Whistleblowing procedure: how to investigate a concern and protect the person who raised it

Check what kind of concern it is first, because that decides which procedure applies.

When it’s whistleblowing

A worker makes a whistleblowing disclosure when they tell you something they reasonably believe shows one of these, and reasonably believe that raising it is in the public interest:

• a criminal offence
• someone failing to meet a legal obligation
• a miscarriage of justice
• danger to someone’s health or safety
• sexual harassment (since 6 April 2026)
• damage to the environment
• someone covering up any of these

It can be about something that has happened, is happening or is likely to happen, in the UK or abroad. They don’t need evidence before they raise it. A concern raised as a grievance, in an email or in passing can still be a whistleblowing disclosure. The Public Interest Disclosure Act 1998 put these rules into the Employment Rights Act 1996, as Part 4A.

When it’s a grievance

Acas’s Code of Practice describes grievances as concerns, problems or complaints that employees raise with their employers. A concern about their own situation alone, such as their pay, may be a personal problem that whistleblowing law doesn’t cover. It can still be whistleblowing if it meets the test above, including the public interest part.

When it’s both

• Ask them. If a grievance might contain a disclosure, check with the person who raised it. If they’re doing both, you might need to follow both your grievance procedure and your whistleblowing procedure (Acas).
• Confirm a switch in writing. If they raised a grievance by mistake and nothing in it needs the grievance procedure, write to say the grievance procedure has ended and your whistleblowing procedure has replaced it.
• Explain your decision. If you decide it isn’t whistleblowing, tell them why, so they can take it elsewhere if they still think it is, and still try to resolve it.

The Acas Code. For the grievance part, tribunals take the Acas Code of Practice on disciplinary and grievance procedures into account, and in a relevant case can increase an award by up to 25% if you unreasonably failed to follow it. The Code itself suggests a separate procedure for whistleblowing. A report of sexual harassment can be a protected disclosure and a harassment complaint at once, and our dignity at work guide covers investigating the complaint.

What the law requires. No UK law sets a deadline to acknowledge a concern or to deal with it. From the first conversation, you must not treat the person badly for raising it.

Good practice. GOV.UK’s guidance says to act promptly, talk to the worker to understand the concern and explain how you intend to handle it, and let them bring a colleague or union representative if they want one. In that first conversation:

• Thank them for raising it, and confirm in writing that you’ve received it.
• Find out what worries them, what they’ve seen and who else knows.
• Tell them who will handle it, what happens next and when they’ll next hear from you.
• Ask whether they want their name kept confidential, and explain what that means in practice.
• Check whether anyone is at risk now, or whether evidence could be lost, such as CCTV footage that’s deleted after a set time, and deal with that first.

Your timescales. Put them in your policy and tell the person. For a benchmark, the EU Whistleblowing Directive gives employers there 7 days to acknowledge a report and 3 months from then to give feedback, and the government’s consultation describes the same clocks in Ireland’s law.

What the law requires. UK law doesn’t say who investigates. In the EU, the Whistleblowing Directive requires an impartial person or department to follow up each report.

Good practice. From Acas’s guidance on investigations at work:

• Pick someone not involved, such as another manager or someone from HR, so there’s no conflict of interest. If nobody is independent, make the process as impartial as you can.
• Match them to the case. Choose someone trained where possible, and someone more senior or experienced for a serious or complex concern, such as discrimination or bullying. Our workplace investigation training guide covers training the managers who investigate.
• Bring in an external investigator in exceptional cases, for an independent view. It can cost more and take longer.
• Write their terms of reference: what to investigate, whether to make recommendations, how to set out the findings and who to report them to.

If the concern is about a director, or about the person who would normally investigate, take it outside that line, for example to a non-executive director or an external investigator. Ask whoever you choose to confirm they have no link to the people or the matter. NHS England’s national speak-up policy asks for an investigator who is suitably independent, which might mean someone from outside the organisation, and trained in investigations.

What the law requires. No law sets how you investigate a whistleblowing concern. Data protection law covers the evidence you gather and the people in it. If the findings lead to disciplinary action against someone, the Acas Code applies to that process: investigate without unreasonable delay and, where practicable, have different people investigate and hear the case.

