Whistlelink webinars – a practical guide to whistleblowing Register now
Whistlelink webinars – a practical guide to whistleblowing Register now
Last updated:
UK whistleblowing protection changed on 6 April 2026. Sexual harassment is now expressly included as a qualifying disclosure under UK whistleblowing law, making it important for employers to review their policies, internal reporting channels and case handling processes.
Whistlelink helps organisations provide secure, confidential reporting channels with structured case management, anonymous follow-up and clear documentation — supporting a trusted speak-up process for employees and stakeholders.
UK whistleblowing law protects workers who raise certain concerns about wrongdoing in the public interest. The main UK framework is based on the Public Interest Disclosure Act 1998, commonly known as PIDA, together with relevant provisions in employment law.
Unlike EU member states, the UK is not subject to the EU Whistleblowing Directive. This means UK employers are not following the same legal framework as organisations in the EU. However, they still need reliable internal processes for receiving, assessing and documenting whistleblowing reports.
For employers, this means more than simply having a policy in place. A trusted whistleblowing process should make it clear what can be reported, who can report, how reports are handled, and how workers are protected from retaliation. See also the GOV.UK guidance on whistleblowing.
If your organisation operates across both the UK and the EU, your whistleblowing setup should reflect both frameworks. Whistlelink helps organisations manage internal reporting channels, case handling and follow-up across multiple jurisdictions. For the EU side, see our overview of national whistleblowing laws across the EU.
PIDA, the Public Interest Disclosure Act 1998, is the key UK legislation protecting workers who make certain disclosures of information in the public interest. A protected disclosure is a qualifying disclosure made by a worker in accordance with the legal requirements.
For employers, this means whistleblowing reports should be handled through a clear and consistent process. Concerns may relate to legal obligations, health and safety, financial misconduct, environmental damage, safeguarding, governance or the concealment of wrongdoing.
A report may start as a simple concern, but it can quickly become a protected disclosure if it relates to wrongdoing in the public interest. Secure reporting channels, structured case management and clear documentation help employers respond appropriately from the start.
| Grievance | Protected disclosure | |
|---|---|---|
| What it concerns | The worker’s own employment — pay, contract, treatment or working conditions | Wrongdoing that affects others, raised in the public interest |
| Whose interest | Personal | Public |
| Typical subject | A dispute with a manager, terms of employment, individual treatment | Criminal offences, breach of a legal obligation, health and safety, environmental damage, miscarriages of justice, concealment |
| Legal basis | The employment contract and the employer’s grievance procedure | PIDA 1998, through the Employment Rights Act 1996 |
| Who can raise it | Employees, under the grievance policy | Workers — a wider group, including agency staff, contractors and trainees |
| Protection when raised | Ordinary employment rights apply | Protection from detriment and automatic unfair dismissal, with no minimum service requirement |
| Can it be anonymous | Not normally — the process depends on identifying the complainant | Yes, though anonymity limits follow-up |
| Where it goes | Line manager, then HR | The whistleblowing channel, or a prescribed person or regulator |
A single concern can be both. A worker may raise a personal grievance that also discloses wrongdoing in the public interest — where that happens, the whistleblowing route and its protections still apply.
UK whistleblowing protection applies to a broad range of workers, not only permanent employees. This can include employees, agency workers, trainees and others who raise concerns in a work-related context.
For employers, this means internal reporting processes should be accessible, easy to understand and clearly communicated across the organisation. Workers need to know where to report concerns, what information to include, and what will happen after a report has been submitted.
A clear whistleblowing process also helps managers, HR, legal and compliance teams respond consistently, protect confidentiality and reduce the risk of retaliation.
A Whistleblowing process is only effective if people know it exists and feel safe using it. Clear reporting channels, simple instructions and confidential follow-up help build trust from the start.
To qualify for whistleblowing protection, a disclosure must usually relate to certain types of wrongdoing and be made in the public interest. These are often referred to as qualifying disclosures.
