A complete whistleblowing policy to copy and adapt: what counts as a concern, who can raise one, how, what happens in the first seven days and the first three months, and the protection the law gives. Written to the law of Great Britain (England, Wales and Scotland), with a bracketed line wherever Northern Ireland, the EU Directive or US law differs.
“The global leaders in whistleblowing software”
As seen in:
Fulham F.C.
Templates usually pick a jurisdiction. This one is written to the Employment Rights Act 1996 as amended by the Public Interest Disclosure Act, with a bracketed line wherever Directive 2019/1937 or US law asks for something different, so one policy serves a group with offices in both.
Acknowledge within seven days, feed back within three months. The Directive requires both, and the October 2026 UK consultation includes them in one of its two options. Section 4 commits to each, so the handler has a deadline and the reporter has a date.
A designated impartial person receives every concern, a named alternate takes it when the concern is about them, and anyone named in a report is kept out of it. Sections 4 and 5 say so in plain words, which is where the trust comes from.
[Organization] wants to hear about wrongdoing early. This policy explains what whistleblowing is, how to raise a concern, what happens next and how we protect you.
Whistleblowing is reporting wrongdoing at work that affects others: colleagues, customers or the public. Public interest generally means the wrongdoing affects others, not just you. A complaint about your own pay, contract or treatment is a grievance and belongs under [the grievance procedure], unless the wider public interest is engaged.
Under the Employment Rights Act 1996, which applies in Great Britain, a disclosure is protected when you reasonably believe it is in the public interest and that it tends to show one of the following, past, present or likely, in the UK or abroad:
This policy is open to everyone who works for or with [Organization]: employees, workers, contractors and consultants, agency staff, secondees, trainees, volunteers and former workers.
Whistleblowing law in Great Britain protects workers in the wide sense used by the Employment Rights Act 1996, including agency workers and some contractors. It does not clearly protect volunteers, non-executive directors or the self-employed in general. This policy covers them anyway.
[Northern Ireland: the Employment Rights (Northern Ireland) Order 1996 applies instead and differs in places, including the sexual harassment category and tribunal time limits. Check the current position for staff in Northern Ireland.]
[EU: Directive 2019/1937 applies to private entities with 50 or more workers (and to some financial services entities of any size) and, under Article 4, protects workers, the self-employed, shareholders, volunteers, trainees, former workers, applicants and anyone who helps a reporter.]
We would rather hear a concern early and in rough form than late and polished. Tell us what you saw, where and when, and who was involved.
You can report openly, confidentially (we know who you are and share it with no one beyond the people handling the report) or anonymously. Anonymous reports are welcome and assessed in the same way, but are harder to investigate and may limit the feedback we can give. [If the reporting system allows it: an anonymous reporter can read questions and updates using the reference it gives, without identifying themselves.]
[EU: under Article 7, Member States encourage internal reporting first where the breach can be dealt with effectively internally and the reporter sees no risk of retaliation. Under Article 10 you may also report directly to the competent authority.]
You can raise a concern:
Within seven days of receiving your concern we will acknowledge it in writing, wherever we have a way to reach you.
[The Compliance Lead] is the designated person who follows up every report. If a concern involves [the Compliance Lead], it goes instead to [the Chair of the Audit Committee]. The designated person sits outside the reporting line of anyone named and has no stake in the outcome.
The designated person assesses the concern, decides whether it needs an investigation, an immediate protective step, a referral elsewhere or no further action, and records the reason. Not every concern needs a formal investigation. Every concern gets an assessment, a decision and a record.
You will receive feedback within three months of the acknowledgment: what we did, what we found so far and what happens next. Where the law or confidentiality limits what we can share, we will say so.
You do not need to provide evidence for us to look into a concern, and you do not need to be right. An honest, reasonable belief is enough.
[Law: the seven-day and three-month periods are requirements of Article 9 of Directive 2019/1937. UK law does not yet set them. The government consultation published 12 October 2026 consults on a statutory duty, one of two options, that would include both for private employers with 50 or more employees and all public sector employers.]
If you tell us who you are, your identity is known only to the designated person and those who need it to handle the report. We will not pass it beyond that group without your consent, unless the law requires it, in which case we will tell you first wherever we can.
Anyone named in a report does not see it, is not told who made it and takes no part in handling it. [Where a case system is used: access to each case is restricted by role and every access is logged.]
We keep a record of every concern: when it arrived, who handled it, what was decided and why. Records are kept for no longer than is necessary and proportionate, which for us means [retention period] after the case closes, unless a legal hold, legal proceedings, a regulator's request or another legal requirement means we must keep them longer. Records are then deleted or anonymized.
