Content reviewed October 2026.

CalmER · Workplace guides

UK whistleblowing policy guide: what to include in 2026, with a free model policy

For employers in England, Scotland and Wales: whether you need a whistleblowing policy, what the law protects since the April 2026 change, what a good policy says, and a model policy you can adapt.

Last updated 8 October 202613 min read

At a glance What changed in 2026 Is a policy a legal requirement?What counts as whistleblowing What your policy should include Free model policy Reporting outside the organisation Running it day to day FAQs

At a glance, as at 8 October 2026

Most UK employers don’t have to have a whistleblowing policy, but the law protects workers who raise concerns either way. A written policy tells staff where to go and helps you hear about problems first. Since April 2026, the law also covers concerns about sexual harassment.

What	Where things stand
Do you need a policy?	Not by law for most employers. UK banks, Solvency II insurers and providers of NHS care have sector rules.
What counts	Seven kinds of wrongdoing, including sexual harassment since 6 April 2026, where the worker reasonably believes raising it is in the public interest.
Who’s protected	Workers, which includes employees, agency workers, many contractors, trainees and former staff.
The protection	Dismissal for whistleblowing is automatically unfair, with no minimum service and no cap on compensation. Workers are also protected from other unfair treatment, by you or their colleagues.
Time to claim	6 months where the act or dismissal happened on or after 1 October 2026. 3 months before that.
Gagging clauses	Void. No contract or settlement agreement can stop a worker making a protected disclosure.

The new law

What changed in 2026

Sexual harassment became a whistleblowing category (6 April). The Employment Rights Act 2025 added it to the list of things a worker can blow the whistle about. The public interest test still applies. Acas says the protection covers detriment or dismissal from 6 April 2026, even if the disclosure was made before then.
Longer to bring a claim (1 October). Workers now have 6 months to bring a detriment or dismissal claim where the act or dismissal happened on or after 1 October 2026. Some older pages, including one of Acas’s, still say 3 months.
New guidance for employers (6 April). GOV.UK replaced the 2015 guidance and code of practice with new guidance, which lists what a whistleblowing policy should include.
The National Guardian’s Office closed (30 June). NHS England took on some of its work from 1 July. Your policy shouldn’t send staff to it.
The list of prescribed persons changed (2 June and 30 September). New bodies include the Building Safety Regulator and the Security Industry Authority, and the Information Commissioner’s Office is now the Information Commission.
Coming in 2027: confidentiality agreements. The government plans regulations to stop employers using confidentiality agreements to silence people about harassment and discrimination.

See the Free Model Policy

Your obligations

Is a whistleblowing policy a legal requirement?

Not for most employers. GOV.UK’s guidance says plainly: “You are not legally required to have a whistleblowing policy.” It also warns that without one, wrongdoing can go undetected and you risk reputational damage and legal claims.

Having one still helps in law:

A concern raised through a route you’ve authorised, such as an external reporting line, counts as raised with you.
If a worker goes public, a tribunal can consider whether they used your procedure first.
You’re liable when one worker victimises another for blowing the whistle, unless you took all reasonable steps to prevent it.

Who	What applies
UK banks and Solvency II insurers	FCA SYSC 18 and PRA rules: internal arrangements that accept anonymous concerns, a whistleblowers’ champion, telling staff they can go straight to the FCA or PRA, an annual report to the board, and set wording in settlement agreements. Other FCA firms can follow SYSC 18 as good practice.
Providers of NHS care in England	Adopt the national Freedom to Speak Up policy (version 2, June 2022) as a minimum and add local details, and have a Freedom to Speak Up guardian. The NHS Standard Contract makes this a contract term for providers that hold one.
CQC-registered providers	CQC looks at whether staff feel able to speak up as part of its well-led assessment, including how leaders support people who raise concerns.
Listed companies	The UK Corporate Governance Code asks for a way for the workforce to raise concerns in confidence, anonymously if they wish, with the board reviewing it (comply or explain).
Everyone else	No legal duty to have a policy, but the same legal protection for workers who blow the whistle.

Scope

What counts as whistleblowing

Whistleblowing means a worker telling you, or a body named in law, about wrongdoing they reasonably believe shows one of these:

a criminal offence
someone failing to meet a legal obligation
a miscarriage of justice
danger to someone’s health or safety
sexual harassment (since 6 April 2026)
damage to the environment
someone covering up any of these

It covers wrongdoing that has happened, is happening or is likely to happen, in the UK or abroad. The worker must also reasonably believe that raising it is in the public interest. GOV.UK lists what a tribunal may weigh up: how many people the wrongdoing affects, how serious it is, whether it was deliberate, and who did it.

Who’s protected. Workers, which is wider than employees. It includes agency workers, many contractors, trainees and people who’ve left. GOV.UK says the self-employed, volunteers and non-executive directors are unlikely to be protected.