Qualifying disclosures may include concerns about criminal offences, failure to comply with a legal obligation, miscarriages of justice, dangers to health and safety, damage to the environment, or attempts to conceal information about these types of wrongdoing.
From an employer’s perspective, reports may come from many different parts of the organisation. A concern could involve financial misconduct, health and safety risks, safeguarding issues, environmental harm, harassment, discrimination, corruption or governance failures.
This is why internal reporting channels should be structured enough to capture the right information, while remaining simple enough for workers to use with confidence.
Examples of concerns that may be reported include:
Sexual harassment was added to this list in 2026 — see what changed in 2025 and 2026.
A secure whistleblowing system helps organisations collect reports consistently, protect the identity of reporters where appropriate, assign cases to the right people and document each step of the process.
UK whistleblowing law itself has changed less than the landscape around it. Five dates over two years have altered what employers are expected to be able to show.
Section 23 of the Employment Rights Act 2025 added sexual harassment to the categories of qualifying disclosure under section 43B of the Employment Rights Act 1996, with effect from 6 April 2026. This means that workers who make a sexual harassment disclosure can be protected from detriment and unfair dismissal, provided the legal conditions are met.
Previously, workers often had to argue that a sexual harassment disclosure fell under another category of wrongdoing, such as a danger to health and safety. The new change makes the position clearer by explicitly recognising sexual harassment as a matter that can fall within whistleblowing protection.
For UK employers, this makes it important to review how sexual harassment concerns are received, escalated, investigated and documented. A trusted internal reporting channel can help workers raise concerns safely, while giving HR, legal and compliance teams a structured way to manage sensitive cases.
Sexual harassment reports can involve both workplace conduct and legal risk. A secure whistleblowing system helps employers manage sensitive disclosures consistently, protect confidentiality and create a clear audit trail from the first report to final outcome.
If your organisation is authorised by the Financial Conduct Authority, a second change matters as much as the first.
The detailed whistleblowing rules in SYSC 18 — internal arrangements able to handle any disclosure, anonymous reporting, and a Whistleblowers’ Champion with board-level oversight — have applied since 2016, but only to the larger end of the sector: SMCR banking firms, Solvency II insurers and UK MiFID investment firms.
The FCA’s non-financial misconduct regime, set out in PS25/23 and effective from 1 September 2026, goes considerably further. Bullying, harassment and violence in the workplace become a conduct matter the FCA can act on at every FSMA Part 4A authorised firm — which includes mortgage brokers and advisers, independent financial advisers, insurance brokers and intermediaries, consumer credit firms, payment and e-money firms, and claims management companies.
This does not create a duty for smaller firms to operate a formal whistleblowing channel. That requirement still sits in SYSC 18, and still applies only to larger firms. What it does mean is that any authorised firm needs to be able to show how a concern of this kind reached it, and what it did about it.
Read alongside the April change, the same complaint can now be a conduct matter and a protected disclosure at the same time — with statutory protection for the person who raised it, and uncapped compensation if they are treated badly for having done so.
We have written a separate guide covering SYSC 18, the 1 September change and what smaller authorised firms actually need to have in place.
The Economic Crime and Corporate Transparency Act 2023 created a corporate offence of failing to prevent fraud, in force since 1 September 2025. It applies to organisations meeting two of three tests — more than 250 employees, more than £36m turnover, or more than £18m in total assets — assessed across the whole group.
Liability is strict. The only defence is having had reasonable fraud prevention procedures in place, and the Home Office’s statutory guidance addresses whistleblowing directly: organisations should have appropriate whistleblowing arrangements, including independent channels and protection for those who use them.
For a large but unlisted UK organisation that has never been subject to any whistleblowing requirement, this is the most significant of the recent changes.
30 October 2026. The preventative duty on sexual harassment is strengthened and extended to harassment by third parties. The Equality and Human Rights Commission’s guidance already advises employers to consider a reporting system that allows concerns to be raised anonymously or in name.
6 April 2026. HMRC’s strengthened reward scheme now pays informants between 15% and 30% of tax recovered in cases above £1.5m. For the first time, an insider has a direct financial reason to go outside the organisation rather than inside it.