Good practice. Acas wrote its guidance on investigations at work for discipline and grievances. It fits a whistleblowing concern too, with one addition: protect the whistleblower’s identity at every step.

• Plan it: what to investigate, who’s investigating, who to speak to, what evidence to gather, such as work records, emails or CCTV, anything you could lose, such as footage that’s deleted after a set time or someone going on leave, and your timeframe.
• Gather evidence from all sides. Be fair and objective, get as much information as is reasonable and keep the case confidential. Your aim is to find out what happened.
• Start with the person who raised it. Go through what they know and what they’d like to happen, and let them bring a colleague or union representative.
• Interview witnesses with neutral questions. At the start, explain who’s there and why, the investigator’s role, the purpose and the need for confidentiality. Record the answers, and any refusals to answer, and give each person their notes to check as their witness statement.
• Be fair to the person named. Tell them about the investigation as soon as you decide to start it, unless they might tamper with evidence or influence witnesses, and explain why, who is investigating, how long it could take and what happens next. Hear their side and keep an open mind, without revealing who raised the concern. The FCA’s guidance on training managers includes the steps that ensure fair treatment of anyone a whistleblower accuses of wrongdoing.
• Keep any conduct issue separate. If the findings point to misconduct, start a separate disciplinary process, with its own rights. NHS England’s national policy says the same of any conduct issue an investigation turns up.

What the law requires. No law sets the form of a report. If the person later brings a claim for unfair treatment, it’s for you to show why you did what you did (Employment Rights Act 1996, section 48), and the report and your records are how you show it. UK banks and Solvency II insurers must keep records of each concern and how they treated it, including the outcome (FCA SYSC 18).

Good practice. Acas says an investigation report should set out:

• which facts were established
• which facts were not established
• any mitigating circumstances
• all the evidence collected

Keep it objective and concise, stick to the facts and explain any acronyms. The conclusions are the investigator’s own, and they can take advice from HR. If their terms of reference ask for recommendations, they can recommend formal action, such as a disciplinary hearing or a change to a policy; informal action, such as training, counselling or mediation; or no further action. If the information turns out to be untrue, GOV.UK says that doesn’t mean the person raised it maliciously. NHS England’s national policy adds that the report identifies any issues, to stop the problems happening again.

What the law requires. Data protection law sets no fixed period for keeping the records: keep them only as long as you need them, and set the period in a retention schedule (ICO). UK banks and Solvency II insurers must keep records of each concern and its outcome, report to the board at least once a year on how well their whistleblowing arrangements work, keeping whistleblowers’ identities confidential, and tell the FCA promptly about each tribunal claim they contested and lost on whistleblowing detriment or dismissal (FCA SYSC 18). In the EU, the Directive requires a record of every report, kept no longer than necessary and proportionate.

Good practice.

• Close it with the person. Tell them the case is closed, what changed as far as you can, and who to go to if anyone treats them badly for raising it.
• Keep one record: the concern, each decision and the reason for it, the investigation, each check-in and the outcome. If they later say someone treated them badly for speaking up, it shows why you acted as you did.
• Act on the lessons. NHS England’s national policy promises staff that lessons are shared across the organisation, and CQC expects leaders to share lessons and act on them.
• Report numbers and themes to the board at least once a year, naming nobody. Our ER metrics guide covers what to report and how to calculate it.

CalmER keeps every concern in one case log, shows trends across teams, sites and case types, and drafts a board pack from your live data for a person to sign off. See CalmER.

The UK law in this guide covers England, Scotland and Wales, and the wrongdoing a worker reports can be in the UK or abroad.

• Northern Ireland has its own law, the Employment Rights (Northern Ireland) Order 1996, and its list of what counts doesn’t include sexual harassment.
• EU countries. Employers with 50 or more workers in an EU country need internal reporting channels and procedures that acknowledge reports within 7 days, name an impartial person to follow up, give feedback within 3 months, protect the reporter’s identity and keep a record of each report (Directive (EU) 2019/1937, articles 8, 9, 16 and 18). Each country’s law adds its own rules: Ireland’s, for example, adds feedback every 3 months if the person asks.

One procedure can work in every country if it meets the strictest rules you face, starting with the Directive’s: acknowledge within 7 days, give feedback within 3 months, and keep identities to the people handling the case. Our EU Whistleblowing Directive guide covers what each country requires.