Protected Disclosure: Why Your Whistleblowing Channel Matters in 2026 [+ Policy Checklist]

When something goes wrong at work, whether it’s fraud, a safety shortcut or harassment, your leadership team is rarely the first to know. The people on the ground are. The question is whether they feel safe enough to tell you.

“No reports means no problems” is one of the most expensive assumptions an employer can make. Silence usually means people don’t know where to go, or don’t trust what happens when they do. Issues don’t resolve themselves in the meantime. They resurface later as tribunal claims, regulator enquiries or headlines.

And from 2026, the stakes are higher. The Employment Rights Act 2025 has made sexual harassment its own category of whistleblowing disclosure and is raising the bar on what employers must do to prevent it. Here’s what’s changed, why a proper whistleblowing channel matters, and a checklist to get your policy in shape.

Key facts

• A whistleblowing channel is a secure, confidential (or anonymous) route for workers to raise serious concerns, such as a dedicated portal, hotline or in-app channel.
• Is it a legal requirement? For most UK employers, no. There’s no general duty to run a whistleblowing channel, unlike the EU, where organisations with 50+ workers must have one. Some regulated sectors, such as FCA-regulated firms, do have specific requirements.
• Who’s protected: workers who make a “qualifying disclosure” in the public interest are protected under the Public Interest Disclosure Act 1998 (PIDA), which sits within the Employment Rights Act 1996. Protection applies from day one.
• What’s new: since April 2026, sexual harassment is a specific category of qualifying disclosure. From October 2026, employers must take all reasonable steps to prevent sexual harassment, including by third parties such as customers.
• Why it matters: a clear, trusted reporting route is one of the most practical ways to show you’re meeting your harassment prevention duty, and to hear about problems while you can still fix them.

Is your business prepared for the UK Employment Rights Act?

• Review active rules, from day-one Statutory Sick Pay to six-year holiday record-keeping.
• Prepare for doubled tribunal claim windows and mandatory sexual harassment prevention duties.
• Audit probation and onboarding workflows before the six-month unfair dismissal threshold.

Download for free

What changed in 2026

Three changes in two years have moved harassment reporting from “good practice” to something tribunals will look at closely.

The public interest test still applies, so not every complaint becomes a whistleblowing case. But the line between “HR issue” and “protected disclosure” is now much thinner where harassment is involved. How you receive and handle reports matters more than ever.

Dates as of November 2026. Some details depend on secondary regulations, so check the GOV.UK Employment Rights Act 2025 overview for the latest.

Why silence isn't safety

Recent independent reviews into UK workplaces, from broadcasters to the NHS to financial services, keep finding the same pattern. Concerns existed, but they never reached anyone who could act.

Picture a junior production assistant who sees a senior presenter repeatedly making inappropriate comments to freelancers. She mentions it to her line manager. Her manager is sympathetic but busy, and the presenter brings in the ratings. Nothing gets written down. Two years later, a former freelancer goes to the press, and the company is asked what it knew and when.

That scenario plays out in every sector, and it teaches three lessons:

• Unreported isn’t the same as resolved. An issue nobody logged is still a live risk. It just hasn’t been found yet.
• Late discovery weakens your position. Years later, you can no longer protect the victims, fix the culture or show you acted promptly.
• Power imbalances silence informal routes. Expecting a contractor or junior employee to raise concerns about a senior leader or star performer with their own manager is unrealistic. Without an independent channel, those concerns leave the business, and come back through a tribunal, a regulator or a journalist.

A trusted channel closes the gap between what’s happening on the ground and what leadership knows.

Whistleblowing vs personal grievance: what's the difference?

The key question is whether the concern affects others or the wider public, or mainly the individual raising it.

Grey areas are normal. A single dispute between two colleagues usually goes through grievance. But a pattern of bullying, repeated harassment or a manager covering things up may well be a protected disclosure. If in doubt, treat it with whistleblowing-level confidentiality and take advice.

5 ways an internal channel protects your business

1. You hear about problems while you can still fix them. When someone spots dodgy bookkeeping or inappropriate behaviour, they choose between speaking up and staying quiet. A clear, trusted channel tips that choice towards speaking up, so you can investigate and act before things escalate.
2. Concerns stay in-house. Workers can take concerns to “prescribed persons” such as the HSE, the FCA or the ICO, and still be protected. In more limited circumstances, wider disclosures, including to the media, can be protected too. An internal route that people trust means you get the first chance to put things right.
3. You can show you’re meeting your harassment duty. With the “all reasonable steps” duty now in place, tribunals will ask what you actually did to prevent harassment. A well-communicated reporting channel, backed by training and follow-up, is concrete evidence.
4. Fear stops being the deciding factor. In one UK survey of 2,000 employees, those unwilling to blow the whistle most often cited fear of losing their job (45%) or of retaliation and bullying (39%). Anonymous, two-way reporting lowers that barrier, especially for contractors, apprentices and junior staff.
5. It strengthens trust in your governance. Investors, enterprise customers and candidates increasingly look at how a company handles misconduct. A working speak-up process is a visible sign of good governance.