UK whistleblowing law does not only affect how organisations respond after a report has been made. It also affects whether workers feel safe enough to raise concerns internally in the first place.
If employees, contractors or other workers do not trust the internal process, they may be more likely to report concerns externally, including to regulators, prescribed persons or other authorities. This can increase legal, reputational and operational risk for the organisation.
A clear internal whistleblowing process gives people a safe route to raise concerns early. It also gives employers a structured way to assess the report, involve the right people, protect confidentiality and document how the case has been handled.
A reporting channel should make it clear what can be reported, whether reports can be anonymous, who receives the report, how follow-up works and how the organisation protects people from retaliation. Read how we secure whistleblower data.
For what this means in practice, see what UK employers should do now.
Now that the 2026 changes are in force, UK employers should review their whistleblowing policy, internal reporting channels and case management process.
A strong whistleblowing setup should help workers understand where to report concerns, while giving HR, legal and compliance teams the tools they need to handle sensitive disclosures consistently.
UK employers should consider whether they have:
Since 1 September 2026 there is a simpler test behind all of this. If a conduct concern arose tomorrow, could you show what happened to it? An organisation that can answer that is in a materially stronger position than one with a policy and no record.
Whistlelink helps organisations provide secure and confidential internal reporting channels that are simple for workers to use and easy for responsible teams to manage.
Our solution is also designed for organisations operating across multiple jurisdictions. If your business has both UK and EU operations, the system can support consistent internal reporting and case management while allowing your organisation to adapt its process to different legal environments.
No. The UK is not subject to the EU Whistleblowing Directive. UK whistleblowing protection is based on the UK legal framework, including PIDA and rules on protected disclosures. Organisations operating in both the UK and the EU should make sure their whistleblowing process reflects both frameworks.
PIDA stands for the Public Interest Disclosure Act 1998. It is the key UK legislation that protects workers who make certain disclosures of information in the public interest.
A protected disclosure is a qualifying disclosure made by a worker in accordance with the legal requirements. For the types of wrongdoing that qualify, see what can be reported.
Since 6 April 2026, sexual harassment is expressly a qualifying disclosure under UK whistleblowing law. Full detail is in what changed in 2025 and 2026.
If your firm holds FCA permissions, yes. From that date the FCA’s conduct rules on bullying, harassment and violence reach every authorised firm, not only the larger firms covered by SYSC 18. It does not require you to have a formal whistleblowing channel — but you should be able to show how a concern reached you and how it was handled.
If your organisation meets two of three tests — more than 250 employees, more than £36m turnover, or more than £18m in total assets, assessed group-wide — then yes, and it has applied since 1 September 2025. The only defence is reasonable fraud prevention procedures, and the Home Office guidance treats whistleblowing arrangements as part of that.
Anonymous reporting can help workers feel safer when raising sensitive concerns. For employers, anonymous two-way communication can be valuable because it allows follow-up questions while protecting the reporter’s identity.
Yes. Whistlelink supports UK organisations with secure internal reporting channels, anonymous follow-up, structured case management and clear documentation. It is also suitable for organisations operating across both the UK and the EU. You can try it free for 30 days.
Ready to strengthen your UK reporting process?
Whether you are reviewing your whistleblowing policy or managing reporting across both the UK and EU, Whistlelink helps you create a secure and trusted internal reporting process.
Annelie Demred
annelie.demred@whistlelink.com
30-minute demo — no commitment.
Nice to meet you!
Questions about which plan is right for your organisation, or how to get the most out of Whistlelink?
→ Or go to our page with Frequently Asked Questions
Do you need quick answers about the product or are you experiencing any issues? We’re here to help.
For confidentiality and data protection reasons, do not share personal data or details relating to specific whistleblowing cases. Submissions containing such information will be deleted.
Whistlelink values your privacy. We will only contact you about our solutions.
HAPPY TO MEET YOU!
Whistlelink values your privacy. We will only contact you about our solutions.
You may unsubscribe at any time. For more info, please review our Privacy Policy
