Whistleblowing Policy: UK Employer Guide Including 2026 Changes

What Is Whistleblowing and Why Should UK Employers Care?

Whistleblowing is when a worker reports wrongdoing they have witnessed in the workplace. In UK law, these reports are called "protected disclosures" under the Public Interest Disclosure Act 1998 (PIDA), which amended the Employment Rights Act 1996.

Getting this wrong is expensive. Workers who are dismissed or subjected to detriment for whistleblowing can bring claims to an employment tribunal with no cap on compensation. There is no qualifying service period for these claims. A day-one employee has the same protection as someone with 20 years of service.

Beyond the legal risk, a clear whistleblowing policy builds trust. Workers who feel safe raising concerns internally are far less likely to go to external regulators, the press, or social media. For small and medium employers especially, handling a disclosure properly in-house is vastly preferable to having it play out in public.

The Legal Framework: Public Interest Disclosure Act 1998

PIDA sets out the rules for when a disclosure qualifies for protection. Employers need to understand three core elements: who can blow the whistle, what counts as a qualifying disclosure, and where the disclosure can be made.

Who Is Protected?

Protection extends beyond employees. It covers:

• Employees (full-time and part-time)
• Workers, including agency workers and contractors
• Apprentices
• NHS practitioners, police officers, and trainees

Genuinely self-employed individuals are not covered, but the test is the real nature of the working relationship, not whatever the contract says. If you engage someone as a contractor but they function as a worker, they likely have whistleblowing protection. For more on these distinctions, see our guide to employment status.

What Counts as a Qualifying Disclosure?

A qualifying disclosure is any disclosure of information that, in the reasonable belief of the worker, is made in the public interest and tends to show one or more of the following:

1. A criminal offence has been committed, is being committed, or is likely to be committed
2. A legal obligation has been or is being breached
3. A miscarriage of justice has occurred or is likely to occur
4. Health and safety of any individual has been, is being, or is likely to be endangered
5. The environment has been, is being, or is likely to be damaged
6. Information tending to show any of the above has been, is being, or is likely to be deliberately concealed

Since April 2026, the Employment Rights Act 2025 has added a seventh category: sexual harassment in connection with work. More on this below.

The worker does not need to be right about the wrongdoing. They need a "reasonable belief" that the information tends to show one of these things, and the disclosure must be made in the public interest.

Where Can the Disclosure Be Made?

PIDA creates a tiered system of protection. Disclosures to certain recipients attract stronger protection:

• Employer or responsible person: The broadest protection. The worker only needs reasonable belief that the information tends to show wrongdoing.
• Legal adviser: Disclosures made in the course of getting legal advice are always protected.
• Prescribed persons: Regulators like the HSE, CQC, FCA, HMRC, or the Information Commissioner. The worker must reasonably believe the information is substantially true.
• Wider disclosures (media, MPs, police): Protected only if additional conditions are met, including that the worker reasonably believed they would be subjected to detriment by their employer, or that evidence would be concealed or destroyed.

The clear takeaway for employers: make internal reporting easy and safe. If workers trust the process, they will come to you first.

The 2026 Change: Sexual Harassment as a Qualifying Disclosure

The Employment Rights Act 2025 introduced a significant change that came into force in April 2026. Sexual harassment in connection with work is now a qualifying whistleblowing disclosure.

What This Means in Practice

Before April 2026, a worker reporting sexual harassment might have qualified for whistleblowing protection if the conduct also amounted to a criminal offence or a breach of a legal obligation. That required the worker to frame their complaint in those terms, and it left gaps.

Now, any worker who discloses information that, in their reasonable belief, tends to show that a person has been, is being, or is likely to be subjected to sexual harassment in connection with work, is making a protected disclosure. Full stop.

This change works alongside the strengthened employer duty to prevent sexual harassment under the Worker Protection (Amendment of Equality Act 2010) Act 2023, which introduced a proactive duty to take reasonable steps to prevent sexual harassment. For a deeper look at that duty, see our guide to the sexual harassment employer duty.

What Employers Must Do

1. Update your whistleblowing policy to explicitly reference sexual harassment as a qualifying disclosure category
2. Train managers so they recognise that a report of sexual harassment may simultaneously be a protected disclosure
3. Review your sexual harassment and whistleblowing procedures to ensure they work together, not against each other
4. Ensure no detriment follows from a worker reporting sexual harassment, whether the report goes through your harassment procedure, your whistleblowing channel, or both

The overlap between harassment complaints and whistleblowing disclosures is real. A worker who reports that a colleague is sexually harassing another team member is blowing the whistle. Treat it accordingly.

