unsure about the protections available to them or the appropriate channels to use; and
whistleblowing charities and support groups – organisations such as Protect (formerly Public Concern at Work) provide confidential advice to whistleblowers and can assist in guiding them through the reporting process.

4.2.2. Role of anonymous reporting systems

Anonymous reporting systems provide a means for employees to report concerns without revealing their identity, which can be crucial for encouraging whistleblowing in environments where fear of retaliation is high. However, anonymous reporting presents unique challenges that organisations must address to ensure that these reports are still effective.

Benefits of anonymous reporting

Encourages reporting: Fear of retaliation is one of the primary reasons employees hesitate to report wrongdoing. Anonymous systems can reduce this fear, making it more likely that employees will come forward with critical information.
Protects the whistleblower: Related to the above point, in cases where the whistleblower's identity could put them at risk of harassment, dismissal, or other forms of detriment, anonymity offers a level of protection that can be vital for their safety and wellbeing.
Increases the flow of information: Anonymous systems can lead to a higher volume of reports, as employees feel safer making disclosures. This can help organisations identify patterns of wrongdoing that might otherwise go unnoticed.

Challenges of anonymous reporting

Difficulty in investigating: One of the main challenges with anonymous reports is that investigators may find it difficult to gather additional information or clarify details without knowing the identity of the whistleblower. This can make investigations more complex and time-consuming.
Lack of credibility: Anonymous reports can sometimes be viewed with scepticism, particularly if there is no way to verify the credibility of the source. This may lead to valid concerns being dismissed or not fully investigated.
Limited feedback: Providing feedback to the whistleblower is an important part of maintaining trust in the reporting process. With anonymous reports, it can be challenging to inform the whistleblower of the outcome or any actions taken, which may discourage future disclosures.

Best practices for managing anonymous reporting systems

To address the challenges associated with anonymous reporting, organisations should implement best practices that maximise the effectiveness of anonymous reporting systems while minimising potential downsides, as follows.

Clear guidelines: Establish clear guidelines on how anonymous reports will be handled, including the steps the organisation will take to investigate such reports and the criteria used to assess their validity.
Encouragement to identify: While anonymous reporting should always be an option, organisations should encourage employees to provide their identity by reassuring them of the protections in place and the confidentiality of the process.
Robust follow-up procedures: Implement procedures to follow up on anonymous reports effectively, such as using a third-party service that allows anonymous two-way communication with the whistleblower. This can help investigators gather more information while maintaining the whistleblower’s anonymity.
Regular training: Provide regular training to those managing whistleblower reports on how to handle anonymous disclosures sensitively and effectively. This includes recognising the potential importance of anonymous tips and treating them with the seriousness they deserve.

Section 5 – Handling whistleblowing reports

Organisations should follow the steps below when they receive a complaint from a potential whistleblower.

5.1 Initial assessment of whistleblower reports

The initial assessment of whistleblower reports is a critical stage in the whistleblowing process. This process must be handled with utmost care, as it can significantly impact the outcome of the investigation and the treatment of the whistleblower.

Organisations should determine whether the whistleblower’s disclosure qualifies as a protected disclosure under PIDA (see 2.1 above). This determination involves evaluating several key factors, namely:

nature of the disclosure – does the information disclosed address one of the categories of wrongdoing outlined in PIDA;
public interest requirement – was the disclosure made in the public interest;
reasonable belief – the whistleblower must have a reasonable belief that the information they are disclosing is true and that it relates to one of the qualifying categories of wrongdoing; and
recipient of the disclosure – the validity of the disclosure also depends on to whom it was made.

Once this assessment has been carried out, organisations should carefully consider the appropriate next steps, as outlined at 5.2 below.

5.2 Next steps

The organisation must decide on the actions required to address the concerns raised. These actions should aim to ensure protection of the whistleblower’s rights while also safeguarding the interests of the organisation. The following steps are typically involved.

Acknowledge the report: This acknowledgment should be done in writing and should reassure the whistleblower that their concerns are being taken seriously. If the report was made anonymously, the organisation should use any available means, such as secure online platforms, to provide acknowledgment and updates to the whistleblower.
Assign a case manager: The case manager should be someone with the appropriate expertise, authority, and independence to oversee the investigation. This individual will be responsible for coordinating the investigation, communicating with the whistleblower, and ensuring that the process is fair and thorough.
Risk assessment: A preliminary risk assessment should be conducted to evaluate any immediate threats to the whistleblower or the organisation. This includes assessing the potential for retaliation against the whistleblower, the risk of evidence being tampered with or destroyed, and any urgent legal or regulatory obligations that may need to be addressed. If there is a significant risk of retaliation, steps should be taken immediately to protect the whistleblower, such as offering temporary relocation, adjusting duties, or providing additional security measures.
Preservation of evidence: This may involve locking down digital records, securing physical documents, or interviewing key witnesses before they are aware of the full details of the whistleblower’s report.
Consider preliminary suspension: Depending on the nature and severity of the allegations, the organisation may need to consider temporarily suspending individuals involved in the alleged wrongdoing. This decision should be made carefully, considering both the rights of the accused and the need to ensure a fair and unbiased investigation. Suspension should not be punitive but should be used as a precautionary measure to prevent interference with the investigation.
Engage legal and HR support: From the outset, it is important to involve both legal and human resources professionals in the process.
Establish a communication plan: Maintaining clear and consistent communication with the whistleblower throughout the process is vital. The communication plan should outline how updates will be provided, how confidentiality will be maintained, and what steps will be taken if the whistleblower experiences any form of retaliation. The goal is to keep the whistleblower informed and reassured without compromising the integrity of the investigation.
Investigate the concerns: The requirements for an investigation will vary depending on the nature of the complaint and the complexity of the issue. Detailed information about investigations is beyond the scope of this guide, but typically, workplace investigations involve a number of key steps, including gathering and reviewing physical evidence, interviewing witnesses and providing an outcome to the complainant.