Whistleblowing Policy template

2. Policy statement

{{org.name}} wants wrongdoing reported, however uncomfortable that is. We would always rather hear about a problem from our own people than from a regulator, a journalist, or a court. Anyone who raises a genuine concern under this policy will be supported and protected, even if the concern turns out to be mistaken.

3. What to report under this policy

• Criminal activity, including theft, fraud, or bribery.
• Failure to comply with a legal or regulatory obligation.
• Danger to the health and safety of any person — staff, customers, or the public.
• Damage to the environment.
• A miscarriage of justice.
• Misuse of personal data or serious breaches of confidentiality.
• Deliberate concealment of any of the above.

4. How to raise a concern

1. 1Report the concern to [whistleblowing officer — name/role]. If the concern involves that person, go to [alternative senior name/role] instead.
2. 2Raise it in writing or verbally — a conversation is a valid report and will be written up and confirmed back to you.
3. 3Give what facts you can: what you saw or heard, dates, people involved, and any documents. You are not expected to investigate or prove anything yourself.
4. 4Say whether you want to be identified, kept confidential, or remain anonymous. Anonymous reports are accepted, but they limit how well we can investigate and mean we cannot update or protect you directly.

5. How {{org.name}} handles concerns

1. 1Acknowledge the concern within [number] working days.
2. 2Make an initial assessment and decide the response: internal investigation, escalation to [owner/board], or referral to the police or a regulator.
3. 3Appoint an investigator with no involvement in the matter, who gathers evidence proportionately and confidentially.
4. 4Keep the person who raised the concern updated where possible — timescales and, as far as confidentiality allows, the outcome.
5. 5Record the concern, the investigation, and the outcome in [confidential register/location], and fix any process gap the case exposed.

6. Protection and confidentiality

Nobody who raises a genuine concern under this policy will be dismissed or suffer any detriment for doing so — no demotion, victimisation, lost hours, or exclusion. Retaliating against a whistleblower is a disciplinary offence at {{org.name}}, and serious retaliation is gross misconduct.

We keep the identity of the person raising the concern confidential wherever we can. Deliberately false or malicious reports — as opposed to honest concerns that prove unfounded — are dealt with under the disciplinary procedure.

7. External disclosures

We hope anyone with a concern raises it internally first, so we can act quickly. However, workers have the legal right to make a protected disclosure to a prescribed person — the relevant regulator for the subject matter, such as the HSE for safety concerns or the ICO for data concerns. GOV.UK publishes the full list.

Nothing in this policy, any contract, or any settlement agreement prevents a worker from making a protected disclosure.

8. Records and review

The whistleblowing register is held by [name/role], access-restricted, and retained in line with our data retention policy. [Owner/board] reviews anonymised themes [frequency] so patterns are spotted.

This policy is reviewed [frequency, e.g. annually] and after every concern raised under it. Owner: [name/role]. Next review due: [date].