A worker says a safety record was altered, a manager concealed fraud or colleagues face repeated sexual harassment. Treating the report as an ordinary complaint can expose the organisation and the person who spoke up. Employers need a reliable way to recognise whistleblowing, protect the worker and examine the underlying risk.
Recognise the substance, not the label
Whistleblowing is a disclosure of information about wrongdoing that affects others. Under the Employment Rights Act 1996, the worker must reasonably believe the information tends to show a qualifying failure and that the disclosure is in the public interest. They do not need to use legal language, complete a particular form or prove the case before the employer takes it seriously.
Qualifying failures include a criminal offence, breach of a legal obligation, miscarriage of justice, danger to health and safety, environmental damage, and deliberate concealment of any of those matters. Since 6 April 2026, sexual harassment is also expressly included as a qualifying disclosure. The concern may relate to something that happened in the past, is happening now or is likely to happen.
Look at what the worker is communicating. An email headed 'complaint' could still allege that forklift checks were fabricated for every shift. A verbal report to a supervisor could still disclose that care records were altered. Managers should record the information and escalate it through the whistleblowing route even if the worker never mentions a protected disclosure.
Separate whistleblowing from a personal grievance
A personal grievance is usually about the individual's own employment, such as a disputed appraisal or relationship with a manager. It will not normally be whistleblowing unless the worker reasonably believes the issue is also in the public interest. The distinction depends on the content and wider effect, not which policy the worker selected.
The same report can contain both. A worker might complain that they were denied overtime and also allege that timesheets are routinely changed to avoid paying several colleagues. The personal remedy belongs in the grievance process; the wider alleged wrongdoing may require a whistleblowing investigation. Acas advises checking with the worker and, where necessary, operating both procedures.
Do not dismiss a concern as 'only a grievance' simply because the worker is personally affected. Confirm in writing how each part will be handled, who owns it and what information can be shared. This gives the worker a clear route without forcing them to make the legal classification themselves.
Protect the worker from detriment immediately
Workers must not be subjected to detriment because they made a protected disclosure. Detriment can include bullying, threats, unexplained loss of hours, blocked training or promotion, exclusion from normal work and damaging references. If an employee is dismissed because of whistleblowing, the dismissal is automatically unfair; Acas confirms that protection starts from the beginning of employment.
Give the worker a named contact and tell relevant managers that retaliation is prohibited. Consider interim safeguards without presenting them as punishment: reporting-line changes, separating subjects from evidence, preserving records and monitoring decisions about shifts, performance, training or promotion. Moving the whistleblower against their wishes can itself look detrimental, so discuss options before acting wherever possible.
Protection can extend beyond the employer's direct decisions. Acas warns that bullying or harassment by colleagues, contractors or people connected with the employer may create liability. Record alleged retaliation separately and respond promptly rather than waiting for the main investigation to finish.
Keep identity confidential, but do not promise secrecy
Acas says employers should keep the whistleblower's identity confidential. Limit access to people who genuinely need the information, store the report securely and avoid casual discussion. Tell the worker how their information will be handled and consult them if the investigation may reveal their identity.
Confidential does not mean that nobody will ever know. Evidence may point to its source, the subject may need enough detail to respond fairly, or a regulator or court may require information. Explain those limits instead of promising absolute anonymity that the organisation cannot deliver.
Anonymous reports should still be assessed on their substance. They can be harder to clarify and may restrict feedback, but anonymity is not a reason to ignore a credible safety, fraud or safeguarding concern. Provide more than one reporting channel so workers do not have to approach a manager who may be involved.
Set the right process before investigating.
HR + SAFETY can help separate the personal complaint from the wider concern, set confidentiality controls and brief the managers responsible for each route.
Discuss a whistleblowing concernInvestigate the wrongdoing, not the whistleblower's motive
Appoint somebody with sufficient independence, authority and subject knowledge. Define the allegations, immediate risks, evidence to preserve and any regulator or police involvement before interviews begin. Serious safety, safeguarding, financial or data concerns may require specialist advice and external notification alongside the internal process.
The investigation should test the disclosed information fairly. Secure documents and system records, speak to relevant witnesses, give the subject a proper opportunity to respond and keep an evidence-based chronology. Avoid asking the whistleblower to prove the whole case or conduct covert evidence gathering; Acas notes that gathering and removing documents may breach contracts or other laws.
Keep the whistleblower updated on progress and give appropriate feedback when the investigation ends. Confidentiality, data protection and fairness may prevent disclosure of disciplinary details, but the employer can normally confirm that the concern was examined and whether action was taken. Record reasons, findings, controls and follow-up dates.
Related guide: workplace investigation process → · Acas: responding to a whistleblowing disclosure ↗
Understand internal and external reporting routes
A worker will often raise the concern with the employer first, but the law also protects disclosures made through specified routes. These can include a legal adviser, a person responsible for the wrongdoing and an appropriate prescribed person or body. A prescribed regulator must match the subject: for example, a workplace safety concern may fall within the remit of HSE or the relevant local authority.
The current prescribed-person list was updated on 2 June 2026. Do not copy a regulator directory into a policy and leave it untouched; link to the current GOV.UK list and check the body's remit when a concern arises. Wider disclosure, such as to the media, carries stricter legal conditions and should not be described as an ordinary alternative channel.
A confidentiality or non-disclosure clause cannot lawfully prevent a protected whistleblowing disclosure. Managers handling settlements, exits or complaints should avoid wording or conduct that suggests otherwise.
Ten-point employer response checklist
Test the process using a realistic example. If a worker told a supervisor that safety inspections were being falsified, could the supervisor preserve the evidence, protect the worker and reach the right decision-maker that day? A policy that nobody can use under pressure is not an effective reporting route.
- Listen and record the information, even if the worker uses the wrong label.
- Check for a qualifying failure and a possible public-interest element.
- Identify any linked grievance, safeguarding, safety or regulatory process.
- Acknowledge the disclosure and name the person managing it.
- Control immediate risk and preserve relevant evidence.
- Protect confidentiality and explain its practical limits.
- Prevent and monitor detriment, including decisions made by other managers.
- Appoint an impartial investigator with suitable knowledge and authority.
- Keep the worker updated and provide appropriate outcome feedback.
- Record actions, review controls and update the whistleblowing policy and training.
A sound whistleblowing response identifies the public-interest concern, protects the person who raised it, investigates the evidence and corrects the underlying risk. Labels matter less than disciplined action and a clear record.
This guide provides general information for UK employers. It is not legal advice and should not replace advice based on the facts of a specific matter.