Handling a Whistleblowing Complaint

How to Handle a Whistleblowing Complaint

Whistleblowing is when a worker reports wrongdoing that could meet the threshold of a protected disclosure. It’s usually something they have witnessed at work, that affects others or the wider public interest. It is different from a grievance, which concerns an individual's own employment situation, although the two can overlap and it is not always obvious at first which one you are dealing with.

How an organisation responds to a whistleblowing complaint matters. Handled well, it allows problems to be identified and fixed early, protects the organisation from legal and reputational damage, and shows employees that speaking up is safe. Handled badly, it can result in legal claims with uncapped compensation, regulatory scrutiny and lasting damage to trust. This guide takes you through the legal framework and the practical steps to follow.

What Counts as a Protected Disclosure

Broadly, a disclosure will qualify for protection where the worker reasonably believes it shows wrongdoing such as a criminal offence, a breach of a legal obligation, a miscarriage of justice, a danger to health and safety, damage to the environment, or the deliberate concealment of any of these.

A word of caution: a complaint does not need to be labelled as whistleblowing to be protected. Many protected disclosures arrive dressed as grievances, emails to managers, or comments in meetings, it’s also important to understand that a complaint or concern may not be a protected disclosure or grievance. Managers need to be able to know the difference and recognise a protected disclosure, because the protection applies from the moment the disclosure is made, not from the moment someone in HR categorises it.

Understand the Legal Framework

Whistleblowers have legal protection in all jurisdictions across the UK & Ireland, but the frameworks differ.

In Great Britain, workers who make a protected disclosure are protected from detriment and from dismissal for making a protected disclosure, dismissal in these circumstances is automatically unfair with no minimum service requirement and no cap on compensation. From April 2026, Sexual harassment was added as an express category of qualifying disclosure, meaning workers who report sexual harassment, whether it has occurred, is occurring or is likely to occur, are now clearly protected under whistleblowing legislation without needing to fit their disclosure into another category.

In Northern Ireland, the legislation provides broadly equivalent protection to that in GB, although employers should note that the recent GB reforms do not automatically apply in NI.

In the Republic of Ireland, there is a much more prescriptive regime. Private sector employers with 50 or more employees are required to establish formal internal reporting channels and procedures. There are strict statutory timelines: acknowledging a report within 7 days, diligently following up, and providing feedback to the person raising the complaint within 3 months (extendable to 6 months in duly justified cases).

Step 1: Have a Policy and Reporting Channels in Place

A clear whistleblowing policy should set out what whistleblowing is, how to raise a concern, who to raise it with (including an alternative route if the concern involves the person's manager), how confidentiality will be handled, and what the person can expect to happen next. Review your policy regularly, and if you operate in GB make sure it reflects the sexual harassment change introduced in April 2026.

Step 2: Receive and Acknowledge the Concern

When a concern is raised, acknowledge it promptly. Take an initial note of what is being alleged, by whom, and what evidence exists. Do not express scepticism or judgement at that stage. In Ireland, remember the statutory requirement to acknowledge the report within 7 days.

Step 3: Assess What You Are Dealing With

Carry out an initial assessment to establish whether the concern is a potential protected disclosure, a grievance, both, or neither. If in doubt, treat it as a protected disclosure and apply the higher standard of care. Decide who is best placed to handle it, ensuring they are impartial, sufficiently senior and not implicated.

Step 4: Protect the Whistleblower

Protect the whistleblower's identity as far as possible, sharing it only with those who genuinely need to know. Make clear to managers and anyone involved that retaliation of any kind, including subtle detriment such as exclusion, changed duties or a change in treatment is unacceptable and will itself be treated as a serious matter. Most whistleblowing claims arise not from the original wrongdoing but from how the person was treated after they spoke up.

Step 5: Investigate Proportionately

Investigate the substance of the concern fairly, thoroughly and proportionately to its seriousness. Follow a similar process to any workplace investigation: plan the scope, gather documents, interview relevant witnesses, keep accurate records, and reach findings based on the evidence. Where allegations are serious or complex, or where independence is difficult to achieve internally, consider appointing an external investigator.

Step 6: Feed Back and Act on Findings

Keep the whistleblower informed of progress where possible, recognising that confidentiality may limit what you can share about outcomes affecting others. In Ireland, feedback is required to be provided within 3 months. Where wrongdoing is found, take action to address it and to prevent recurrence. Where it is not, explain the outcome sensitively; a concern raised in good faith that turns out to be unfounded is still a protected disclosure.

Step 7: Keep Records and Take Learnings

Keep confidential records of the report, the assessment, the investigation and the outcome, in line with data protection requirements. Review what the case tells you about your culture, controls and training, and feed that learning back into the organisation.

Common Pitfalls to Avoid

•          Failing to spot that a grievance or complaint is also a protected disclosure.

•          Breaching confidentiality by naming a whistleblower unnecessarily.

•          Allowing subtle retaliation to go unchecked after a disclosure is made.

•          Dismissing a concern because of who raised it or how it was raised.

•          Missing the statutory timelines that apply in Ireland.

At A Human Resource we have extensive experience of handling sensitive workplace investigations and whistleblowing matters across the UK and Ireland. You can contact us for advice, guidance and support here.

Below are some links with additional helpful guidance on whistleblowing in the various jurisdictions:

GB: https://www.acas.org.uk/whistleblowing-at-work

NI: https://www.lra.org.uk/workplace-policies/whistleblowing

IE: https://www.workplacerelations.ie/en/what_you_should_know/employer-obligations/protection-of-whistleblowers/