How to Set Up a Whistleblowing Policy: UK Guide

A whistleblowing policy gives people a safe, trusted way to raise serious concerns about wrongdoing before they become scandals. Done well, it surfaces problems early, protects the people who speak up, and shows regulators and staff that an organisation takes integrity seriously.

Knowing how to set up a whistleblowing policy matters because the alternative, where employees stay silent or go straight to the press, is far more damaging. This guide explains the legal backdrop in the UK, what a good policy contains, how to build reporting channels people will actually use, and how to roll it out so it becomes part of the culture rather than a document nobody reads.

Start with the legal framework

In the UK, whistleblowing is governed by the Public Interest Disclosure Act 1998 (PIDA), which amended the Employment Rights Act 1996. It protects workers who make a "qualifying disclosure", a reasonable belief, in the public interest, that wrongdoing is happening, has happened or is likely to. Protected concerns include crime, breaches of legal duties, health and safety dangers, environmental damage and the cover-up of any of these. Workers who blow the whistle are protected from being dismissed or treated badly for it. Some sectors go further: financial services firms must maintain whistleblowing arrangements under the FCA and PRA rules.

What to put in the policy

A clear, plain-English policy is the foundation. It should cover:

Purpose and scope: who it applies to (employees, workers, and ideally contractors and agency staff) and what kinds of concern it covers.
What to report: examples of wrongdoing, and the difference between a whistleblowing concern and a personal grievance, which usually follows a separate process.
How to raise a concern: the internal and independent channels available, and what information helps.
Confidentiality and anonymity: how identity will be protected and how anonymous reports are handled.
Protection from retaliation: a firm commitment that no one will suffer for raising a genuine concern.
What happens next: how reports are assessed, investigated and fed back on.

Build reporting channels people trust

A policy is only as good as the routes it offers. Provide more than one: a named senior contact or designated officer, a route to the board or audit committee, and an independent option such as a confidential hotline or online portal run by a third party. Multiple channels matter because the concern may be about the very person an employee would normally report to. Make clear that workers can also approach the relevant "prescribed person", the regulator listed by the government for their sector, if internal routes are not appropriate.

Handle reports consistently

Set out a simple, repeatable process: acknowledge the report, assess it, investigate proportionately, act on the findings and, as far as confidentiality allows, tell the person who raised it what has happened. Keep records, protect the reporter's identity, and involve HR or legal advice where needed. Consistency is what turns a policy into something people believe in.

Roll it out and keep it alive

Publish the policy where everyone can find it, train managers on how to receive a concern without defensiveness, and have leaders talk about "speaking up" positively. Review it regularly, and track, in anonymised form, how many concerns come in and how they were resolved, so you can show it is working. A policy that is launched once and forgotten does little; one that is visibly used builds trust.

Whistleblowing sits alongside your wider integrity framework. To go deeper, see our guides to corporate compliance and what business ethics is, or return to the E-Business Ethics homepage. The charity Protect offers free, confidential advice on whistleblowing law and practice.

Frequently asked questions

Is a whistleblowing policy a legal requirement in the UK?

There is no blanket legal duty for every business to have a written whistleblowing policy, but the Public Interest Disclosure Act 1998 protects workers who raise concerns, and some regulators require one. Financial services firms, for example, must have whistleblowing arrangements under the FCA and PRA rules. A clear policy is strongly recommended for any organisation, because it channels concerns internally and evidences good governance.

What is a protected disclosure under PIDA?

A protected disclosure is a report by a worker who reasonably believes it is in the public interest and shows wrongdoing such as a criminal offence, a breach of a legal obligation, a danger to health and safety, damage to the environment, a miscarriage of justice, or the deliberate concealment of any of these. Workers who make a qualifying disclosure are protected from dismissal and detriment.

Should a whistleblowing policy allow anonymous reports?

It should allow them, while being honest about the limits. Anonymous reports can be harder to investigate, but refusing them discourages people from speaking up. Good practice is to accept anonymous concerns, offer a confidential route where identity is known only to a named contact, and make clear how confidentiality will be protected.

Who should whistleblowing concerns be reported to?

Your policy should set out an internal route first, usually a line manager, a designated senior officer or the board, plus an independent channel such as a confidential hotline. It should also tell workers they can go to a "prescribed person", the relevant regulator listed by the government, if raising it internally is not appropriate or has not been acted on.

How do you protect whistleblowers from retaliation?

State plainly that victimising or dismissing someone for raising a genuine concern is a disciplinary matter, keep the reporter's identity confidential as far as possible, limit who knows about the report, and follow up to check they have not suffered any detriment. Retaliation is both unlawful under PIDA and corrosive to the culture a policy is meant to build.