Speak Up and Whistleblowing Essentials: A Guide for Employees

Most employees never expect to witness serious wrongdoing at work, but when it happens, knowing what to do next matters. Whistleblowing law exists to give you the confidence to speak up about genuine wrongdoing without risking your job or your career. This guide explains what a protected disclosure actually is under UK and Irish law, who is covered, how to raise a concern the right way, and what non-retaliation means in practice. If you want a structured way to build this knowledge alongside your other compliance training, Learnsignal's CPD courses cover whistleblowing essentials as part of a wider workplace conduct curriculum.

What Counts as a Protected Disclosure?

Not every complaint is whistleblowing. In law, a protected (or “qualifying”) disclosure is information about wrongdoing that you reasonably believe is happening, has happened, or is likely to happen, and which you reasonably believe is in the public interest to raise. It is not enough to simply be unhappy about something at work — the disclosure has to concern one of a defined set of serious issues.

In the UK, the Public Interest Disclosure Act 1998 (PIDA), as incorporated into the Employment Rights Act 1996, sets out six categories of relevant wrongdoing:

• A criminal offence
• A breach of a legal obligation
• A miscarriage of justice
• Danger to the health and safety of any individual
• Damage to the environment
• Deliberate concealment of information about any of the above

In Ireland, the Protected Disclosures Act 2014, significantly strengthened by the Protected Disclosures (Amendment) Act 2022 (which transposed the EU Whistleblowing Directive), defines “relevant wrongdoing” in broadly similar terms: criminal offences, failure to comply with a legal obligation (including breaches of EU law), miscarriages of justice, danger to health and safety, damage to the environment, misuse of public funds, oppressive or discriminatory conduct by a public body, and the concealment or destruction of evidence relating to any of these.

In both jurisdictions, you remain protected even if it later turns out the wrongdoing did not actually happen, provided you held a genuine and reasonable belief in it at the time you raised it.

Who Is Protected?

Protection is generally wider than people assume. Under UK law, anyone who meets the broad definition of a “worker” is covered — this includes employees, agency workers, and those on short-term or zero-hours contracts, not just permanent staff. Under Irish law the definition is wider still, extending to employees, former employees, job applicants, contractors, agency workers, trainees, volunteers, and board members.

You do not need to be a compliance officer, an auditor, or a manager to raise a protected disclosure — the law is designed for every employee, which is exactly why this foundational training exists for the whole organisation rather than only for those in oversight roles.

Whistleblowing Is Not the Same as a Personal Grievance

One of the most common misconceptions employees have is that any complaint about being treated unfairly counts as whistleblowing. It does not. A personal grievance — a dispute about your own pay, your own performance review, a clash with a colleague, or how you personally have been treated — is an employment relations matter, usually dealt with through your organisation's grievance procedure, not whistleblowing law.

Whistleblowing is about wrongdoing that affects others or the wider public interest: a safety risk to colleagues or customers, financial fraud, a breach of regulation, environmental harm, or a cover-up of any of these. If your concern is purely personal to you and does not point to wider wrongdoing, it is still worth raising through the right channel — but it will not attract the specific legal protections described here.

How to Raise a Concern

Most organisations expect concerns to be raised internally first, and internal routes are usually the quickest way to get an issue looked at. Typical steps include:

• Your line manager — the first port of call for most concerns, unless the wrongdoing involves them directly.
• A designated speak-up or whistleblowing officer — many organisations have a named contact or confidential hotline separate from the normal management line.
• Senior management, HR, or the board — appropriate where the concern involves your direct manager or is particularly serious.

If you do not feel able to raise a concern internally, or you have done so and nothing has been done, both jurisdictions allow disclosure to an external regulator — known in the UK as a “prescribed person” and covered similarly in Ireland — such as the Financial Conduct Authority, the Health and Safety Executive, the Health and Safety Authority, or a relevant professional or sectoral regulator. In Ireland, disclosures can also be made to the independent Office of the Protected Disclosures Commissioner, which was established to receive and route disclosures appropriately.

Wider disclosure — to the media, an MP, or the public — is protected only in narrower circumstances: typically where you reasonably believe you would be penalised for raising it internally, where evidence would likely be concealed or destroyed, where you have already raised it with no adequate response, or where the wrongdoing is exceptionally serious. Going public should be a last resort, not a first step, because the legal bar for protection is considerably higher.

Managers who receive a disclosure have their own set of responsibilities — acknowledging it, keeping it confidential, and handling any resulting investigation properly. If you manage people, or want to understand what happens once a concern lands on someone's desk, Learnsignal's companion guide, Handling Whistleblowing Disclosures: A Guide for Managers, covers that side of the process in detail.

What Happens After You Raise a Concern?

Once you have raised a genuine concern, your organisation should acknowledge it, treat it confidentially, and assess whether it needs a formal investigation. Not every disclosure results in a full investigation, but where one is needed, it should be conducted fairly, proportionately, and by someone without a conflict of interest. If you want to understand what a proper investigation process looks like from the inside — including how evidence is gathered and how interviews are conducted — Learnsignal's guide to conducting workplace investigations walks through the full process.

Non-Retaliation: What It Actually Means

Non-retaliation is the legal and cultural backbone of any speak-up system. In practice, it means your employer cannot dismiss you, demote you, deny you a promotion, cut your hours, exclude you from training, give you an unfairly negative appraisal, or otherwise treat you detrimentally because you made a protected disclosure. In the UK, dismissal for making a protected disclosure is automatically unfair, and there is no cap on the compensation that can be awarded in a successful claim. In Ireland, dismissal connected to a protected disclosure is likewise automatically unfair, and interim relief may be available to keep you employed while a claim is heard, with the burden generally falling on the employer to show that any detrimental treatment was not connected to the disclosure.

