Safe Workplace
Explore productBook a demo
Products
CalmERCompliantCare
Pricing
CalmER pricingCompliantCare pricing
More
CustomersGuidesBlogBook a demo

Content reviewed October 2026.

CalmER · Workplace guides

UK whistleblowing policy guide: what to include in 2026, with a free model policy

For employers in England, Scotland and Wales: whether you need a whistleblowing policy now and under the government's proposed duty, what the law protects since the April 2026 change, what a good policy says, what to do after someone raises a concern, and a model policy you can adapt.

Last updated 4 November 202621 min read
At a glanceWhat changed in 2026Is a policy a legal requirement?What counts as whistleblowingWhat your policy should includeCare, FCA firms and small businessesFree model policyReporting outside the organisationAfter someone raises a concernCalmER speak-up toolsRunning it day to dayFAQs
At a glance, as at 27 October 2026

A whistleblowing policy tells workers how to raise a concern about wrongdoing, such as fraud or a danger to someone’s safety, who they can raise it with, and how you will protect them. Most UK employers don’t have to have one, and the law protects workers who raise concerns either way. The government is now consulting on a legal duty to have one, for private employers with 50 or more employees and all public bodies. A written policy tells staff where to go and helps you hear about problems first. Since April 2026, the law also covers concerns about sexual harassment.

WhatWhere things stand
Do you need a policy?Not by law for most employers. UK banks, Solvency II insurers and providers of NHS care have sector rules.
Proposed legal dutyUnder consultation until 8 January 2027: a duty to have a whistleblowing policy and procedure, for private employers with 50 or more employees and all public bodies. Not law yet.
What countsSeven kinds of wrongdoing, including sexual harassment since 6 April 2026, where the worker reasonably believes raising it is in the public interest.
Who’s protectedWorkers, which includes employees, agency workers, many contractors, trainees and former staff.
The protectionDismissal for whistleblowing is automatically unfair, with no minimum service and no cap on compensation. Workers are also protected from other unfair treatment, by you or their colleagues.
Time to claim6 months where the act or dismissal happened on or after 1 October 2026. 3 months before that.
Gagging clausesVoid. No contract or settlement agreement can stop a worker making a protected disclosure.
How staff raise a concernNamed, confidential or anonymous. To reply to an anonymous concern, you need a route that lets you write back without knowing who raised it.
After a concern is raisedTalk to the person promptly, keep them updated and tell them your decision (GOV.UK guidance). You’re liable when colleagues treat them badly for raising it, unless you took all reasonable steps to prevent it.
The new law

What changed in 2026

  1. Sexual harassment became a whistleblowing category (6 April). The Employment Rights Act 2025 added it to the list of things a worker can blow the whistle about. The public interest test still applies. Acas says the protection covers detriment or dismissal from 6 April 2026, even if the disclosure was made before then.
  2. Longer to bring a claim (1 October). Workers now have 6 months to bring a detriment or dismissal claim where the act or dismissal happened on or after 1 October 2026. Some older pages, including one of Acas’s, still say 3 months.
  3. New guidance for employers (6 April). GOV.UK replaced the 2015 guidance and code of practice with new guidance, which lists what a whistleblowing policy should include.
  4. The National Guardian’s Office closed (30 June). NHS England took on some of its work from 1 July. Your policy shouldn’t send staff to it.
  5. The list of prescribed persons changed (2 June and 30 September). New bodies include the Building Safety Regulator and the Security Industry Authority, and the Information Commissioner’s Office is now the Information Commission.
  6. A consultation on a legal duty to have a policy (12 October). The government is asking whether employers should have to have whistleblowing procedures and a policy that explains them, and follow up each concern. It suggests covering private employers with 50 or more employees and all public bodies. The consultation closes on 8 January 2027 and the response comes in 2027, so it isn’t law yet. The detail is under what the government is proposing.
  7. Coming in 2027: confidentiality agreements. The government plans regulations to stop employers using confidentiality agreements to silence people about harassment and discrimination.

See the Free Model Policy

Your obligations

Is a whistleblowing policy a legal requirement?

Not for most employers. GOV.UK’s guidance says plainly: “You are not legally required to have a whistleblowing policy.” It also warns that without one, wrongdoing can go undetected and you risk reputational damage and legal claims.

