Whistleblowing policy requirements: what UK employers must include

Is a whistleblowing policy a legal requirement?

For most employers, no. The government's whistleblowing guidance for employers says you are not legally required to have a policy, but recommends one so workers know how to raise concerns and managers know how to respond.

The legal protection for whistleblowers applies whether or not you have a policy. Under Part IVA of the Employment Rights Act 1996 (inserted by the Public Interest Disclosure Act 1998), a worker who makes a protected disclosure has the right not to suffer detriment (s.47B), and dismissing an employee mainly for making one is automatically unfair. Employers are also liable for detriment caused by colleagues unless they took all reasonable steps to prevent it, and a clear policy with training is part of showing those steps.

Who is expected to have whistleblowing arrangements

• ●Certain financial services firms. Banks, building societies, insurers and some other firms regulated by the FCA and PRA must have whistleblowing arrangements under the FCA Handbook (SYSC 18); it is guidance for other regulated firms.
• ●NHS organisations in England are expected to adopt the national Freedom to Speak Up policy as a minimum standard.
• ●Large organisations within the failure to prevent fraud offence (in force from 1 September 2025) need reasonable fraud prevention procedures, and the Home Office guidance says these should include appropriate whistleblowing arrangements.
• ●Suppliers to the public sector. Buyers commonly ask for a whistleblowing policy in governance and ethics questions, and as part of showing how wrongdoing on the contract would be reported.

What a whistleblowing policy should include

Drawing on the government's guidance and Acas advice, a good policy covers:

• ●What whistleblowing is, and how it differs from a personal grievance.
• ●What counts as a qualifying disclosure (s.43B): a criminal offence, breach of a legal obligation, miscarriage of justice, danger to health and safety, damage to the environment, sexual harassment (added from 6 April 2026), or a cover-up of any of these, reasonably believed to be in the public interest.
• ●Who to contact (a named whistleblowing officer) and an alternative if the concern involves that person.
• ●How to raise a concern: in writing or verbally, openly, confidentially or anonymously, and that no proof is needed.
• ●How confidentiality is protected, and that anonymous concerns can be harder to investigate and give feedback on.
• ●How concerns are assessed and investigated, typical timescales and what feedback the person can expect.
• ●A clear statement that victimising a whistleblower will not be tolerated and is a disciplinary matter.
• ●External routes: the relevant prescribed persons (such as HSE, HMRC or the FCA), plus Protect, Acas and trade unions.
• ●That confidentiality clauses and NDAs cannot stop someone making a protected disclosure.
• ●Who the policy covers (employees, agency workers, contractors), how records are kept under UK GDPR, training, and the review date.

Whistleblowing vs grievance

What tender buyers look for

• ●A policy in your company's name, approved by a director and dated within the last 12 months.
• ●A named contact, and routes that cover subcontractors and agency workers on the contract.
• ●Reference to current law, including protection from detriment and prescribed persons.
• ●Consistency with your anti-bribery and modern slavery policies, which usually point to the whistleblowing route.

Get a whistleblowing policy for your business

Get a free tailored Whistleblowing policy in about three minutes: answer a few questions about your sector, team and reporting routes and we'll email you a PDF and Word version. Prefer it branded with your logo alongside your other policies? Use the Whistleblowing policy template in the generator. To see which other policies your tenders need, try the free tender policy checker.

Frequently asked questions