Whistleblowing in the UK is governed by a layered legal framework that has evolved significantly since 1998. At its foundation sits the Public Interest Disclosure Act 1998 (PIDA), amended and extended by subsequent legislation including the Employment Rights Act 2025 (ERA 2025).
Understanding this legal framework – what it protects, who it covers, and what it requires of those who receive disclosures – is a prerequisite for any manager involved in receiving, handling or escalating concerns in the workplace.
The foundation: Public Interest Disclosure Act 1998
PIDA amended the Employment Rights Act 1996 to create a specific set of protections for workers who make qualifying disclosures in the public interest. It remains the primary statute governing whistleblowing in the UK, though it has been materially amended since its enactment.
Who is protected
PIDA’s protections extend beyond employees to a broad category of “workers” including agency workers, contractors, trainees, and certain categories of self-employed professionals. Following ERA 2025, job applicants in certain circumstances may also be protected. This breadth means managers need to apply whistleblowing protections to a wider group than those covered by standard employment law.
What qualifies as a protected disclosure
A qualifying disclosure is a disclosure of information that the worker reasonably believes tends to show one or more of the following categories of wrongdoing:
- A criminal offence
- A failure to comply with a legal obligation
- A miscarriage of justice
- A danger to the health or safety of any individual
- Damage to the environment
- The deliberate concealment of any of the above
- Sexual harassment – added by ERA 2025, in force from 6 April 2026
The worker’s reasonable belief that the information tends to show one of these categories is the test – not whether the concern turns out to be well-founded. A disclosure made in good faith on reasonable grounds is protected even if an investigation finds no wrongdoing.
The public interest requirement
Since the Enterprise and Regulatory Reform Act 2013, a qualifying disclosure must also be made in the public interest. This requirement was introduced to prevent PIDA being used for essentially personal employment disputes dressed up as whistleblowing. In practice, concerns that affect a class of people beyond the individual worker – colleagues, customers, the public – will typically meet the public interest threshold.
Protected disclosure routes
PIDA establishes a tiered disclosure regime. The level of protection available depends in part on to whom the disclosure is made:
Internal disclosures
Disclosures made to the employer – or to a person nominated by the employer to receive reports – attract full protection. Internal reporting is the first tier and is the route most managers will encounter. Organisations with a whistleblowing hotline, a compliance function or a nominated whistleblowing officer are establishing an internal disclosure channel of this kind.
Prescribed person disclosures
Workers may also make protected disclosures to a prescribed person – a regulator or other body designated by the Secretary of State to receive reports in their area of responsibility. For financial services workers, this includes the FCA and the PRA. For health and safety concerns, it includes the HSE. Disclosures to prescribed persons attract full protection provided the worker reasonably believes the concern falls within the prescribed person’s remit and that the information is substantially true.
Wider disclosures
Disclosures to the media, MPs or other non-prescribed third parties attract protection only in more limited circumstances – broadly, where internal or prescribed person routes have been exhausted or would be inappropriate, and where the disclosure is not made for personal gain. The practical consequence for managers is that workers who have not been given a safe internal reporting route are more likely to seek external channels.
What the framework requires when a disclosure is received
The legal framework imposes both positive and negative obligations on those handling disclosures.
Negative obligations: what must not happen
The employer must not subject a worker to any detriment on grounds of a protected disclosure. Detriment is broadly defined and includes formal disciplinary action, informal marginalisation, withdrawal of opportunities, negative references and any other treatment that disadvantages the worker. The employer is vicariously liable for detriment caused by the acts of its managers and staff, unless it took all reasonable steps to prevent those acts. Individual managers can also be held personally liable for detriment they personally commit.
Positive obligations: what must happen
While PIDA does not prescribe a detailed investigation procedure, the practical requirements for handling a disclosure properly are well-established through case law and regulatory guidance. A disclosure must be: acknowledged and recorded; treated confidentially where requested; escalated to the appropriate internal function; investigated proportionately and in good faith; and followed up with feedback to the reporter where possible. Managers who receive a disclosure and take no action – or who refer it back to the person the disclosure is about – fail these requirements.
ERA 2025: what has changed in the framework
The Employment Rights Act 2025 made two changes to the PIDA framework with direct bearing on how disclosures are handled:
Sexual harassment as a qualifying category: from 6 April 2026, sexual harassment is an explicit qualifying disclosure category. Managers handling harassment complaints now need to assess whether the concern also constitutes a protected disclosure, and respond accordingly. Treating a harassment report purely as a grievance, without recognising the whistleblowing dimension, creates detriment risk under a framework the manager may not have known applied.