Having one still helps in law:

  • A concern raised through a route you’ve authorised, such as an external reporting line, counts as raised with you.
  • If a worker goes public, a tribunal can consider whether they used your procedure first.
  • You’re liable when one worker victimises another for blowing the whistle, unless you took all reasonable steps to prevent it.
WhoWhat applies
UK banks and Solvency II insurersFCA SYSC 18 and PRA rules: internal arrangements that accept anonymous concerns, a whistleblowers’ champion, telling staff they can go straight to the FCA or PRA, an annual report to the board, and set wording in settlement agreements. Other FCA firms can follow SYSC 18 as good practice.
Providers of NHS care in EnglandAdopt the national Freedom to Speak Up policy as a minimum and have a guardian. Our Freedom to Speak Up guide covers both.
CQC-registered providersCQC looks at whether staff feel able to speak up as part of its well-led assessment, including how leaders support people who raise concerns.
Listed companiesThe UK Corporate Governance Code asks for a way for the workforce to raise concerns in confidence, anonymously if they wish, with the board reviewing it (comply or explain).
Everyone elseNo legal duty to have a policy. Workers who blow the whistle have the same legal protection whether you have one or not.

What the government is proposing

On 12 October 2026, the government opened a consultation on whistleblowing law. It closes on 8 January 2027, and the response is due in 2027. For employers, it puts forward two options:

  • Revised guidance. More detailed guidance on handling concerns, with no new legal duty.
  • A legal duty. Employers would have to have procedures for handling whistleblowing concerns and a policy that explains them to workers, and follow up each concern.

For the legal duty, the government suggests covering private employers with 50 or more employees, charities included, and every public body whatever its size. It would consider leaving out organisations that already have equivalent rules, such as some FCA-regulated firms, and asks whether to phase the duty in. Employers that don’t comply would face civil penalties, such as fines. To follow up, you’d take reasonable, proportionate steps to check whether a concern has merit and decide what to do. It wouldn’t mean formally investigating every concern.

The consultation also asks whether to protect more people, such as non-executive directors, charity trustees and some self-employed people. Nothing changes in law until the government decides.

Scope

What counts as whistleblowing

Whistleblowing means a worker telling you, or a body named in law, about wrongdoing they reasonably believe shows one of these:

  • a criminal offence
  • someone failing to meet a legal obligation
  • a miscarriage of justice
  • danger to someone’s health or safety
  • sexual harassment (since 6 April 2026)
  • damage to the environment
  • someone covering up any of these

It covers wrongdoing that has happened, is happening or is likely to happen, in the UK or abroad. The worker must also reasonably believe that raising it is in the public interest. GOV.UK lists what a tribunal may weigh up: how many people the wrongdoing affects, how serious it is, whether it was deliberate, and who did it.

Where the law sits. The Public Interest Disclosure Act 1998 (PIDA) added these protections to the Employment Rights Act 1996 as Part 4A.

Who’s protected. Workers, which is wider than employees. It includes agency workers, many contractors, trainees and people who’ve left. GOV.UK says the self-employed, volunteers and non-executive directors are unlikely to be protected.

What doesn’t count. A complaint about someone’s own treatment, such as their pay or a dispute with a colleague, is usually a grievance, handled under your grievance or dignity at work policy, unless it’s also in the public interest. A disclosure isn’t protected if making it is a criminal offence, or if it reveals legal advice the person received in confidence.

Best practice

What your whistleblowing policy should include

GOV.UK’s 2026 guidance lists what a typical policy includes. In plain terms:

  • what whistleblowing is, and how your procedure works
  • training for everyone on the law and your process
  • a promise to treat every concern fairly and consistently
  • reasonable steps to keep someone’s identity confidential when they ask
  • how to report anonymously, and that anonymous concerns are harder to investigate and may limit feedback
  • what feedback people can expect, and your timeframes for handling concerns
  • a clear statement that victimising whistleblowers is unacceptable
  • that people don’t need evidence before they raise a concern
  • where to get advice, such as GOV.UK, Acas, Protect or a trade union
  • how to raise concerns with the relevant prescribed person

How staff raise a concern: named, confidential or anonymous

Say in your policy which of these ways staff can use, and what each means for them:

  • Named. They give their name, and the people handling the concern can talk to them openly.
  • Confidential. They give their name, and you take reasonable steps to keep it to the people who need to know, such as HR and the senior managers handling it.
  • Anonymous. They don’t give their name to anyone. An anonymous concern is harder to investigate, and you can only give feedback through a route that lets you reply without knowing who raised it.

