Whistleblowing policy

What whistleblowing is, and what it is not

Whistleblowing is a worker raising a concern about wrongdoing that affects others. The law calls it making a protected disclosure, and the legal framework is the Public Interest Disclosure Act 1998, which inserted the protections into the Employment Rights Act 1996.

The distinction that causes most trouble is between whistleblowing and a grievance. A grievance is about how you personally have been treated. Whistleblowing is about wrongdoing affecting others, the organisation or the public. The same set of facts can produce both, and a policy should say what happens then rather than forcing a choice.

The distinction matters because the two follow different routes. Personal grievances go to the grievance policy; suspected wrongdoing that affects others goes to the whistleblowing policy and procedure. Most organisations describe both badly, and staff who cannot tell which applies tend to use neither.

Whistleblowing is also not the same as raising a safeguarding concern, though the two overlap constantly. In care and education, a concern about a colleague's conduct towards a service user is usually both, and a policy that does not connect to the safeguarding route leaves staff guessing which door to use.

What counts as a protected disclosure

Not every complaint is protected. For a disclosure to qualify, the worker must reasonably believe it is in the public interest and that it tends to show one of seven categories of wrongdoing:

• a criminal offence, such as fraud
• a failure to comply with a legal obligation
• a miscarriage of justice
• a danger to the health and safety of any individual
• sexual harassment
• damage to the environment
• the deliberate concealing of any of the above

Two points are widely misunderstood. The worker does not have to be right: a reasonable belief is enough, and a concern raised in good faith that turns out to be mistaken is still protected. And the disclosure does not have to be made to the employer. A qualifying disclosure to a prescribed person, which for most sectors means the relevant regulator, is protected too, but the bar is higher: the worker must also reasonably believe that the matter falls within that body's remit and that the information, and any allegation in it, are substantially true.

A policy should name the prescribed person for your sector explicitly. Staff who cannot find it internally will find it externally, and it is better that they find the right one.

Who is protected, and from what

Protection covers workers, which is broader than employees: it includes agency workers, contractors, trainees and, since May 2018, people applying for jobs with NHS employers. It does not extend to genuinely self-employed contractors in most cases, and volunteers with no enforceable contract are not usually covered by the statutory protection, which is a real gap in charities: a policy can open its routes to them and promise them the same treatment, though it cannot give them the legal protection.

The protections are against dismissal and against detriment. Detriment is broader than victimisation in the everyday sense: it covers being sidelined, denied training, moved shifts, excluded from a rota, or given a reference that does not match the file. It also covers detriment by a colleague, for which the employer can be liable.

A dismissal for making a protected disclosure is automatically unfair, with no qualifying period of service, and compensation is uncapped. That last detail is why boards should care about this policy specifically: an unfair dismissal claim of this kind carries no ceiling. The cap on the compensatory award in other unfair dismissal claims is removed where the effective date of termination is on or after 1 January 2027, when the qualifying period for ordinary claims also falls to six months; a whistleblowing dismissal still needs none.

Whistleblowing law also protects the whistleblower from being disciplined for raising concerns. A disciplinary process opened against someone shortly after they make a disclosure is the pattern tribunals look for hardest, and the organisation will be asked to show the two were unconnected.

What a whistleblowing policy must include

The Whistleblowing Commission's code and the guidance from most regulators converge on the same content. The government's own guidance for employers, published on 6 April 2026, lists what a typical policy may include, among them a clear statement that victimisation of whistleblowers is unacceptable, timeframes for handling disclosures and information about raising concerns with the relevant prescribed person.

1. Who it covers. Say workers, and say whether you are extending it to volunteers and contractors.
2. What can be raised. The seven categories in plain words, with examples from your own sector.
3. How to raise a concern. At least two internal routes, because the first is often the problem. A named alternative to the line manager is essential.
4. The external route. The prescribed person for your sector, named, with a link, and an explicit statement that using it is legitimate.
5. What happens next. Who receives it, the timescale for acknowledgement, who investigates, and what the person will be told about the outcome.
6. Confidentiality. What you can and cannot promise. See below.
7. Protection from detriment. A clear statement, and the route to raise a concern about retaliation.
8. Records. What is recorded and how long it is kept.
9. Board oversight. How and how often concerns are reported upwards, in anonymised form.

Confidentiality, and what you cannot promise

This is where policies most often overreach. Confidentiality is not anonymity, and neither can be guaranteed absolutely. An investigation may make the source obvious; a tribunal or a regulator may require disclosure; and a safeguarding concern may have to be shared regardless of the reporter's wishes.

The honest formulation is that you will not disclose the person's identity without their consent unless required to do so by law or by the nature of the investigation, and that you will tell them before you do. A policy promising unconditional confidentiality sets up the exact betrayal that stops the next person coming forward.

Anonymous disclosures should be accepted and taken seriously, while being clear that they are harder to investigate and that no protection from detriment can be offered to someone whose identity is unknown.

