What is whistleblowing? Definition, examples and the law

Whistleblowing is the act of reporting suspected wrongdoing or a risk of wrongdoing, as ISO 37002, the international standard for whistleblowing management, defines it. Acas, the UK's workplace advice service, adds the test that matters in UK law: the wrongdoing must affect others, not only the person reporting it.

A whistleblower does not have to be right or bring proof. They only need to reasonably believe what they report. The first decision is whether a concern is whistleblowing at all, or a personal complaint that belongs in another process.

Suppose a finance manager notices that a contract in the accounts has been backdated. The money it records left the company and came back through two other entities. She tells the head of legal, and from that moment she is a whistleblower, whether or not anyone uses the word.

What whistleblowing is and is not

The UK government's guidance for workers says you are a whistleblower if you are a worker and you report certain types of wrongdoing.

The public interest is what separates whistleblowing from other complaints. A grievance is a concern about your own treatment, such as pay, hours or how your manager speaks to you. The government's guidance is direct: personal grievances are not covered by whistleblowing law, unless your particular case is in the public interest.

If your concern is personal only to you, it is unlikely to count. The public interest means it has to also affect others, such as other workers, customers or the general public. A customer complaint works the same way. It belongs in the complaints procedure unless it reveals wrongdoing that reaches further.

The two can overlap. In Chesterton Global v Nurmohamed, decided on 10 July 2017, the Court of Appeal held that a disclosure made in the worker's own interest can still qualify.

The EU Whistleblowing Directive, Directive (EU) 2019/1937 of 23 October 2019, uses different words. Its title refers to the protection of persons who report breaches of Union law, and its rules speak of the "reporting person" rather than the whistleblower. It defines retaliation as any direct or indirect act or omission in a work-related context that is prompted by a report. To count, the act must cause or be able to cause unjustified detriment to the reporting person.

What counts as wrongdoing

The UK sections of this guide cover Great Britain. Northern Ireland has its own whistleblowing law, which the 2026 changes do not amend.

In Great Britain, the test is whether the report is a qualifying disclosure under section 43B of the Employment Rights Act 1996. That is a disclosure of information that, in the worker's reasonable belief, is made in the public interest and tends to show one or more of the following:

• a criminal offence, fraud for example
• a failure to comply with a legal obligation
• a miscarriage of justice
• the health or safety of any individual being endangered
• sexual harassment that has occurred, is occurring or is likely to occur, added by the Employment Rights Act 2025 from 6 April 2026
• damage to the environment
• the deliberate concealment of any of these

The wrongdoing can be past, present or likely to happen, in the UK or abroad.

The EU Directive lists areas of EU law rather than kinds of wrongdoing:

• public procurement
• financial services, and the prevention of money laundering and terrorist financing
• product safety
• transport safety
• the environment
• radiation protection and nuclear safety
• food and feed safety, and animal welfare
• public health
• consumer protection
• privacy, personal data and network security

It adds breaches affecting the EU's financial interests and the internal market, including competition, State aid and corporate tax.

US federal law is built around investors: section 806 of the Sarbanes-Oxley Act protects an employee of a listed company who reports certain kinds of fraud. The information must concern mail, wire, bank or securities fraud, or a breach of a Securities and Exchange Commission (SEC) rule. Any provision of federal law relating to fraud against shareholders also counts. The report can go to a federal agency, to Congress or to a supervisor.

Safety, transport and food concerns have their own statutes. The Occupational Safety and Health Administration (OSHA) enforces 25 of them, and states add laws of their own.

Five examples of whistleblowing

The first example is a matter of public record. The other four are hypothetical cases that show how the law applies.

Wirecard: an internal report, then the press

In early 2018 a member of Wirecard's finance team in Singapore reported that a senior accounting executive was forging and backdating contracts. Pav Gill, then Head of Legal for Asia-Pacific, opened an investigation, and outside lawyers delivered a preliminary report on 4 May 2018. He was ordered to stand down, and an executive implicated in the probe was put in charge of it. On 30 January 2019 the Financial Times published the first story built on the documents.

A safety concern taken to the HSE

Suppose a warehouse worker tells her manager that the racking is overloaded and a bay collapsed overnight. Nothing changes, so she writes to the Health and Safety Executive (HSE). The HSE is a prescribed person under UK law, and its remit covers the health and safety of individuals at work.

Her disclosure is protected under section 43F, just as a report to her employer would be. To be protected, she must reasonably believe that the matter falls within the HSE's remit and that what she says is substantially true.

A sexual harassment report, now a protected disclosure

Since 6 April 2026, the law in Great Britain has treated a report of sexual harassment as a qualifying disclosure. That covers harassment that has occurred, is occurring or is likely to occur. The worker must reasonably believe the report is in the public interest.

Suppose a team member tells HR that a manager has harassed two colleagues and that others are at risk. Since the change, that person is a whistleblower under the Employment Rights Act as well as a complainant. The protection against detriment and dismissal follows.