Staff can raise a concern at any time, about wrongdoing that has happened, is happening or is likely to happen. The time limits apply to tribunal claims.

What older templates get wrong. Many free templates still online predate the changes:

  • “Good faith”. The law dropped it as a condition of protection in 2013. A tribunal can now only reduce compensation, by up to 25%, if a disclosure wasn’t made in good faith.
  • Six categories. There are seven since sexual harassment was added in April 2026.
  • Employees only. The law protects workers, a wider group.
  • Three months to claim. It’s 6 months where the act or dismissal happened on or after 1 October 2026.
  • Old contacts. Public Concern at Work is now Protect, and the National Guardian’s Office has closed.
  • EU deadlines as UK law. “Acknowledge within 7 days, feedback within 3 months” comes from the EU Directive. UK law sets no handling deadlines, so set your own and put them in the policy. For staff in EU countries, our EU Whistleblowing Directive guide covers what each country requires.
By sector

What a whistleblowing policy needs in care, FCA firms and small businesses

The model policy below suits any employer in England, Scotland or Wales. Care providers and FCA-regulated firms have more to add, and a small business can keep it short.

Care homes and other CQC-registered providers

The regulator looks at speaking up as part of its well-led assessment. Its quality statement on freedom to speak up expects staff who raise concerns, including external whistleblowers, to get support without fear of detriment. It also expects leaders to investigate concerns sensitively and confidentially and act on the lessons. In your policy:

  • Name CQC as a route for concerns about care in England. Staff can go straight to it as a prescribed person, without raising the concern with you first.
  • Cover agency workers, trainees, and student nurses and midwives. The law protects them as workers.
  • If you provide NHS care, adopt the national Freedom to Speak Up policy as your minimum and add your local details.
  • Leave out any line saying the law doesn’t protect malicious disclosures, including the one in CQC’s 2013 whistleblowing guidance for providers. The law dropped good faith as a condition in June 2013.

FCA-regulated firms

UK banks and Solvency II insurers must follow the whistleblowing rules in SYSC 18, alongside matching PRA rules. Other firms can adopt them as good practice. The rules ask for arrangements that:

  • accept concerns in confidence or anonymously, through a range of methods
  • assess concerns and escalate them where needed, including to the FCA or PRA
  • take reasonable steps to stop anyone in the firm victimising the person who raised a concern
  • give feedback where it’s feasible and appropriate
  • keep records of concerns and outcomes, with written procedures UK staff can find easily
  • report to the board on how the arrangements work every year, and tell the FCA promptly about any whistleblowing claim the firm contested and lost at a tribunal
  • train UK staff, their managers and the people who run the arrangements

Those firms also need a whistleblowers’ champion, a director or senior manager who oversees the arrangements. They must tell UK staff they can go straight to the FCA or PRA without using the internal route first, and put a term in every settlement agreement saying nothing in it stops a protected disclosure. Since 1 September 2026, serious bullying, harassment and violence also fall under the Conduct Rules for every firm under the Senior Managers and Certification Regime: our guide to the non-financial misconduct rules covers what that asks of you.

Small businesses

No law requires a small business to have a whistleblowing policy, and the legal duty the government is consulting on would start at 50 employees for private employers. The law still protects your workers from their first day, and compensation has no cap if you dismiss someone for blowing the whistle. A short policy works. Make sure it:

  • names someone outside the management line to go to, such as an HR adviser you authorise, for concerns about the owner or a manager
  • names the regulator staff can report to for your kind of work
  • promises that nobody will treat staff badly for raising a concern, and says who to tell if someone does
  • says how and when you’ll reply

Fill in the gaps in [square brackets] in the model policy below. In a small business, one person can hold more than one of its roles.

Free template

A model whistleblowing policy you can adapt

Here’s how the model policy starts, and what the rest of it covers. It’s written for an employer in England, Scotland or Wales. Request the full policy below and you get it as an editable Word document, ready to fill in the parts in [square brackets] with your own names, routes and timeframes. If you provide NHS care, adopt the national Freedom to Speak Up policy and use this to add your local details. FCA-regulated firms need to add their SYSC 18 arrangements.