Whistleblowing in health and social care, and in safeguarding

Whistleblowing in health and social care means a worker raising a concern about the safety or quality of care, or other wrongdoing, at the service they work for: first inside the organisation and, if that fails or does not feel safe, with the regulator. In England the Care Quality Commission (CQC) is the prescribed person for “the provision of adult social care services in England” and for “matters relating to the provision of health and social care”, according to the government’s list of prescribed people and bodies, so a qualifying disclosure to CQC is protected on the conditions set out above. CQC’s page Report a concern if you are a member of staff says “If you’re employed by an organisation that we regulate and you have concerns about the care being provided by your employer, we want you to tell us”, that concerns can be raised anonymously, and that “All organisations that provide care must have whistleblowing procedures and must make them available to their employees” – a firmer line than the general position for employers in the introduction. It is equally clear about its limits: “We don’t have any powers to protect you from action taken against you by your employer.”

Examples of whistleblowing in a care home or home care service, set against the categories of wrongdoing in section 43B of the Employment Rights Act 1996:

• a resident being hit, shouted at, restrained without need, or left without food, drink or help – a danger to health and safety, and often a criminal offence;
• medication errors or falls left out of the records, or records altered after the event – deliberate concealment of information about a danger to health and safety;
• rotas that leave too few trained staff on shift to care for people safely – a danger to health and safety;
• charging for visits that did not happen, or misusing a resident’s money – a criminal offence;
• an incident the provider is legally required to notify to CQC that goes unreported – a failure to comply with a legal obligation;
• sexual harassment of staff or residents – a category in its own right since 6 April 2026.

In safeguarding the two routes meet. A concern that a child or adult is being harmed is raised through the safeguarding procedure; whistleblowing covers concerns about the organisation’s own safeguarding practice, and the outside routes open when the inside ones fail. Keeping children safe in education 2026 asks schools and colleges for “Appropriate whistleblowing procedures” so that staff can raise concerns about “poor or unsafe practice and potential failures in the school or college's safeguarding provision”, and names the NSPCC Whistleblowing Advice Line, 0800 028 0285, as “an alternative route for staff who do not feel able to raise concerns regarding child protection failures internally” (paragraphs 80 to 82). The NSPCC is the prescribed person for “matters relating to child welfare and protection”, and Ofsted for “matters relating to regulation and inspection of children’s social care”.

The concern that was raised, and cannot be shown

The failure mode is rarely the policy. It is that the first raising of a concern almost never arrives through the route the policy describes.

It starts as a message to a supervisor: "can I talk to you about something". A text on a Sunday evening. A question in a staff group chat about whether anyone else has noticed what has been going on. By the time anything reaches the formal channel, the person has usually tried twice already, informally, and those attempts are the ones that matter most.

They matter because the legal question in a detriment claim is what the employer knew and when. If a worker says they raised it in March and the organisation's records begin in July, the organisation is arguing against a gap in its own evidence. Those March messages sit on personal phones, on both sides, belonging to people who may since have left.

And the asymmetry cuts against the employer. A worker keeps their own messages; they will produce them. An organisation that cannot produce its side is not neutral in that exchange, it is silent. Where a concern was in fact handled well, the record that would prove it is the one nobody kept.

That is a records question rather than a policy one, and it is worth asking at your next board meeting whether the first raising of a concern lands anywhere your organisation could produce it from.

Questions people ask

What are the legal requirements for whistleblowing in the UK?

The legal requirement is about how a whistleblower is treated, not about having a policy: in Great Britain the Employment Rights Act 1996 protects a worker who makes a protected disclosure from detriment and, if they are an employee, from unfair dismissal. The government's guidance for employers says "You are not legally required to have a whistleblowing policy or to respond to whistleblowing disclosures", although it recommends a policy, and Northern Ireland has its own whistleblowing law.

What doesn't count as whistleblowing?

A personal grievance does not count as whistleblowing unless the particular case is in the public interest; GOV.UK says to report it under the employer's grievance policy instead. Going to the media is also usually outside the protection: Whistleblowing for employees: who to tell and what to expect warns that in most cases a worker who reports to the media will lose their whistleblowing law rights.

What qualifies you as a whistleblower?

You qualify as a whistleblower if you are a worker and you report certain types of wrongdoing, such as a crime, a danger to health and safety or a cover-up, that you reasonably believe is in the public interest. Employees, trainees and agency workers are covered, but the government's guidance for employers says volunteers, non-executive directors and most self-employed people are unlikely to be protected.

What is the Whistleblowing Act?

There is no Act of that name: the law usually meant is the Public Interest Disclosure Act 1998, which inserted the whistleblowing protections into Part IVA of the Employment Rights Act 1996, sections 43A to 43L. The latest change added sexual harassment to the wrongdoing a protected disclosure can show, from 6 April 2026, in section 43B(1)(da), inserted by the Employment Rights Act 2025.

Where to read the official guidance

gov.uk's whistleblowing guidance covers the worker's position, and its list of prescribed people and bodies is the authoritative source for the external route. Acas publishes the most practical employer guidance, and the charity Protect runs a free, confidential advice line for workers worried about wrongdoing at work, and a separate support service for employers.

This page is a summary, not legal advice. Whistleblowing disputes turn on their facts and reach tribunals; take proper advice on a live one.