What Must a Whistleblowing Policy Include?

There is no legal requirement to have a written whistleblowing policy. But not having one is a significant risk factor. Tribunals and regulators will look at whether you had a clear process. The absence of one suggests you were not taking the issue seriously.

A solid whistleblowing policy should cover:

Scope and Purpose

State clearly that the policy applies to all workers (not just employees), explain what whistleblowing is, and distinguish it from personal grievances. A grievance is about the worker's own treatment. A whistleblowing disclosure is about wrongdoing that affects others or the public interest.

Categories of Qualifying Disclosure

List all seven categories, including the new sexual harassment category from April 2026. Use plain English. Workers should not need a law degree to understand when they are protected.

How to Raise a Concern

Provide multiple reporting channels:

• Named individuals: A senior manager or director who is not in the worker's direct line management
• Alternative contacts: In case the concern involves the named individual
• Anonymous reporting: Consider offering this, though encourage named reports where possible (they are easier to investigate)
• External routes: Mention the right to report to prescribed persons (regulators) and provide a link to the government's list of prescribed persons

Investigation Process

Explain what happens after a concern is raised:

• Who will investigate (and that it will not be someone implicated in the concern)
• Approximate timescales for acknowledgement and investigation
• How the worker will be kept informed
• That the focus is on the concern raised, not on the person raising it

Protection from Detriment

This is the most important part. State explicitly that:

• No worker will be subjected to any detriment for making a protected disclosure
• Detriment includes dismissal, disciplinary action, demotion, exclusion, or any other disadvantageous treatment
• Victimisation of whistleblowers will be treated as a serious disciplinary matter
• Workers who raise concerns in good faith will not face consequences even if the concern turns out to be unfounded

Confidentiality

Commit to protecting the identity of the whistleblower as far as possible. Be honest that in some cases (for example, if the matter goes to tribunal) complete confidentiality may not be achievable.

Record-Keeping

Keep a written record of all disclosures, investigations, and outcomes. This is your evidence that you took the matter seriously if it goes to tribunal.

Common Employer Mistakes with Whistleblowing

Treating It as a Grievance

A disclosure about health and safety risks or financial fraud is not a grievance. If a worker raises something that falls within the qualifying categories, it is a potential protected disclosure regardless of how they label it or which form they use. Train managers to spot the difference.

Subjecting the Whistleblower to Detriment

This does not just mean dismissal. Detriment includes anything that puts the worker at a disadvantage: being excluded from meetings, passed over for promotion, moved to less desirable duties, subjected to excessive scrutiny, or even just being cold-shouldered by colleagues. All of these can found a claim.

Focusing on the Messenger, Not the Message

Investigating whether the worker had an ulterior motive for blowing the whistle, rather than investigating the substance of the disclosure, is a common and costly error. The test is whether the disclosure was made in the public interest. Personal motivation does not automatically disqualify it.

Failing to Act on the Disclosure

Receiving a disclosure and then doing nothing is worse than not having a policy at all. It demonstrates that your process is window dressing. Investigate promptly and document what you find.

Ignoring Verbal Disclosures

A protected disclosure does not need to be in writing. A worker who tells their manager about safety concerns in a corridor conversation has made a disclosure. If that worker is later dismissed, the employer cannot argue it was not a real disclosure because no form was filled in.

Whistleblowing and the Disciplinary Process

One of the trickiest areas for employers is when a whistleblower is also subject to disciplinary proceedings. This can happen legitimately, but it requires extreme care.

If you are disciplining a worker who has made a protected disclosure, you must be able to demonstrate that the disciplinary action is entirely unconnected to the disclosure. If the timeline suggests otherwise (disclosure on Monday, disciplinary on Wednesday), a tribunal will draw inferences.

Best practice: document your reasoning thoroughly. If the disciplinary matter predates the disclosure, keep a clear paper trail showing that. If the disciplinary matter arises after the disclosure, consider whether it can wait, or whether proceeding risks a detriment claim. For guidance on running a fair process, see our guide to disciplinary procedures.

Whistleblowing for Small Employers

If you employ fewer than 50 people, you might think whistleblowing legislation does not apply to you. It does. There is no small employer exemption.

