Whistleblowing: how to have good ‘speaking up’ procedures and why this matters

Back to Employment and Industrial Relations Law Committee publications

Ed Mills
Travers Smith, London

Anna West
Travers Smith, London


Employers are increasingly focusing on the area of whistleblowing, following recent high-value cases and in light of the new European Union whistleblowing directive. This article looks at the current United Kingdom regime and the new EU directive and discusses best practice for employers when implementing whistleblowing policies and procedures and investigating concerns raised.

Whistleblowing laws were first introduced in the UK in 1998, as a response to a number of separate tragedies and scandals, including the Zeebrugge ferry disaster, the Clapham rail crash and the collapse of the Bank of Credit and Commercial International (BCCI). It became clear during public inquiries that a serious part of the problem was a workplace culture in which employees were afraid to speak up.

Twenty-two years on, whistleblowing continues to be as topical as ever, both in the UK and abroad, with news stories in the last few years involving a number of high profile businesses (Barclays, HBOS and KPMG) and with the US President having been impeached following disclosures by an anonymous whistleblower.

Whistleblowing protections vary greatly from one country to another. Most notably, some countries (including the USA, Canada, South Korea and Hungary) offer bounty payments to whistleblowers, while many others (including the UK) have so far decided not to introduce these. Even across Europe, there are many differences in the protections and rights of whistleblowers. The European Parliament has concluded that only ten European countries offered comprehensive protection to whistleblowers.

EU Whistleblowing Directive

In order to ensure a consistent approach across Europe, a new EU Whistleblowing Directive[1] (‘the Directive’) came into force in December 2019, which European Member States will have to implement by December 2021. The Directive sets out comprehensive protection for individuals who report on breaches of EU law covering specific areas, including financial services, environment, public health, consumer protection and data protection. (See the box for the key features of the directive.)



The Directive will apply to workers, self-employed individuals, shareholders and contractors/subcontractors, former employees/workers, and job applicants. The key requirements are:

• Employers with 50 or more employees will have to establish internal channels and procedures for whistleblowers to make a report and for the employer to follow up.

• Reporting channels may be internal or external but must be secure and ensure the whistleblower's identity is kept confidential.

• Employers will have 7 days to acknowledge receipt of a whistleblowing report, and designate who (internally) will follow up.

• Whistleblowers must be given feedback by the employer within three months of the employer's acknowledgement of the report.

• The identity of the whistleblower cannot be disclosed without their explicit consent.

• A whistleblower can report publicly (and will be protected) if:

– they first reported internally or externally (eg, to a regulator) and no appropriate action was taken in the timeframe; or

– they reasonably believed either that there was an imminent danger to the public interest or that there was a risk of retaliation/low risk of the issue being addressed, following an external report.

• Whistleblowers will be protected from retaliation and will also be immune from civil liability relating to their use of information (eg, confidentiality claims) and entitled to compensation (in accordance with national laws).

• The burden of proof will be on the employer to show that any detriment was not on grounds of whistleblowing.


UK whistleblowing laws: now and in the future

The UK is among the European countries considered to have some of the better protection for whistleblowers (see the box for an overview of the UK position). Despite this, the new Directive would mean some changes to the UK regime, most notably:

  • protection for self-employed individuals and job applicants (this is wider than the current protection, which covers employees and workers only);
  • the new requirement for internal whistleblowing channels (currently only certain employers in the financial services sector are required to have internal whistleblowing policies and procedures);
  • greater scope for whistleblowers to report publicly (currently whistle-blowers can only make public reports in extremely limited circumstances);
  • strict rules around anonymity for whistleblowers (currently whistleblowers may ask to remain anonymous, but employers do not have to guarantee their anonymity (for example, their identity may become clear during the investigation).

There is some uncertainty over Brexit’s impact on the implementation of the Whistleblowing Directive and much will depend on the nature of the UK's future relationship with the EU, which is yet to be negotiated.

Separately, the All Party Parliamentary Group for Whistleblowing is currently reviewing the adequacy of UK whistleblowing laws. The Group's first report, published in June 2019, included a ten point plan of recommendations. Among those recommendations was establishing an independent whistleblowing body.



• A person blows the whistle if they make a disclosure that is:

– about a criminal offence, breach of a legal obligation, miscarriage of justice, risk to health and safety or to the environment, or a cover-up of any of these, and

– in the public interest, and

– made to their employer, or legal adviser, or relevant regulator

(known as a "protected disclosure")

• It doesn't matter if the whistleblower is motivated by his or her own personal interests, as long as the disclosure is also in the public interest

• Factors relevant to whether a disclosure is in the public interest include the identity of the wrongdoing organisation, the nature of the wrongdoing (including whether it was deliberate), and the numbers affected

• If a person is dismissed for whistleblowing, they may claim compensation for their losses, up to one year's pay (capped at £83,682)

• Individuals can claim compensation for loss, and also for injury to feelings, if they are subjected to a detriment (e.g. a disciplinary warning) for having blown the whistle.

• It is possible for a whistleblower to bring a claim against an individual colleague or manager, for whistleblowing detriment.


Practical considerations for employers

Employer approaches to whistleblowing have evolved over the 22 years since the laws were originally introduced. Initially, it was common for an employer simply to put in place a basic whistleblowing policy, which outlined the legal position and offered internal channels for making complaints.

