How Whistleblowing Actually Works

Whistleblowing is not glamorous. It is paperwork, silence, and hoping someone reads what you sent. It is also how rot gets dragged into daylight. This guide shows you how to do it safely, get heard, and protect yourself.

What counts and what does not

Whistleblowing is public interest. Risks to safety, fraud, misuse of public funds, cover ups, unlawful data use, systemic discrimination, safeguarding failures. If the impact goes beyond you, it likely qualifies.

Grievance is personal. Pay disputes, one off unfair treatment that does not affect others. Use your employer’s grievance policy for those.

Prescribed persons and what we are not

Under the Public Interest Disclosure Act, some regulators and bodies are listed as prescribed persons. Disclosing to a relevant prescribed person can give a worker stronger protection in law if the disclosure meets the tests. The official list is here: prescribed persons list.

The Reasonable Adjustment is not a prescribed person. We are an independent public interest and journalism platform. People can lawfully contact us and we handle disclosures responsibly, but we cannot grant statutory protection. If you want the strongest legal protection, disclose to the correct regulator as well, or in some cases instead.

External disclosures to non prescribed recipients, including media or watchdogs, can still be protected in some situations if the law’s tests are met. Even then, parallel disclosure to a prescribed person is usually the safer plan.

When a one off dispute becomes a public interest matter

A single incident can be public interest if it exposes risk or wrongdoing that affects others. Use this quick test.

Public money: is there misuse of grants, contracts, or donations intended for the public. Are taxpayers, donors, or service users impacted.
Wider impact: would the same conduct affect other clients, staff, or a class of people, not just you.
Legal duty: is there a likely breach of law or regulation. Equality, safeguarding, data protection, charity governance, procurement rules.
Concealment: is there evidence of deletion, blocking contact, hiding records, or shutting down accountability routes.
Vulnerability: are at risk groups involved. Disabled people, children, patients, people under supervision or on benefits.

If you can answer yes to one or more of the above, you are not airing a personal grievance. You are raising a public interest concern. This is why some disputes move from private HR to legitimate public scrutiny.

How to frame it clearly

This issue is not only about my case.
It shows a risk to others because [explain pattern or duty].
Public funds are involved because [grants, contracts, or donations].
There may be breaches of [name the duty, for example Equality Act or data protection].
I am raising this so the risk is stopped for everyone, not just me.

Choose your route

Internal route. Use the Speak Up or whistleblowing policy if you believe it is safe. You create a record and give them a chance to fix it.
Regulator route. If the risk is high, evidence may be destroyed, or internal routes failed, go to the relevant regulator directly. See links below.
Watchdog or press route. You can disclose to a public interest platform. Use encrypted contact and keep your evidence organised. Consider disclosing to a prescribed person in parallel.

Reality check and risk

Retaliation is unlawful. It still happens. Pick a route you can live with. If you are mid recruitment, think about timing. If a company bins you for raising a legitimate concern, treat that as a filter. You did not lose a fit, you dodged one.

Evidence that survives scrutiny

Timeline. Dates, times, locations, who knew what. Keep it to one page with links to exhibits.
Documents. Emails, logs, letters, screenshots. Keep originals, work on copies.
Relevance. Include what proves the point. Leave out private data that is not needed.
Chain of custody. Note how you obtained files. If you cannot export safely, describe where they are stored.
Redaction. Remove third party identifiers if they are not essential to the point.

Secure contact and PGP quick start

If you want an encrypted route, you can contact us here:

TRSA encrypted whistleblower page for secure contact and file drop.

Organisations can add a secure intake in minutes using our open source drop in PGP widget. See the same page for setup notes and usage.

PGP in brief

Use an email client with OpenPGP. Thunderbird supports this natively.
Create a key pair, store your revocation certificate offline, use a strong passphrase.
Import the recipient’s public key and verify the fingerprint out of band.
Encrypt and sign the message. Send a small test first. Then send the evidence.

Template, concise disclosure email

Subject: Protected disclosure in the public interest regarding [issue] at [organisation]

Hello,

I am making a protected disclosure in the public interest regarding [issue].

What happened: [one paragraph, factual]
When: [dates and times]
Who is affected: [staff, patients, customers, service users, public]
Evidence held: [list of documents or where they are stored]
Risk if ignored: [safety, legality, public funds, data rights, safeguarding]
Steps taken so far: [internal route tried or reason it was unsafe]

Please acknowledge receipt and confirm next steps. I am happy to provide evidence securely.

Regards,
[Your name or anonymous handle]

After you send it, timelines and escalation

Acknowledge. Log the date you sent, the mailbox, and any case number.
Follow up. If no reply in a reasonable window, send a short nudge. Keep it factual.
Escalate. If internal stalls, go to the regulator that fits the issue. If a regulator stalls, ask for their complaints route.
Protect yourself. Keep everything in writing. If you need advice, call an independent helpline.

Useful links and regulators

Official guidance and lists

Data protection and privacy

Information Commissioner’s Office, whistleblower report

Finance and prudential

Health and safety

Health and Safety Executive, report an issue

Care, schools, exams

Charities, NHS, tax

Independent advice

Useful internal links

Plain English. Information, not legal advice. If your case is sensitive, get independent advice before you disclose.