What doesn’t count. A complaint about someone’s own treatment, such as their pay or a dispute with a colleague, is usually a grievance, unless it’s also in the public interest. A disclosure isn’t protected if making it is a criminal offence, or if it reveals legal advice the person received in confidence.

Best practice

What your whistleblowing policy should include

GOV.UK’s 2026 guidance lists what a typical policy includes. In plain terms:

what whistleblowing is, and how your procedure works
training for everyone on the law and your process
a promise to treat every concern fairly and consistently
reasonable steps to keep someone’s identity confidential when they ask
how to report anonymously, and that anonymous concerns are harder to investigate and may limit feedback
what feedback people can expect, and your timeframes for handling concerns
a clear statement that victimising whistleblowers is unacceptable
that people don’t need evidence before they raise a concern
where to get advice, such as GOV.UK, Acas, Protect or a trade union
how to raise concerns with the relevant prescribed person

What older templates get wrong. Many free templates still online predate the changes:

“Good faith”. The law dropped it as a condition of protection in 2013. A tribunal can now only reduce compensation, by up to 25%, if a disclosure wasn’t made in good faith.
Six categories. There are seven since sexual harassment was added in April 2026.
Employees only. The law protects workers, a wider group.
Three months to claim. It’s 6 months where the act or dismissal happened on or after 1 October 2026.
Old contacts. Public Concern at Work is now Protect, and the National Guardian’s Office has closed.
EU deadlines as UK law. “Acknowledge within 7 days, feedback within 3 months” comes from the EU Directive. UK law sets no handling deadlines, so set your own and put them in the policy. For staff in EU countries, our EU Whistleblowing Directive guide covers what each country requires.

Free template

A model whistleblowing policy you can adapt

Here’s how the model policy starts, and what the rest of it covers. It’s written for an employer in England, Scotland or Wales. Request the full policy below and you get it as an editable Word document, ready to fill in the parts in [square brackets] with your own names, routes and timeframes. If you provide NHS care, adopt the national Freedom to Speak Up policy and use this to add your local details. FCA-regulated firms need to add their SYSC 18 arrangements.

Whistleblowing policy

[Organisation name] · Version [1.0] · Approved by [name and role] on [date] · Next review [date]

1. About this policy

[Organisation name] wants to hear about wrongdoing early, so we can put it right. This policy explains how to raise a concern, what we will do with it, and how we protect people who speak up.

It applies to everyone who works for us: employees, workers, agency staff, contractors, trainees and people who used to work here. Volunteers can use it too.

This policy doesn't form part of any contract of employment, and we may update it. [Role] owns it and reviews it every [12 months].

The full policy also covers:

Concerns this policy doesn't cover
You don't need proof
How to raise a concern
Confidentiality and anonymous reports
What we will do
Protection for people who speak up
Concerns you know are untrue
Raising a concern outside [Organisation name]
Agreements never stop you speaking up
Records, training and review
Contacts

Get the full policy as a Word document ↓

Reflects the law in England, Scotland and Wales as at 8 October 2026. General information, not legal advice.

Free Word template

Get the full policy as a Word document

Enter your work email and the team will send you the full model policy as an editable Word document.

Outside routes

Who staff can report to outside your organisation

Workers don’t have to raise a concern with you first. They’re protected when they go to a prescribed person for that kind of concern, as long as they reasonably believe it’s substantially true. The ones employers most often name:

Concern	Prescribed person
Health and safety at work	Health and Safety Executive, or the local council
Equality or human rights law	Equality and Human Rights Commission
Data protection	Information Commission (formerly the ICO)
Tax and customs	HM Revenue and Customs
Health and social care in England	Care Quality Commission
NHS services	NHS England, and the NHS Counter Fraud Authority for fraud
Health and care professionals	Their professional regulator, such as the GMC, NMC or HCPC
Financial services	Financial Conduct Authority, Prudential Regulation Authority
Charities	Charity Commission for England and Wales
Pensions	The Pensions Regulator
Anything	The worker’s MP (or MSP in Scotland)

Scotland and Wales have their own bodies for some areas, such as the Care Inspectorate and Social Care Wales. The list changes, so link to GOV.UK’s list of prescribed people and bodies in your policy, and leave out the National Guardian’s Office.

Going to the media or posting online is protected only in narrower circumstances, for example where a worker reasonably fears you’d punish them for raising it with you. Your policy can say so and point people to advice first.