Now, more and more employers are proactively encouraging and developing an environment in which employees feel able to speak up, as part of an increasing focus on organisational culture. This also ensures that concerns are addressed at an early stage, rather than being ignored, only to erupt later. In some organisations, it is becoming clear that there have been sexual harassment issues which were not raised at the time due to employees' fears of speaking up. These businesses are doing a lot of work to eradicate this barrier, as an important part of their approach to diversity and inclusion. In the financial services sector specifically, creating a culture of openness is seen as a key part of reducing the risk of the types of scandals the industry has seen in the past. Banks, building societies and certain other financial services businesses are now specifically required to put in place whistleblowing procedures, including an external channel for raising concerns, and to designate a whistleblowers’ champion.

There are a number of steps which employers can take to develop and embed a speaking-up culture, and to reduce the risk of successful whistleblowing claims.

Policies and procedures

All employers should have a whistleblowing or ‘speak up’ policy, including:

  • a statement of the employer's commitment to a culture of openness, encouraging employees to speak up;
  • details of the types of issues that should be raised under the whistleblowing policy;
  • a number of internal channels for raising issues and details of any external channel and any relevant regulator (see below);
  • how concerns will be investigated and what feedback the whistleblower can expect to receive; and
  • commitment to ensuring that whistleblowers do not suffer retaliation and treating any such retaliation as a disciplinary matter.

It is advisable to offer employees as wide a range of whistleblowing channels as possible, including an external channel, such as a third party whistleblowing hotline. This increases the likelihood of matters being raised (particularly serious issues, or concerns about senior staff, which employees may feel less comfortable about highlighting internally). Employers are increasingly turning to external providers (such as NAVEX Global) who can assist by operating anonymous hotlines, advising on compliance and offering online tools for handling complaints.


Training in whistleblowing policy and procedures is important, for all levels of staff (and is a specific requirement for some financial services employers). A survey by Protect, the UK whistleblowing charity, found that whilst 93 per cent of employers said they had whistleblowing arrangements in place, only 43 per cent of employees were aware of a whistleblowing policy at work.

However good a whistleblowing policy may be on paper, it is of little use if employees are unfamiliar with it or lack confidence in it. As well as training managers and other senior staff who may be on the receiving end of a whistleblowing concern, all other employees should also be trained in the policy in order to ensure that they understand what it is for and how it works. This training also helps to demonstrate the organisation's commitment to a speaking-up culture. It can work well for staff at all levels to be trained together, with an additional, separate session for managers on issues specific to them.

Anonymity and confidentiality

Any concerns raised through the whistleblowing channels should be investigated as fully as possible. Investigations are often more difficult when the whistleblowing concern has been raised anonymously, because the employer may not be able to go back to the whistleblower to ask for further information. When there is a way to make contact, the whistleblower may be reluctant to give further information for fear of their identity being revealed. The employer can only do as much investigation as the information allows. It is worthwhile making this clear in the policy and the training, so that employees understand why investigations might be limited in some circumstances and to encourage them to provide as much information as possible.

Sometimes employees raise a concern confidentially, for example, through Human Resources, and ask that their identity is kept confidential. This can put the employer in a difficult position, because they cannot always guarantee that the whistleblower's identity will remain a secret as it might become clear to others during the course of the investigation. This may happen, for example, because information which only the whistleblower could know is relied upon. Again, it is important to make clear to employees in the policy and training that, although the employer will always respect the individual's wish to remain confidential, their confidentiality cannot be guaranteed in every situation.


If an employee reports something and never hears anything from the employer about it, they may well think that nothing has been done, even though the opposite may be the case. In this way, confidence in the policy and procedure can quickly be undermined. Even though employers may not be able to give any information about the detail of an investigation (because of confidentiality), they should provide feedback to the whistleblower as far as possible, for example, that an investigation is under way or has concluded and that appropriate action has been taken. It is also important to keep dialogue with the whistleblower open and to encourage them to speak up if they feel they may be suffering any kind of retaliation.

Some larger employers report annually to staff employees on the number of concerns that have been reported through their whistleblowing channels and on the fact that they have been (or are being) addressed. This can help to demonstrate the employer's commitment to the whistleblowing process and may help employees feel more confident about using it.

Tactical whistleblowing?

All employers run the risk that, from time to time, there may be individuals who decide to use the whistleblowing process ‘tactically’. For example, they may do so during a performance management process and then claim that the subsequent dismissal was due to the whistleblowing. Having thorough policies and procedures, alongside training, and demonstrating commitment to an open culture, means that a tactical claim of this nature is less likely to succeed. Most whistleblowing claims turn on causation, that is, whether the whistleblowing caused the dismissal or was detrimental. If the employer can show it genuinely encourages employees to speak up, it may be harder for an employee to persuade an Employment Tribunal that they were dismissed for whistleblowing.

Future developments

Whistleblowing is likely to continue as a focus for employers in the UK and across Europe, especially in light of the new EU Directive, which will require all employers (except those with fewer than 50 employees) to have whistleblowing policies and procedures in place. Employers who have not already done so would be well advised to start addressing this early on. There are many benefits for employers who implement whistleblowing policies, procedures and training, if they are genuinely committed to creating a culture in which employees are not afraid to speak up.


[1] EU directive on the protection of persons reporting on breaches of Union law: Directive 2019/1937 on the protection of persons who report breaches of union law: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.305.01.0017.01.ENG&toc=OJ:L:2019:305:TOC


Back to Employment and Industrial Relations Law Committee publications