Whistleblowing policy

[Organisation name] · Version [1.0] · Approved by [name and role] on [date] · Next review [date]

1. About this policy

[Organisation name] wants to hear about wrongdoing early, so we can put it right. This policy explains how to raise a concern, what we will do with it, and how we protect people who speak up.

It applies to everyone who works for us: employees, workers, agency staff, contractors, trainees and people who used to work here. Volunteers can use it too.

This policy doesn't form part of any contract of employment, and we may update it. [Role] owns it and reviews it every [12 months].

The full policy also covers:

  1. Concerns this policy doesn't cover
  2. You don't need proof
  3. How to raise a concern
  4. Confidentiality and anonymous reports
  5. What we will do
  6. Protection for people who speak up
  7. Concerns you know are untrue
  8. Raising a concern outside [Organisation name]
  9. Agreements never stop you speaking up
  10. Records, training and review
  11. Contacts

Get the full policy as a Word document ↓

Reflects the law in England, Scotland and Wales as at 8 October 2026. General information, not legal advice.

Free Word template

Get the full policy as a Word document

Enter your work email and the team will send you the full model policy as an editable Word document.

Outside routes

Who staff can report to outside your organisation

Workers don’t have to raise a concern with you first. They’re protected when they go to a prescribed person for that kind of concern, as long as they reasonably believe it’s substantially true. The ones employers most often name:

ConcernPrescribed person
Health and safety at workHealth and Safety Executive, or the local council
Equality or human rights lawEquality and Human Rights Commission
Data protectionInformation Commission (formerly the ICO)
Tax and customsHM Revenue and Customs
Health and social care in EnglandCare Quality Commission
NHS servicesNHS England, and the NHS Counter Fraud Authority for fraud
Health and care professionalsTheir professional regulator, such as the GMC, NMC or HCPC
Financial servicesFinancial Conduct Authority, Prudential Regulation Authority
CharitiesCharity Commission for England and Wales
PensionsThe Pensions Regulator
AnythingThe worker’s MP (or MSP in Scotland)

Scotland and Wales have their own bodies for some areas, such as the Care Inspectorate and Social Care Wales. The list changes, so link to GOV.UK’s list of prescribed people and bodies in your policy, and leave out the National Guardian’s Office.

Going to the media or posting online is protected only in narrower circumstances, for example where a worker reasonably fears you’d punish them for raising it with you. Your policy can say so and point people to advice first.

After a report

How to handle a whistleblowing concern and protect the person who raised it

The law protects the person who raised a concern from unfair treatment because of it, by you or by colleagues, and compensation has no cap. If they bring a claim for that treatment, it’s for you to show why you did what you did. In 2024, 29% of UK employees who reported misconduct at work faced retaliation (Institute of Business Ethics).

UK law sets no handling steps or deadlines for most employers, so your policy sets them. In short: talk to them promptly; decide whether to investigate, refer it or take no action, and record why; protect their identity; keep them updated and tell them your decision; check in on how they’re treated at 30, 60 and 90 days; and keep one record of what you did. If someone raised a concern anonymously, you can only update them through a route that lets you reply without knowing who they are.

Our whistleblowing procedure guide takes you through each step, with what the law requires and what it leaves to you, who should investigate, how long an investigation should take, and a free investigation playbook.

Set up with you, from £99 a month

CalmER speak-up tools that give staff a safe route to speak up

A whistleblowing policy only works if staff can use the routes it names, even when the concern is about their own manager.

Our CalmER speak-up tools give them a credible, confidential way to raise a concern through Slack, Teams, email or WhatsApp, with an anonymous option where appropriate.

How it works in Slack or Teams

  1. Install the Safe Workplace app. An admin adds it to Slack or Teams once, and our team sets it up with you.
  2. Staff raise a concern in a private chat with the app. In Slack they type /safeworkplace, and in Teams they choose Raise a concern. They decide whether to give their name.
  3. It goes straight to the people who handle concerns. Each concern arrives in a private channel with only those people, and one of them picks it up.
  4. You reply, and they stay anonymous. The people handling it reply in the concern’s thread, and the app passes each question on. The person who raised it answers without giving their name unless they choose to.
  5. Every concern stays in one log. It shows each concern and how you handled it.

