Whistleblowing / UK law
The Public Interest Disclosure Act protects workers in England, Wales and Scotland who report wrongdoing, and outside financial services asks almost nothing of the employer who receives the report. Confide is built for the duty the October 2026 consultation is asking about.
“The global leaders in whistleblowing software”
As seen in:
Fulham F.C.
PIDA protects a disclosure to the employer under section 43C and says nothing about who receives it. Confide takes reports by web form, voice, QR code and email and routes each one past line management to the people you name.
The Corporate Governance Code expects a means to raise concerns in confidence. Confide locks anyone named in a report out of it automatically, writes every access to an immutable record, and lets roles decide who sees a case.
The October 2026 consultation asks whether to make procedures, a policy and follow-up a legal duty, citing Ireland's model of acknowledgment in seven days, a designated person and feedback in three months. Confide holds every concern in one case record, with its acknowledgment, its owner and its outcome.
| Requirement | What the law says |  |
|---|---|---|
| Protected disclosure categories | s.43B(1): seven heads, sexual harassment since 6 Apr 2026 | IncludedEcho completes the report at intake |
| Anonymous reporting accepted | Not in PIDA. Expected by Code Provision 6 and gov.uk | IncludedAnonymous web form, voice, QR code |
| Confidentiality of the reporter | Code Provision 6, gov.uk reasonable steps where requested | IncludedAnyone named locked out automatically |
| Protection from detriment and dismissal | s.47B detriment, s.103A dismissal, uncapped under s.124(1A) | IncludedRoles decide who sees a case |
| Six-month window for detriment claims | s.48(3), six months from 1 Oct 2026 | IncludedLegal hold on the case |
| Interim relief after dismissal | ss.128 to 129, apply within seven days | IncludedEvery access on an immutable record |
| Prescribed persons signposted to staff | s.43F, more than 90 on the gov.uk list | IncludedPrescribed persons named in the policy |
| Written whistleblowing policy | Not required by PIDA, except FCA SYSC 18 firms | IncludedDrafted from the gov.uk list |
| Acknowledgment and feedback to the reporter | Not yet required. Option 2 cites Ireland: acknowledge in 7 days, feed back in 3 months | IncludedEvery step dated on the case |
| Records and board reporting | SYSC 18.3.1R annual report, Code Provision 6 board review | IncludedSentinel answers across every case |
| Victimisation statement in the policy | gov.uk: a clear statement that victimisation is unacceptable | IncludedWritten into the policy at kick-off |
| Training for all workers | gov.uk list: training on the law and internal processes | IncludedDelivered in the rollout |
gov.uk says a whistleblower does not need to provide evidence for the employer to investigate, and Echo asks its follow-up questions at intake, so 50% more reports arrive ready to investigate before a designated person picks them up.
The consultation closes on 8 January 2027 and any statutory duty would come after it, but a standard Confide setup takes one day and an enterprise rollout three to six weeks, so the route and the record are live before the policy is signed off.
One annual fee from USD 2,000 by headcount covers unlimited users and cases, so an employer at the 50-employee threshold the consultation floats and a group with a designated person in every entity both pay nothing per user or per report.
From no written policy to a program ready for the duty the consultation is asking about, in the order the gov.uk guidance and the consultation set it out.
Book a demoA Confide compliance expert works through which of your entities could fall inside a statutory duty if it follows the scope the government would consider, 50 or more employees in the private sector and every public body, whether SYSC 18 or the Corporate Governance Code already applies to you, and where concerns arrive today.
The policy covers each item on the gov.uk employer list of 6 April 2026: what whistleblowing is, the procedure, confidentiality, the feedback a reporter can expect, anonymous options and their limits, timeframes, that no evidence is needed, and where to find Acas, Protect or a union.
Web form, voice report, QR code and email intake go live in the languages your people use, each accepting anonymous reports. The policy names the prescribed persons on the gov.uk list, the FCA, HSE, HMRC and CQC among more than 90, so a worker who goes outside the company goes to the right one.
Each concern is assigned to a designated person with the role to see it. The record shows the day it arrived, the day it was acknowledged and the day feedback went back, the three dates a duty on Ireland's model, one of the approaches the consultation cites, would require.
Staff are trained on the law and the internal process, as the gov.uk list asks. The policy carries a clear statement that victimisation of whistleblowers is unacceptable, backed by the automatic lock-out of anyone named in a report.
The board sees what came in, what was done and how long it took, which Provision 6 of the Corporate Governance Code expects and SYSC 18 requires at least once a year. The program is reviewed annually, and again when the government responds to the consultation.
