Guides / Whistleblowing and speaking up
Whistleblowing policy: what to include, with a template
A whistleblowing policy tells workers how to raise a concern about wrongdoing and tells managers what to do when one arrives. This guide covers what UK law protects, what a good policy says, and a short template you can adapt.
What a whistleblowing policy is for
A whistleblowing policy covers concerns about wrongdoing that affects other people: fraud, danger to health or safety, harassment, breaking the law, or covering any of these up. It is different from a grievance procedure, which deals with a person's complaint about their own treatment, such as their pay or a dispute with their manager.
Outside some regulated sectors, UK law does not require a private employer to have a written whistleblowing policy. Government guidance for employers says it is a good idea, so that workers know how to raise concerns and managers know how to respond. In practice a policy also gives you a record of what you promised, which matters when a concern is handled badly.
What UK law protects
In England, Scotland and Wales, whistleblowing protection sits in Part IVA of the Employment Rights Act 1996 (Northern Ireland has its own equivalent). A disclosure qualifies for protection when the worker reasonably believes it is in the public interest and that it tends to show one or more of the following:
- a criminal offence has been, is being or is likely to be committed;
- someone has failed, or is likely to fail, to meet a legal obligation;
- a miscarriage of justice;
- the health or safety of any person has been, is being or is likely to be endangered;
- sexual harassment has occurred, is occurring or is likely to occur (added from 6 April 2026 by the Employment Rights Act 2025);
- damage to the environment;
- deliberate concealment of any of the above.
It does not matter whether the wrongdoing happened in the UK or elsewhere. An employer must not treat a worker unfairly (the legal term is "detriment") or dismiss them for making a protected disclosure. Workers can also go to a "prescribed person", usually the regulator for that area, and keep their protection. GOV.UK publishes the list.
What a good policy says
- Who it covers. Employees, and also agency workers, contractors, volunteers and, where you choose, workers at your suppliers. Say so plainly.
- What to raise. The categories above, in everyday words with examples from your own work, and a note that personal complaints go through the grievance procedure.
- How to raise it. At least two routes, and at least one that does not go through the person's line manager. Name the people or the link, not just a job title.
- What happens next. Who acknowledges the concern, how quickly, whether the person will be asked questions, and what feedback they can expect. Be honest that you may not be able to share the outcome of an investigation in full.
- Confidentiality. Who will see the concern and the person's identity, and the limits. Do not promise what you cannot keep.
- Protection. That you will not tolerate detriment, and how someone reports it if it happens.
- Support. GOV.UK guidance says to let the worker bring a colleague or union representative to meetings if they want one.
- Outside routes. The relevant prescribed person and where to find the list. Telling people about outside routes shows you are not trying to keep concerns in.
- Records and review. Who keeps the record, who reports numbers to the board, and when the policy is next reviewed.
A short template
Adapt this to your organization and take advice before you rely on it. Square brackets mark what you need to fill in.
1. Purpose. [Organization] wants to hear about wrongdoing early. This policy explains how to raise a concern and what we will do.
2. Who can use it. Employees, agency and bank workers, contractors, volunteers and [supplier workers].
3. What to raise. Crime, breaches of legal obligations, danger to health or safety, sexual harassment, damage to the environment, miscarriages of justice, or any attempt to hide these. Complaints about your own employment go to [grievance procedure].
4. How to raise it. Tell [named person or team], use [site link or QR code], or contact [second route]. You do not need proof, only a reasonable belief.
5. What happens next. We will acknowledge your concern within [number] working days, may ask you questions, and will tell you what we are doing and when we have finished.
6. Confidentiality. Only [reviewers] will see your concern. We will protect your identity as far as we can and tell you if that becomes impossible.
7. Protection. Nobody will be treated unfairly for raising a concern in good faith. Report any such treatment to [named person].
8. Outside routes. You can also contact [prescribed person]. The full list is on GOV.UK.
9. Ownership. [Role] owns this policy and reports to [board or committee] every [period]. Next review: [date].
Make the policy work where people work
A policy on an intranet does not reach a night cleaner, a warehouse picker or an agency carer. Put the routes on the wall and in the induction pack, in the languages people use. Train the managers who are most likely to hear a concern first, because the first reply decides whether people try again. Our guide to building a speak up culture covers that part.
Then check the routes are used. If a site never raises anything, that is information too.
Where Tellhaven fits
Tellhaven can be one of the routes your policy names: a link or QR code for each site, where people type or talk in their own language, answer follow-up questions and read your reply in the same thread. It is not a statutory whistleblower channel and does not replace the other routes in your policy. See whistleblowing software or, if you run a phone line today, ethics hotline software.