In fact, small employers face particular challenges:

• Fewer reporting channels (the "named individual" might be the person the concern is about)
• Closer working relationships make confidentiality harder
• Less HR resource to manage investigations

Practical steps for small employers:

• Designate an external contact: An accountant, solicitor, or HR consultant who can receive disclosures when the concern involves senior management
• Use your employee handbook: Include a whistleblowing section even if you do not have a standalone policy. Our guide to employee handbooks covers what to include
• Get advice early: If you receive a disclosure and are unsure how to handle it, take legal advice before acting. The cost of a solicitor's call is nothing compared to an uncapped tribunal award

Prescribed Persons: When Workers Go External

Workers have the right to make disclosures to prescribed persons (regulators) without first raising the concern internally. You cannot penalise them for this.

Key prescribed persons include:

• Health and Safety Executive (HSE): Workplace health and safety concerns
• Care Quality Commission (CQC): Health and social care services
• Financial Conduct Authority (FCA): Financial services misconduct
• Information Commissioner's Office (ICO): Data protection and privacy breaches
• HM Revenue and Customs (HMRC): Tax fraud, national minimum wage breaches
• Environment Agency: Environmental damage
• Gangmasters and Labour Abuse Authority (GLAA): Labour exploitation

The government maintains a full list of prescribed persons. Workers do not need to prove wrongdoing occurred when reporting to prescribed persons. They need only a reasonable belief that the information is substantially true and that the matter falls within that regulator's remit.

Your best defence against external disclosures is making internal reporting safe and effective. Workers generally prefer to resolve things internally. If they go external, it is usually because they do not trust the internal process.

How to Investigate a Whistleblowing Disclosure

When you receive a disclosure, follow these steps:

1. Acknowledge receipt within 5 working days, confirm who will be investigating, and set expectations on timescales
2. Assess the disclosure: Does it fall within the qualifying categories? If so, it is a protected disclosure regardless of how it was labelled
3. Appoint an investigator who is independent of the concern. In small organisations, this may need to be external
4. Investigate promptly and thoroughly: Interview witnesses, gather documents, preserve evidence
5. Keep the whistleblower informed of progress (without compromising the investigation)
6. Document everything: Your investigation report should set out the concern, the evidence gathered, findings, and recommended actions
7. Take action based on your findings, whether that means disciplinary proceedings, process changes, regulatory reporting, or concluding that the concern was unfounded
8. Confirm the outcome to the whistleblower in writing, explaining what you found and what action was taken (while respecting confidentiality of any disciplinary action against others)

Employer Audit: Is Your Whistleblowing Policy Compliant?

If you are unsure whether your current whistleblowing arrangements meet the legal requirements, particularly the 2026 changes, our free employer compliance audit can help you identify gaps and prioritise what needs updating.

Frequently Asked Questions

Q: Can we require workers to raise concerns internally before going to a regulator?

No. Workers have the legal right to make disclosures directly to prescribed persons (regulators) without first raising the matter internally. Any policy that requires internal reporting first, or that penalises external reporting, risks being found to subject the worker to a detriment. You can encourage internal reporting, but you cannot mandate it.

Q: Does a whistleblower have to be right about the wrongdoing for the disclosure to be protected?

No. The test is "reasonable belief," not proof. If a worker genuinely and reasonably believes that the information they are disclosing tends to show wrongdoing, the disclosure is protected even if the investigation concludes that no wrongdoing occurred. You must not subject them to any detriment for raising the concern.

Q: How does the new sexual harassment category interact with existing harassment complaint procedures?

A report of sexual harassment can now be both a harassment complaint and a protected disclosure simultaneously. Your harassment procedure deals with the complaint itself. Your whistleblowing protections ensure the person reporting it faces no detriment for doing so. Both sets of protections apply, and your policies should acknowledge this overlap explicitly.

Q: Are anonymous disclosures protected?

The legislation protects the worker making the disclosure, so in practice, protection requires the worker to be identifiable at some point (for example, if they bring a tribunal claim). However, anonymous disclosures should still be investigated on their merits. Your policy should allow anonymous reporting while noting that it may limit the scope of any investigation.

Q: What is the time limit for a whistleblowing claim at tribunal?

A worker must normally bring a whistleblowing claim within three months of the act of detriment or dismissal (minus one day). The tribunal can extend this if it was not reasonably practicable to bring the claim in time, but employers should not rely on limitation as a defence. If you have subjected a whistleblower to detriment, the claim is likely coming.

Q: We are a small employer with only 10 staff. Do we really need a whistleblowing policy?

Yes. There is no size exemption. Smaller employers face higher risk in some ways because closer working relationships make it harder to maintain confidentiality and impartiality. At minimum, include a whistleblowing section in your employee handbook and designate an external contact for concerns involving management.