Where AI helps, and where people must decide

AI can make a speak-up process faster and more consistent. It can’t replace the judgement and empathy these cases need.

Where AI earns its place:

• Triage and routing. Categorising reports (fraud, safety, harassment) and sending them to the right, conflict-free handler quickly.
• Spotting patterns. Flagging repeated concerns about the same team, site or manager that might look minor on their own.
• Admin and deadlines. Drafting acknowledgements, tracking response times and keeping the audit trail complete.
• Accessibility. Translating reports and summarising long case files so investigators can get up to speed.

Where a person needs to lead:

• The first human response. Someone reporting harassment or a cover-up is often anxious and taking a real risk. How they’re listened to shapes whether they trust the process, and whether others come forward.
• Judging credibility and context. Weighing evidence, reading between the lines and understanding workplace dynamics is human work.
• Decisions with consequences. Whether to investigate, suspend, discipline or protect someone should be made by an accountable person. Under UK GDPR, people have rights around significant decisions made solely by automated means.
• Ongoing care. Checking in, adjusting working arrangements and watching for signs of detriment needs a named person, not a workflow.

One practical rule: never paste whistleblowing reports into general-purpose AI tools. These are some of the most sensitive records you hold. Use AI only within systems that have the right security, access controls and data processing terms in place.

Unlock Your Company's Potential with Factorial One

One knows your company and its policies inside out. It answers HR questions, creates reports, and drafts job offers – so you can focus on what matters

Get a demo

Whistleblowing policy checklist

Use this to check your current policy, or as the starting point for a new one. Acas and the government’s guidance for employers are good references.

Policy

• A standalone whistleblowing policy, separate from your grievance procedure
• Plain-English explanation of what counts as a qualifying disclosure, with examples, including sexual harassment
• Clear statement that the policy covers workers, contractors, agency staff and apprentices, not just employees
• Explicit zero-tolerance commitment against retaliation, with victimisation treated as gross misconduct
• Links to your harassment prevention policy and risk assessment, including third-party harassment

Reporting routes

• At least one route that bypasses line management entirely
• An anonymous option that still lets investigators ask follow-up questions
• A secure, access-controlled channel, not a shared inbox
• Details of external routes, including the relevant prescribed persons[10]

Handling and investigation

• Named, trained case handlers with no conflict of interest (for example Head of People, Compliance, or an external provider)
• Target timeframes for acknowledging and updating reporters. UK law sets none, so set your own (many organisations aim for 7 days to acknowledge)
• A process for escalating serious or board-level concerns
• A clear rule on where AI is and isn’t used, with people making all decisions on outcomes
• Confidential record-keeping that complies with UK GDPR

Culture and follow-through

• Policy communicated at onboarding and refreshed regularly
• Managers trained to recognise and pass on disclosures, not resolve them informally
• Support and check-ins for people who’ve raised concerns
• Anonymised reporting data reviewed by leadership at least annually

How Factorial helps

A policy only works if people can use it easily and safely. Factorial’s Corporate Complaints Channel gives you:

• Anonymous, secure reporting. Reports can be fully anonymous, each reporter gets a unique access credential, and information travels over an encrypted channel.
• A route for everyone, not just employees. Candidates, suppliers, clients and the public can raise concerns too, which matters now that the harassment duty covers third parties.
• Reporters stay involved. People can add information and follow the status of their report, without revealing who they are.
• Clear ownership and deadlines. Assign a named person to each case, track it on a timeline in a centralised, audit-ready dashboard, and get notifications and expiry alerts so nothing slips.

The software handles the logistics, so your people team can focus on the part only humans can do: listening, investigating fairly and putting things right.

Frequently asked questions

Is sexual harassment automatically treated as a whistleblowing disclosure in the UK?

From April 2026 under the Employment Rights Act 2025, sexual harassment is explicitly classified as a qualifying disclosure. However, to receive whistleblowing protection under PIDA, the worker must still reasonably believe that reporting it is in the public interest rather than solely a personal grievance.

Are employers legally required to provide an anonymous whistleblowing channel?

Unlike in the EU, there is no blanket legal requirement for all UK employers to maintain a formal whistleblowing channel (except in specific regulated sectors such as financial services). However, offering a secure, anonymous reporting route is strong evidence of taking “all reasonable steps” to prevent harassment under updated UK legislation.

Does whistleblowing protection apply to contractors and agency workers?

Yes. Protection under the Public Interest Disclosure Act 1998 applies from day one of employment to a wide definition of “workers,” including agency staff, contractors, trainees, and apprentices.