[EU: Article 9 of the Directive requires the identity of the reporter and of any third party named in the report to be protected; Article 18 requires a record of every report, kept no longer than is necessary and proportionate.]
Nobody who raises a concern honestly under this policy will suffer for it. Victimization of a whistleblower is unacceptable at [Organization] and is treated as misconduct, whoever does it.
Detriment means any disadvantage because you reported: dismissal, demotion, a cut in pay or hours, a transfer, a poor appraisal or reference, withheld training, discipline, exclusion, harassment or threats. If you think it is happening to you, tell [the Compliance Lead] or [the HR Director]; it will be treated as a new concern, handled by someone who did not handle the first.
Under the Employment Rights Act 1996 a worker has the right not to be subjected to any detriment for making a protected disclosure (section 47B), and dismissal for that reason is automatically unfair (section 103A), with no minimum length of service and no cap on compensation. [EU: under the Directive, once a reporter shows that they reported and then suffered a detriment, the detriment is presumed to be retaliation and the organization must prove otherwise.] [US: Sarbanes-Oxley retaliation complaints go to the Department of Labor within 180 days.]
Protection depends on an honest and reasonable belief, not on being right. Someone who knowingly makes a false report, or uses this policy to harass a colleague, is not protected by it and may face [the disciplinary procedure]. An honest mistake is not a false report.
We hope you raise concerns with us first. You may also report, at any time and without telling us, to a prescribed person: a regulator named by the government for that type of wrongdoing. A report to a prescribed person is protected where you reasonably believe the matter falls within that body's remit and that the information is substantially true. Disclosures to the media or other outsiders are protected only in narrower circumstances, so take advice first. [FCA-authorised and PRA-authorised firms: you may report to the FCA or the PRA at any time; nothing in this policy or your contract prevents it.]
Free, confidential advice is available from the charity Protect's advice line, Acas, your trade union and gov.uk. No settlement agreement, contract or confidentiality clause can stop you making a protected disclosure; a term that tries to is not legally enforceable.
There are more than 90 prescribed persons on the gov.uk list. Examples:
Every worker is trained on whistleblowing law, this policy and the reporting routes on joining and every [two] years after that. Managers receive additional training on how to receive a concern, what not to do with it and how to recognize detriment. This policy is published on [the intranet] and summarized on [posters carrying the QR code] for people who do not sit at a desk.
The board, through [the Audit Committee], receives a report at least once a year on the concerns raised under this policy: how many, of what kind, how long each took to acknowledge and to conclude, the outcomes, and any complaint of detriment. The report does not identify reporters. [Banks, building societies, PRA-designated investment firms and insurers within SYSC 18, and Enhanced SM&CR firms: a senior manager is appointed whistleblowers' champion and oversees this report.] [Companies reporting against the UK Corporate Governance Code 2024: Provision 6 expects a confidential and, if wished, anonymous means to raise concerns, and board review of the arrangements and the reports arising from them.]
This policy is owned by [the Compliance Lead], reviewed yearly and whenever the law changes, and approved by [the board]. Version [1.0], approved [date]. Next review [date].
A starting point to adapt to your organization, not legal advice.
A policy is a set of promises. These six steps make each one true before the first concern arrives.
Book a demoEvery bracket is a decision. The designated person, the alternate for concerns about them, the committee that receives the annual report and the retention period are the ones that matter. A policy with a role in it that nobody holds is a policy that fails on day one.
Section 3 promises a web form, a voice message, a QR code and an email address. Set each one up, test it from a phone, and put the QR code where people without a desk will see it. Confide takes reports by all four and routes each to the people you name.
Section 5 says anyone named in a report never sees it. Decide now how that happens: who assigns cases, who can read them, and what stops a manager opening a report about their own team. In Confide, a user named in a report loses access to that case automatically, and every access is recorded in an audit trail that cannot be changed.
Seven days to acknowledge and three months to feed back only hold if someone is counting. Record both dates on each case the day it arrives, and have the designated person's manager see which cases are near the line.
Section 8 promises training for all workers and extra training for managers. Run it before the policy goes live, and give managers one clear instruction for the moment a concern lands with them: write it down, pass it to the designated person, say nothing to anyone else.
Put the annual report in the board calendar now, with the numbers section 9 lists. Review the policy on the same date each year, and sooner when the law moves: the 6 April 2026 sexual harassment category and the 1 October 2026 six-month tribunal time limit both changed what a policy for Great Britain should say.