Whistleblowing policy.

What whistleblowing is, and what it is not

Whistleblowing is a worker raising a concern about wrongdoing that affects others. The law calls it making a disclosure, and the legal framework is the Public Interest Disclosure Act 1998, which inserted the protections into the Employment Rights Act 1996.

The distinction that causes most trouble is between whistleblowing and a grievance. A grievance is about how you personally have been treated. Whistleblowing is about wrongdoing affecting others, the organisation or the public. The same set of facts can produce both, and a policy should say what happens then rather than forcing a choice.

The distinction matters because the two follow different routes. Personal grievances go to the grievance policy; suspected wrongdoing that affects others goes to the whistleblowing policy and procedure. Most organisations describe both badly, and staff who cannot tell which applies tend to use neither.

Whistleblowing is also not the same as raising a safeguarding concern, though the two overlap constantly. In care and education, a concern about a colleague's conduct towards a service user is usually both, and a policy that does not connect to the safeguarding route leaves staff guessing which door to use.

What counts as a protected disclosure

Not every complaint is protected. For a disclosure to qualify, the worker must reasonably believe it is in the public interest and that it tends to show one of six categories of wrongdoing:

• a criminal offence
• a failure to comply with a legal obligation
• a miscarriage of justice
• a danger to the health and safety of any individual
• damage to the environment
• the deliberate concealing of any of the above

Two points are widely misunderstood. The worker does not have to be right: a reasonable belief is enough, and a concern raised in good faith that turns out to be mistaken is still protected. And the disclosure does not have to be made to the employer. A qualifying disclosure to a prescribed person, which for most sectors means the relevant regulator, carries the same protection.

A policy should name the prescribed person for your sector explicitly. Staff who cannot find it internally will find it externally, and it is better that they find the right one.

Who is protected, and from what

Protection covers workers, which is broader than employees: it includes agency workers, contractors, trainees and, since 2015 in health, certain applicants. It does not extend to genuinely self-employed contractors in most cases, and volunteers are not covered by the statutory protection at all, which is a real gap in charities and something a policy can close voluntarily.

The protections are against dismissal and against detriment. Detriment is broader than victimisation in the everyday sense: it covers being sidelined, denied training, moved shifts, excluded from a rota, or given a reference that does not match the file. It also covers detriment by a colleague, for which the employer can be liable.

A dismissal for making a protected disclosure is automatically unfair, with no qualifying period of service, and compensation is uncapped. That last detail is why boards should care about this policy specifically: an unfair dismissal claim of this kind carries no ceiling.

Whistleblowing law also protects the whistleblower from being disciplined for raising concerns. A disciplinary process opened against someone shortly after they make a disclosure is the pattern tribunals look for hardest, and the organisation will be asked to show the two were unconnected.

What a whistleblowing policy must include

The Whistleblowing Commission's code and the guidance from most regulators converge on the same content.

1. Who it covers. Say workers, and say whether you are extending it to volunteers and contractors.
2. What can be raised. The six categories in plain words, with examples from your own sector.
3. How to raise a concern. At least two internal routes, because the first is often the problem. A named alternative to the line manager is essential.
4. The external route. The prescribed person for your sector, named, with a link, and an explicit statement that using it is legitimate.
5. What happens next. Who receives it, the timescale for acknowledgement, who investigates, and what the person will be told about the outcome.
6. Confidentiality. What you can and cannot promise. See below.
7. Protection from detriment. A clear statement, and the route to raise a concern about retaliation.
8. Records. What is recorded and how long it is kept.
9. Board oversight. How and how often concerns are reported upwards, in anonymised form.

Confidentiality, and what you cannot promise

This is where policies most often overreach. Confidentiality is not anonymity, and neither can be guaranteed absolutely. An investigation may make the source obvious; a tribunal or a regulator may require disclosure; and a safeguarding concern may have to be shared regardless of the reporter's wishes.

The honest formulation is that you will not disclose the person's identity without their consent unless required to do so by law or by the nature of the investigation, and that you will tell them before you do. A policy promising unconditional confidentiality sets up the exact betrayal that stops the next person coming forward.

Anonymous disclosures should be accepted and taken seriously, while being clear that they are harder to investigate and that no protection from detriment can be offered to someone whose identity is unknown.

The concern that was raised, and cannot be shown

The failure mode is rarely the policy. It is that the first raising of a concern almost never arrives through the route the policy describes.

It starts as a message to a supervisor: "can I talk to you about something". A text on a Sunday evening. A question in a staff group chat about whether anyone else has noticed what has been going on. By the time anything reaches the formal channel, the person has usually tried twice already, informally, and those attempts are the ones that matter most.

They matter because the legal question in a detriment claim is what the employer knew and when. If a worker says they raised it in March and the organisation's records begin in July, the organisation is arguing against a gap in its own evidence. Those March messages sit on personal phones, on both sides, belonging to people who may since have left.

And the asymmetry cuts against the employer. A worker keeps their own messages; they will produce them. An organisation that cannot produce its side is not neutral in that exchange, it is silent. Where a concern was in fact handled well, the record that would prove it is the one nobody kept.

That is a records question rather than a policy one, and it is worth asking at your next board meeting whether the first raising of a concern lands anywhere your organisation could produce it from.

Where to read the official guidance

gov.uk's whistleblowing guidance covers the worker's position, and its list of prescribed people and bodies is the authoritative source for the external route. Acas publishes the most practical employer guidance, and the charity Protect runs a free advice line for both workers and employers.

This page is a summary, not legal advice. Whistleblowing disputes turn on their facts and reach tribunals; take proper advice on a live one.

Related guides

• Safeguarding in care homes: the six principles and the five Rs
• Conflict of interest policy: what it must include

All guides