Outcome: fewer concerns stay unreported; a clearer, more accessible reporting route.

Moore Kingston Smith, an FCA-regulated accountancy and advisory firm, runs its whistleblowing on CalmER. Six months after go-live, early concerns had doubled and 91% of staff said they feel Safe Workplace protects their identity. Read the case study.

Enter your email to enquire. Our team will be in touch within one working day with the details for your organisation.

From £99 a month.

In practice

Running it day to day

  • Train people. Everyone needs to know what to report and how. Managers need to recognise a disclosure when someone makes one, often in passing, and know what to do next. Our free sexual harassment training pack covers reporting for staff and managers.
  • Give more than one route. A route that bypasses line management matters most when the concern is about a manager. Make the anonymous option easy to find. Our CalmER speak-up tools give staff both. Our free speak-up scorecard checks your routes and the rest of your arrangements.
  • Keep records and report themes. Record every concern, the action taken and the outcome. Report numbers and themes to the board at least once a year without naming anyone. Our ER metrics guide covers what to report and how to calculate it.
  • Check your agreements. Any clause that tries to stop a protected disclosure is void. In England and Wales, a confidentiality agreement also can’t stop a victim of crime reporting it to the police, a lawyer or a support service.

Concerns about sexual harassment now sit in two places: your whistleblowing policy and your duty to prevent harassment, which is “all reasonable steps” from 30 October 2026. Our guide to the duty to prevent sexual harassment covers what that duty asks of you.

Or hear about problems before a regulator does

CalmER gives staff the routes this policy promises: a hotline, app, web form, WhatsApp, Slack or Teams, named or anonymous. Every concern follows the same case path, the right person gets an alert, and CalmER drafts the board pack that shows the themes.

See CalmER →See CalmER pricing
FAQs

Common questions

What is a whistleblowing policy?

A whistleblowing policy tells workers how to raise a concern about wrongdoing at work, such as fraud, a danger to someone's health and safety or sexual harassment, who they can raise it with inside and outside the organisation, and how you will protect them. GOV.UK's guidance for employers calls having one a good idea, so workers know how to raise concerns and managers know how to respond.

Is a whistleblowing policy a legal requirement in the UK?

Not for most employers. GOV.UK's guidance for employers says you are not legally required to have one. Sector rules apply to some: UK banks and Solvency II insurers (FCA and PRA rules), and organisations providing NHS care, which must adopt the national Freedom to Speak Up policy. The law protects workers who blow the whistle whether or not you have a policy. The government is consulting until 8 January 2027 on making a policy and procedure a legal duty for private employers with 50 or more employees and all public bodies.

Will a whistleblowing policy become a legal requirement?

It might. On 12 October 2026 the government opened a consultation on a legal duty for employers to have whistleblowing procedures and a policy that explains them, and to follow up each concern. It suggests the duty would cover private employers with 50 or more employees and all public bodies, with civil penalties, such as fines, for employers that don't comply. Following up wouldn't mean formally investigating every concern. The consultation closes on 8 January 2027 and the government will publish its response in 2027, so the law hasn't changed yet.

What should a whistleblowing policy include?

GOV.UK lists what a typical policy includes: what whistleblowing is, how to raise a concern, training, fair and consistent treatment, confidentiality, anonymous reporting and its limits, the feedback people can expect, timeframes, a clear statement that victimisation is unacceptable, that no evidence is needed, where to get advice, and how to raise concerns with prescribed persons.

Is there a free whistleblowing policy template for the UK?

Yes. We wrote our model policy for employers in England, Scotland and Wales, and it lists sexual harassment among the concerns staff can raise. Request it on this page and the team sends it as an editable Word document within one working day.

What does CQC expect on whistleblowing?

CQC looks at speaking up as part of its well-led assessment. Its quality statement on freedom to speak up expects staff who raise concerns to get support without fear of detriment. It also expects leaders to investigate concerns sensitively and confidentially and act on the lessons. Staff can report concerns about health and social care in England straight to CQC, because it's a prescribed person.

What does SYSC 18 require of FCA-regulated firms?

SYSC 18 applies to UK banks and Solvency II insurers, alongside matching PRA rules. Those firms need arrangements that accept confidential and anonymous concerns, a whistleblowers' champion, a message to UK staff that they can go straight to the regulators, records, training, a report to the board every year, and a term in settlement agreements saying nothing in them stops a protected disclosure. Any other regulated firm can adopt it as good practice.