Fair Work Agency: ERA 2025 established the Fair Work Agency, which launched on 6 April 2026 with proactive enforcement powers. Organisations in scope can expect increased regulatory scrutiny of their employment practices, including how internal reporting channels are managed.
The role of ancillary frameworks
PIDA does not operate in isolation. Several ancillary frameworks bear on how whistleblowing disclosures are handled in practice:
- GDPR and the UK Data Protection Act 2018: the identity and personal data of reporters must be handled in accordance with data protection law. Breaching a reporter’s confidentiality can constitute both a detriment under PIDA and a data protection violation.
- Worker Protection Act 2023: where a disclosure relates to sexual harassment, the employer’s positive preventative duty under the WPA 2023 is also engaged. The handling of a harassment disclosure is simultaneously a PIDA matter and a WPA matter.
- ACAS Code of Practice: while the ACAS Code on disciplinary and grievance procedures does not directly govern whistleblowing, it applies to any disciplinary action that follows. A manager who initiates disciplinary proceedings against a worker shortly after receiving a protected disclosure creates both a PIDA detriment risk and an ACAS Code procedural risk.
- Sector regulation: in financial services, the FCA’s non-financial misconduct rules (PS25/23), in force from 1 September 2026, explicitly include how firms handle internal disclosures as a conduct matter. Healthcare, legal and other regulated sectors have their own overlay requirements.
Why the legal framework requires trained managers, not just policies
Protect’s 2025 Impact Report recorded 3,589 whistleblowing cases – an 8% year-on-year increase. Governance and staff conduct accounted for 30% of cases; bullying and harassment for 17%. The Freshfields Whistleblowing Survey 2023 found that 43% of employees had been involved in a whistleblowing situation, up from 32% in 2020, while line manager reporting had declined from 46% to 40% of cases – suggesting that workers are less confident in direct management chains as a reporting route than in independent channels.
A policy that accurately describes the legal framework is a necessary starting point. It is not sufficient. Managers who have not been trained on what a protected disclosure is, what detriment means, how to handle a report confidentially, and how to escalate correctly will make decisions in real situations that reflect their knowledge gap rather than the policy text. The legal framework imposes obligations on how disclosures are handled in practice – obligations that only trained managers can meet.
Related resources
Legal Obligations for Manager Training in the UK (hub): https://www.safecall.co.uk/resource/legal-obligations-for-manager-training-in-the-uk/
Handling Whistleblowing Disclosures – A Manager Guide: https://www.safecall.co.uk/resource/what-is-the-legal-framework-for-handling-whistleblowing-disclosures-in-the-uk/
Whistleblowing Training for Managers: https://www.safecall.co.uk/service/whistleblowing-training-for-managers-online-and-on-site/
Safecall Whistleblowing Resources: https://www.safecall.co.uk/resources/
Safecall’s whistleblowing training for managers
Safecall has delivered whistleblowing training since 1999, drawing on over 25 years of live case experience. Listen Up – Whistleblowing for Managers is a CPD Certified facilitated course that equips managers with the legal knowledge and practical skills to handle disclosures correctly across the full PIDA and ERA 2025 framework. Available online (half day) or in person (full day), it uses anonymised real-world examples drawn from Safecall’s own case history. Bespoke tailoring available.
Find out more about Safecall’s training courses at safecall.co.uk/service/compliance-training/ or contact the team at [email protected] | +44 (0) 191 516 7720
Sources and further reading
Public Interest Disclosure Act 1998 (as amended): legislation.gov.uk/ukpga/1998/23
Employment Rights Act 2025: legislation.gov.uk/ukpga/2025
Enterprise and Regulatory Reform Act 2013 – public interest amendment to PIDA: legislation.gov.uk/ukpga/2013/24
Worker Protection (Amendment of Equality Act 2010) Act 2023: legislation.gov.uk/ukpga/2023/51
Protect – 2025 Impact Report: protect-advice.org.uk/protect-2025-impact-report/
Freshfields Whistleblowing Survey 2023: freshfields.com/en-gb/our-thinking/campaigns/whistleblowing-survey-2023/
ACAS – Code of Practice on Disciplinary and Grievance Procedures: acas.org.uk/acas-code-of-practice-for-disciplinary-and-grievance-procedures