A tip to the SEC under Dodd-Frank

Suppose an analyst at a listed company sees revenue booked before contracts are signed, and submits a tip to the SEC. If her tip is original information she gives voluntarily, and it leads to an enforcement action with sanctions above $1 million, she may be eligible for an award under the Dodd-Frank Act. The award is between 10 and 30 percent of what is collected. Reporting internally first does not cost her the award if she also reports to the SEC within 120 days.

In its 2025 financial year the SEC awarded more than $60 million to 48 individuals and received about 27,000 tips.

An internal report under the EU Directive

Suppose an engineer works at a German manufacturer with 300 staff. She reports through the company's internal route that a product failed a safety test and shipped anyway.

Within seven days she receives an acknowledgment of receipt. An impartial person or department follows up, and within three months she receives feedback on what was done. Her identity, and that of anyone she named, is kept from staff not authorized to see it. She could also have gone straight to the external authority, because the Directive does not require the internal route first.

Who is protected

UK whistleblowing law protects workers, a term wider than employees. Section 43K of the Employment Rights Act extends the protection to agency and supplied workers, and to contractors whose terms are set by the end user. It also covers NHS contracted practitioners and certain trainees.

Some groups are left out. The government's guidance says other self-employed people, volunteers, non-executive directors, the armed forces and intelligence staff are not likely to be protected. In Sullivan v Isle of Wight Council, on 3 April 2025, the Court of Appeal confirmed that external job applicants outside the NHS are not protected either.

That may change. A government consultation opened on 12 October 2026 and closes on 8 January 2027. It records that stakeholders want charity trustees, non-executive directors, volunteers, job applicants and certain self-employed people added.

The EU Directive covers most of those groups already. Its scope includes workers, civil servants among them, the self-employed and shareholders. It also covers members of management and supervisory bodies, including non-executives. Volunteers, trainees and anyone working under the supervision of contractors, subcontractors and suppliers are covered too.

The US has no single answer. Sarbanes-Oxley protects employees of listed companies and, since Lawson v FMR (2014), employees of their contractors and subcontractors. Dodd-Frank's anti-retaliation rule covers only those who have reported to the SEC. Federal employees have the Whistleblower Protection Act, and state laws fill some of the rest.

How to blow the whistle

1. Check the public interest. Ask who is affected beyond you. If the answer is other workers, customers, patients or the public, the concern is likely to qualify. If it is only you, raise it as a grievance.
2. Choose the route. Reporting to your employer (section 43C) or to a prescribed regulator (section 43F) does not require any prior step. Going wider, for example to the media, is protected only on stricter conditions under section 43G. These include a reasonable fear of detriment or of evidence being destroyed, or an earlier report that went nowhere.
3. Keep a record. Write down what you saw, when, and who you told. You do not need evidence to make a disclosure, but the record is what proves you made it and when.
4. Know the prescribed persons. These are the regulators and other bodies listed in law as able to receive a protected disclosure. The Financial Conduct Authority (FCA) covers regulated firms and markets, and the HSE covers safety at work. HM Revenue and Customs (HMRC) covers tax, and the Care Quality Commission (CQC) covers health and social care. The Serious Fraud Office (SFO) covers serious or complex fraud, and the government's list names more than 90 bodies in all.
5. Watch the time limits. Since 1 October 2026, a detriment claim in the employment tribunal must be brought within six months of the act, up from three. After a dismissal, interim relief, a tribunal order made before the full hearing, must be applied for within seven days.
6. Get advice before you need it. The government's own guidance names three sources: Acas, the charity Protect and your trade union. A clause in a contract or settlement agreement that tries to stop you making a protected disclosure is not legally enforceable.

What protection looks like

In Great Britain, a worker has the right not to be subjected to any detriment by the employer for making a protected disclosure. Dismissal for making one is automatically unfair under section 103A, with no qualifying period. The cap on ordinary unfair dismissal awards, £123,543 from 6 April 2026, does not apply. From 1 January 2027 the cap is removed for all unfair dismissals and the general qualifying period falls to six months.

The EU Directive prohibits any form of retaliation and lists fifteen forms. They run from dismissal through coercion, intimidation, harassment or ostracism to psychiatric or medical referrals. Once a person shows that they reported and then suffered a detriment, the detriment is presumed to be retaliation.

The person who took the measure must then prove it was based on duly justified grounds. The remedy is full compensation, and member states must penalize anyone who retaliates or hinders a report.

In the US, the Supreme Court settled the burden of proof unanimously in Murray v UBS Securities, on 8 February 2024. A Sarbanes-Oxley whistleblower must prove that the protected activity was a contributing factor in the unfavorable personnel action. No retaliatory intent is required.