Non-retaliation also has a practical, day-to-day dimension that matters as much as the legal one: colleagues and managers should not freeze someone out, gossip about a disclosure, or subtly change how they treat a person who has spoken up. A genuinely healthy speak-up culture depends on this being understood by everyone, not just enforced after the fact by a tribunal.

Common Misconceptions Worth Clearing Up

• “Anonymous means untraceable.” You can often raise a concern anonymously, but anonymity is not always guaranteed once an investigation begins, particularly in a small team. Confidential reporting (where your identity is protected but known to a limited number of people) is usually a more realistic expectation than true anonymity.
• “I need hard proof before I say anything.” You do not need to prove the wrongdoing — you only need a reasonable belief, based on the information available to you, that it is happening or has happened.
• “Raising a concern will end my career here.” This fear is understandable but is exactly what non-retaliation protections are designed to prevent. Retaliation is unlawful, and organisations with a mature speak-up culture actively want concerns raised early, before a small issue becomes a serious one.
• “It only counts if I go to a regulator.” Most protected disclosures are, and should be, raised internally first. Going straight to an external body is rarely the right first step and can affect whether wider disclosures later qualify for protection.

Frequently Asked Questions

Do I have to be right about the wrongdoing for my disclosure to be protected?
No. You need to reasonably believe the information is true and that raising it is in the public interest. If your belief was genuine and reasonable at the time, you remain protected even if the concern turns out to be unfounded.

Can I be identified after I raise a concern?
Your organisation should handle disclosures confidentially and limit who knows your identity, but complete anonymity cannot always be guaranteed, especially once an investigation is under way. Ask what confidentiality measures apply before you raise a concern if this worries you.

What if my manager is the person I need to report?
Use an alternative internal route — a designated speak-up contact, HR, senior management, or the board — rather than raising it with the person involved. Most organisations' policies set this out explicitly.

Is a complaint about my own treatment at work a protected disclosure?
Usually not. A dispute about your own pay, workload, or treatment is typically a personal grievance, handled under your organisation's grievance procedure rather than whistleblowing law, unless it also points to wider wrongdoing affecting others.

Building Speak-Up Confidence Across Your Organisation

A genuine speak-up culture depends on every employee understanding what a protected disclosure is, feeling confident about how to raise one, and trusting that non-retaliation protections are real and enforced. Pairing this foundational knowledge with Learnsignal's CPD training gives your whole team — not just managers — a shared, accurate understanding of whistleblowing law and a practical route to raising concerns early, before small issues become serious ones.

Making it work in a finance function

A speaking-up policy only works where the culture behind it has been built deliberately. Finance team ethics training covers that side, and ethics training in finance covers what the professional bodies expect of it and how the obligation is evidenced.

The employer obligations behind a speak-up culture

Speak-up culture is often discussed as though it were purely a matter of tone. In Ireland it is also a statutory duty with a criminal offence attached, and the duty reaches most employers of any size.

The Protected Disclosures (Amendment) Act 2022, which has effect from 1 January 2023, requires employers to establish, maintain and operate internal reporting channels and procedures. The obligation applied first to employers with 250 or more employees, and from 17 December 2023 it extended to all organisations with 50 or more employees.

Size is not the only trigger. The requirement applies regardless of headcount to all public sector organisations, and to organisations subject to EU rules on financial services, money laundering and terrorist financing, transport safety, and offshore gas and oil safety. A small accountancy practice or financial services firm can therefore be in scope on sector grounds while sitting well under fifty staff.

What the channel has to actually do

The Act does not simply require a channel to exist. It sets out what the channel must do, and the timeframes are specific.

• Acknowledge every report in writing within seven days.
• Give feedback to the reporting person within three months on the action taken or planned, and further feedback at three-month intervals on request.
• Follow up diligently on all reports, and state the conditions, if any, under which anonymous reports will be followed up.
• Tell workers how to report externally — to a prescribed person or to the Protected Disclosures Commissioner.
• Operate securely and confidentially, in a manner compliant with data protection law, protecting the identity of the reporting person and of anyone named in a report.
• Put a designated person or function in charge with sufficient independence and authority to do the job, and ensure staff are adequately trained.

Failing to establish, maintain and operate those channels and procedures is an offence. Summary proceedings may be brought and prosecuted by the Workplace Relations Commission. Where a body corporate commits the offence with the consent or connivance of, or through neglect on the part of, a director, manager, secretary or other officer, that individual commits the offence too and can be prosecuted and punished personally.

Why this lands on the training plan rather than the policy file

Three of those requirements cannot be met by a document alone.

The seven-day acknowledgement and the three-month feedback obligation are operational. They need someone who knows the clock is running from the day a report arrives, including when it arrives informally to a line manager rather than through the formal channel. A policy that nobody has been walked through produces missed deadlines rather than compliance.

The requirement that staff be adequately trained is explicit in the guidance, and it applies most sharply to the designated person. Handling a disclosure means assessing whether it is a protected disclosure at all, preserving confidentiality under pressure, and avoiding the penalisation that gives rise to the employee's remedy — none of which is intuitive. Our guide to handling whistleblowing disclosures for managers covers that role in detail.

And the duty to tell workers how to escalate externally only works if workers have been told. An organisation that satisfies the letter of the Act in its handbook while its staff have no idea the channel exists has built the compliance and missed the point: reports go outside, or nowhere.

Related guides

• Protected disclosures in Ireland: employer duties and internal reporting channels
• Handling whistleblowing disclosures: a guide for managers
• Whistleblowing law for UK finance professionals
• The Protected Disclosures Act for healthcare employers in Ireland
• Whistleblower protections and speak-up culture in healthcare

Learnsignal's CPD courses include governance, ethics and compliance training for finance and professional services teams.