In practice

Running it day to day

Train people. Everyone needs to know what to report and how. Managers need to recognise a disclosure when someone makes one, often in passing, and know what to do next. Our free sexual harassment training pack covers reporting for staff and managers.
Give more than one route. A route that bypasses line management matters most when the concern is about a manager. Make the anonymous option easy to find. Our free speak-up scorecard checks your routes and the rest of your arrangements.
Set timeframes and give feedback. UK law sets none, so set your own for acknowledging and handling concerns, and tell people what you can share about the outcome.
Protect people from colleagues. You can be liable when a worker’s colleagues victimise them for blowing the whistle, and those colleagues can be personally liable too.
Keep records and report themes. Record every concern, the action taken and the outcome. Report numbers and themes to the board at least once a year without naming anyone. Our ER metrics guide covers what to report and how to calculate it.
Check your agreements. Any clause that tries to stop a protected disclosure is void. In England and Wales, a confidentiality agreement also can’t stop a victim of crime reporting it to the police, a lawyer or a support service.

Concerns about sexual harassment now sit in two places: your whistleblowing policy and your duty to prevent harassment, which becomes “all reasonable steps” on 30 October 2026. Our guide to the duty to prevent sexual harassment covers what that duty asks of you.

Or hear about problems before a regulator does

CalmER gives staff the routes this policy promises: a hotline, app, web form, WhatsApp, Slack or Teams, named or anonymous. Every concern follows the same case path, the right person gets an alert, and CalmER drafts the board pack that shows the themes.

See CalmER →See CalmER pricing

Last reviewed: 8 October 2026. General information, not legal advice. We review this guide every quarter and whenever the law changes.

FAQs

Common questions

Is a whistleblowing policy a legal requirement in the UK?

Not for most employers. GOV.UK's guidance for employers says you are not legally required to have one. Sector rules apply to some: UK banks and Solvency II insurers (FCA and PRA rules), and organisations providing NHS care, which must adopt the national Freedom to Speak Up policy. The law protects workers who blow the whistle whether or not you have a policy.

What should a whistleblowing policy include?

GOV.UK lists what a typical policy includes: what whistleblowing is, how to raise a concern, training, fair and consistent treatment, confidentiality, anonymous reporting and its limits, the feedback people can expect, timeframes, a clear statement that victimisation is unacceptable, that no evidence is needed, where to get advice, and how to raise concerns with prescribed persons.

What changed in whistleblowing law in 2026?

Since 6 April 2026, a disclosure about sexual harassment can be a protected disclosure. Since 1 October 2026, workers have 6 months to bring a whistleblowing detriment or dismissal claim where the act or dismissal happened on or after that date. GOV.UK published new guidance for employers, the National Guardian's Office closed on 30 June, and the list of prescribed persons changed. Rules on confidentiality agreements are expected in 2027.

Can you be dismissed for whistleblowing?

Dismissing an employee because they made a protected disclosure is automatically unfair. There's no minimum length of service and no cap on compensation. Workers who aren't employees are protected from being treated badly, including having their contract ended, because of a disclosure. Colleagues who victimise a whistleblower can be personally liable.

What doesn't count as whistleblowing?

A complaint about your own treatment, such as your pay or a dispute with a colleague, usually counts as a grievance, unless it's also in the public interest. A disclosure isn't protected if making it is a criminal offence, or if it reveals legal advice the person received in confidence.

Is sexual harassment covered by whistleblowing law?

Yes. Since 6 April 2026, telling your employer or a prescribed person that sexual harassment has happened, is happening or is likely to happen can be a protected disclosure. The person still needs to reasonably believe it's in the public interest. Acas says the protection applies to detriment or dismissal from 6 April 2026, even if the disclosure was made earlier.

How long does someone have to bring a whistleblowing claim?

Where the act or dismissal happened on or after 1 October 2026, a worker has 6 months to bring a tribunal claim. For earlier acts, the limit is 3 months. They must contact Acas for early conciliation first.

Can whistleblowers stay anonymous?

Yes. Your policy should explain how to report anonymously, and that anonymous concerns are harder to investigate and may limit the feedback you can give. Keeping someone's identity confidential is different: they give their name, and you take reasonable steps to protect it.

Who are prescribed persons?

Regulators and other bodies named in law that workers can report concerns to, for example the Health and Safety Executive, the Equality and Human Rights Commission, HMRC, the Care Quality Commission and the Financial Conduct Authority. GOV.UK publishes the full list. A worker can also contact their MP.

Does UK whistleblowing law apply in Northern Ireland or the EU?

No. Northern Ireland has its own law, which doesn't include the sexual harassment category. In the EU, the Whistleblowing Directive requires employers with 50 or more workers in a member state to set up internal reporting channels, acknowledge reports within 7 days and give feedback within 3 months, under each country's own law.

Sources & further reading

References

General information, not legal advice. It reflects our understanding of the law and of GOV.UK, Acas and regulator guidance as of October 2026, so check legislation.gov.uk and gov.uk for the current position.