Тази страница е достъпна само на английски.

Whistleblower law in the United Kingdom #

The United Kingdom protects whistleblowers through Part IVA of the Employment Rights Act 1996, inserted by the Public Interest Disclosure Act 1998 (PIDA). It is not a transposition of Directive (EU) 2019/1937 and predates it by two decades. The structural difference matters more than any point of detail: the Directive obliges the employer to operate a reporting channel, while UK law imposes no such duty and instead gives the worker a remedy after the fact.

Applicable law #

Does Directive (EU) 2019/1937 apply? #

No. The Directive binds member states, and the UK ceased to be one on 31 January 2020 — before the 17 December 2021 transposition deadline. No UK entity is in scope by virtue of being British.

A UK group is still exposed through its subsidiaries. The Directive’s 50-worker threshold applies per legal entity, not per corporate group, so a subsidiary established in a member state falls under that state’s transposing law whatever the parent’s nationality. See our reading of the threshold and the country-by-country obligations .

Who must establish an internal channel #

There is no general statutory duty to operate one. A disclosure to the employer is one protected route among several (s. 43C ERA 1996), not an obligation the employer owes. Two regimes narrow that in practice.

Financial services. SYSC 18.3.1R of the FCA Handbook requires a firm to “establish, implement and maintain appropriate and effective arrangements for the disclosure of reportable concerns by whistleblowers”. “Firm” is narrow here: UK SMCR banking firms other than small deposit takers, and Solvency II insurers. Those firms must also appoint a whistleblowers’ champion (SYSC 18.4) and ensure settlement agreements state that workers may make protected disclosures (SYSC 18.5). SYSC 18.6 carries separate procedure obligations for UK MiFID investment firms other than collective portfolio management firms, and for third-country investment firms.

Large organisations, through fraud. Since 1 September 2025, s. 199 of the Economic Crime and Corporate Transparency Act 2023 makes a large organisation criminally liable where an associated person commits a listed fraud offence intending to benefit it. A body is “large” if it met two of three conditions in the preceding financial year: turnover over £36 million, balance sheet total over £18 million, more than 250 employees (s. 201 ). The only defence is having had reasonable fraud prevention procedures in place, and the statutory guidance states: “To help prevent fraud, organisations should have appropriate whistleblowing arrangements.”

That is the honest UK position. The obligation is not to have a channel; it is to be able to show reasonable procedures if an associate defrauds someone on the organisation’s behalf — and a channel is how the government’s own guidance says that is evidenced.

What counts as a protected disclosure #

Under s. 43B a qualifying disclosure is a disclosure of information which, in the worker’s reasonable belief, is made in the public interest and tends to show a criminal offence, a failure to comply with a legal obligation, a miscarriage of justice, danger to health or safety, sexual harassment, damage to the environment, or deliberate concealment of any of these. The public-interest test was added by the Enterprise and Regulatory Reform Act 2013; sexual harassment was added on 6 April 2026 by the Employment Rights Act 2025.

Section 43B(2) is easy to miss and useful for multinationals: it is immaterial whether the wrongdoing occurred in the UK or elsewhere, and whether the applicable law is British or foreign. A UK worker’s disclosure about conduct in an overseas group company can be protected.

External reporting: prescribed persons #

The UK has no single whistleblowing authority. Under s. 43F a worker may disclose to a prescribed person — a body named in an order made by the Secretary of State — provided the worker reasonably believes the matter falls within the description for which that person is prescribed and that the information is substantially true. The list of prescribed people and bodies records which kind of wrongdoing each body covers. Section 43FA lets the Secretary of State require prescribed persons to report annually on the disclosures they receive.

Nothing requires a worker to raise the matter internally first. Wider disclosure — to the press or the public — is a different matter: under s. 43G it is protected only where the worker reasonably believes the information is substantially true, does not act for personal gain, meets one of the statutory gateways, and where disclosure is reasonable in all the circumstances. Section 43H relaxes the gateways for failures of an exceptionally serious nature.

Section 43G(3)(f) gives employers a concrete reason to run a channel: in judging whether a wider disclosure was reasonable, a tribunal has regard to whether the worker used a procedure authorised by the employer. Where no such procedure exists, that factor cannot count in the employer’s favour.

Protection and remedies #

Detriment (s. 47B). A worker has the right not to be subjected to detriment for making a protected disclosure. Since 2013 this covers detriment by co-workers and agents, with the employer treated as also having done it and an “all reasonable steps” defence available.
Dismissal (s. 103A). Dismissal is automatically unfair where the reason, or principal reason, is that the employee made a protected disclosure. The two-year qualifying period does not apply (s. 108(3)(ff)).
Uncapped compensation (s. 124(1A)). The statutory cap on the compensatory award does not apply to s. 103A dismissals.
Confidentiality clauses (s. 43J). Any agreement is void so far as it purports to preclude a protected disclosure. Section 202A, inserted by the Employment Rights Act 2025 and commenced for specified purposes on 6 January 2026, extends that voiding to clauses covering allegations of harassment and discrimination.

Data protection authority #

For complaints about the handling of personal data in a reporting process, the competent authority is the Information Commissioner’s Office , under the UK GDPR and the Data Protection Act 2018.

Key compliance points #

Northern Ireland runs a parallel regime under the Employment Rights (Northern Ireland) Order 1996 . The FCA Handbook reads its own references to the Employment Rights Act 1996 as including the corresponding Northern Ireland provisions (SYSC 18.1.1B).
A UK-shaped policy does not satisfy the Directive anywhere in the EU. It has no acknowledgment or feedback deadlines, no designated channel duty, and no equivalent of the Directive’s designated external authority.
The two-year qualifying period and the compensation cap both fall away in whistleblowing dismissals, which makes a badly handled report unusually expensive compared with an ordinary unfair-dismissal claim.
Internal procedures should say which prescribed person covers which subject, rather than pointing at “the regulator” in general — the s. 43F protection depends on the worker picking the right one.

Official sources #

Primary law

Government and regulator guidance

Deploy your reporting channel →