Does a small business need a whistleblowing policy?

No law requires one, whatever your size. The law still protects your workers from their first day, and compensation has no cap if you dismiss someone for blowing the whistle. A short policy that names who staff can go to, including someone other than the owner or their manager, and the regulator for your kind of work, helps you hear about a problem first.

What changed in whistleblowing law in 2026?

Since 6 April 2026, a disclosure about sexual harassment can be a protected disclosure. Since 1 October 2026, workers have 6 months to bring a whistleblowing detriment or dismissal claim where the act or dismissal happened on or after that date. GOV.UK published new guidance for employers, the National Guardian's Office closed on 30 June, and the list of prescribed persons changed. On 12 October the government opened a consultation on making a whistleblowing policy and procedure a legal duty. Rules on confidentiality agreements are expected in 2027.

What should an employer do after someone blows the whistle?

Talk to them promptly, explain how you'll handle it, and let them bring a colleague or union representative if they want one. Decide whether to investigate, refer it or take no action, keep them updated, tell them your decision and share their identity only with those who need to know. Then check in at 30, 60 and 90 days and act on any sign of unfair treatment: you're liable when colleagues victimise them, unless you took all reasonable steps to prevent it. Our whistleblowing procedure guide covers each step.

Can you be dismissed for whistleblowing?

Dismissing an employee because they made a protected disclosure is automatically unfair. There's no minimum length of service and no cap on compensation. Workers who aren't employees are protected from being treated badly, including having their contract ended, because of a disclosure. Colleagues who victimise a whistleblower can be personally liable.

What doesn't count as whistleblowing?

A complaint about your own treatment, such as your pay or a dispute with a colleague, usually counts as a grievance, unless it's also in the public interest. A disclosure isn't protected if making it is a criminal offence, or if it reveals legal advice the person received in confidence.

Is sexual harassment covered by whistleblowing law?

Yes. Since 6 April 2026, telling your employer or a prescribed person that sexual harassment has happened, is happening or is likely to happen can be a protected disclosure. The person still needs to reasonably believe it's in the public interest. Acas says the protection applies to detriment or dismissal from 6 April 2026, even if the disclosure was made earlier.

Is there a time limit for raising a whistleblowing concern?

No. Workers can raise a concern at any time, about wrongdoing that has happened, is happening or is likely to happen. The time limits apply to tribunal claims.

How long does someone have to bring a whistleblowing claim?

Where the act or dismissal happened on or after 1 October 2026, a worker has 6 months to bring a tribunal claim. For earlier acts, the limit is 3 months. They must contact Acas for early conciliation first.

Can whistleblowers stay anonymous?

Yes. Your policy should explain how to report anonymously, and that anonymous concerns are harder to investigate and may limit the feedback you can give. You can only update someone who stays anonymous through a route that lets you reply without knowing who they are. Keeping someone's identity confidential is different: they give their name, and you take reasonable steps to protect it.

Do we need a whistleblowing hotline?

Not by law, for most employers. Give staff routes they can use, including one that bypasses their line manager and an anonymous option. A hotline is one such route, and an app, a web form or a channel in Slack or Teams can do the same job. UK banks and Solvency II insurers must accept concerns in confidence or anonymously, through a range of methods (SYSC 18). If you authorise an outside hotline, a concern raised through it counts as raised with you.

Who are prescribed persons?

Regulators and other bodies named in law that workers can report concerns to, for example the Health and Safety Executive, the Equality and Human Rights Commission, HMRC, the Care Quality Commission and the Financial Conduct Authority. GOV.UK publishes the full list. A worker can also contact their MP.

Does UK whistleblowing law apply in Northern Ireland or the EU?

No. Northern Ireland has its own law, which doesn't include the sexual harassment category. In the EU, the Whistleblowing Directive requires employers with 50 or more workers in a member state to set up internal reporting channels, acknowledge reports within 7 days and give feedback within 3 months, under each country's own law.

Sources & further reading

References

General information, not legal advice. It reflects our understanding of the law and of GOV.UK, Acas and regulator guidance as of November 2026, so check legislation.gov.uk and gov.uk for the current position.