The employer must then show, by clear and convincing evidence, that it would have acted the same way anyway. Remedies include reinstatement and back pay, doubled under Dodd-Frank.

All of this is protection after the fact. The UK government's guidance for employers says it in terms. An employer is not legally required to have a whistleblowing policy or to respond to whistleblowing disclosures. The main exception is certain financial services firms, which the FCA's rules require to have whistleblowing arrangements.

A consultation open until 8 January 2027 asks whether to introduce a statutory duty, as one of two options. It would require private-sector employers with 50 or more employees, and all public-sector employers, to have procedures and follow up on disclosures. The subtle forms of retaliation, and how to prevent them, are set out in Confide's guide to whistleblower retaliation.

Why people do not blow the whistle

Many people stay silent because speaking up costs them. Protect, the UK whistleblowing charity, reported on the people who contacted its advice line in 2025. Of those, 71 percent had been victimized, suspended, dismissed or forced to resign after raising a concern, and 38 percent said their concern was ignored. The government's review of the framework, published on 14 July 2025, found that stigma remains around blowing the whistle.

The reasons people give across Europe are consistent. The Special Eurobarometer on corruption, fielded in early 2024, asked why people do not report it. The answers included:

• it is difficult to prove anything, 43 percent
• those responsible will not be punished, 28 percent
• there is no protection for those who report, 28 percent
• no one wants to betray anyone, 20 percent
• they do not know where to report, 18 percent

The gap is widest where the wrongdoing is personal. The Government Equalities Office ran a sexual harassment survey in 2020. It found that 29 percent of those in employment had experienced some form of sexual harassment at work in the previous twelve months. Only 15 percent of them had reported it formally.

What an employer should have

The government's guidance for employers lists what a typical policy contains. Seven of its items do most of the work:

• An explanation of what whistleblowing is, and how it differs from a grievance.
• Guidance on the organization's procedures: who receives a report, who investigates, who decides.
• Confirmation of the anonymous reporting options and how to access them, with the note that anonymous disclosures are harder to investigate and may limit feedback.
• Reasonable steps to keep the reporter's identity confidential where requested.
• A clear statement that victimization of whistleblowers is unacceptable.
• Timeframes for handling disclosures and the type of feedback a whistleblower can expect.
• Information about raising concerns with the relevant prescribed persons, and where to find further guidance: the government website, Acas, Protect and the trade union.

How Confide handles a whistleblowing report

The policy items above only work if the channel behind them does. Confide's Whistleblowing Software accepts reports by web form, voice, QR code, email or API, and each lands in the same case. Reporters can choose to stay anonymous and still exchange messages with investigators, which deals with the feedback problem anonymous reports usually have.

If the organization switches on Echo, Confide's AI agent, it asks the reporter about anything missing while they are still making the report. Echo does not decide whether a report is valid. The team reviews what arrives and makes the decisions, and case data is never used to train AI models.

If a user is named in a report, Confide automatically revokes their access to that case, and each access and action is logged. The UK consultation, and the statutory duty it puts forward as one option, are covered in Confide's guide to UK whistleblowing law. Pricing is published, from $2,000 a year by headcount, with unlimited users and cases.

Whistleblowing FAQ

What is the difference between whistleblowing and a grievance?

A grievance is about your own treatment at work, such as pay, hours or a manager's conduct towards you. Whistleblowing is a report of wrongdoing that affects others, such as other workers, customers or the public. UK whistleblowing law covers a personal grievance only where the worker reasonably believes the particular case is in the public interest. The same concern can be both.

Is whistleblowing anonymous?

It can be, but anonymity and confidentiality are different things. An anonymous reporter is not identified at all, while a confidential reporter is known to the people handling the report, who protect their identity. UK guidance asks employers to confirm what anonymous options exist, and to say that anonymous disclosures are harder to investigate.

The EU Directive leaves it to each member state whether employers must accept anonymous reports. Spain requires it, while Germany and Ireland do not. In the US, Sarbanes-Oxley requires listed companies' audit committees to have a confidential, anonymous route for accounting concerns.

Can you be sacked for whistleblowing?

Not lawfully. In Great Britain, a dismissal is automatically unfair under section 103A of the Employment Rights Act 1996 where its reason, or principal reason, is a protected disclosure. There is no qualifying period and no cap on compensation.

The EU Directive lists dismissal first among the forms of retaliation it prohibits, and presumes retaliation once a report and a detriment are shown. In the US, Sarbanes-Oxley provides reinstatement and back pay, and Dodd-Frank adds double back pay for those who reported to the SEC.

Where to start

The part of whistleblowing an organization controls is what happens when a report arrives. Four points decide it: who sees a report, who is kept out of it, how fast the reporter hears back and whether all three are on record.

Pav Gill raised fraud inside a company that had no good answer to any of them. The report reached the public through a newspaper in January 2019. Confide's Whistleblowing Software is built around those four points, from report intake to access and follow-up.