Whistleblower Policy (Ireland)

A Whistleblower Policy in Ireland sets out the standards, responsibilities, and procedures the organisation expects everyone to follow, and takes its legal force from the Protected Disclosures Act 2014.

The Protected Disclosures Act 2014 was a landmark piece of legislation that for the first time provided thorough statutory protection to workers who disclosed information about wrongdoing in the public interest. The 2014 Act was influenced by a series of high-profile cases in Ireland in which individuals who had reported wrongdoing suffered serious professional and personal consequences. The Act established a tiered disclosure system: workers may first disclose internally (to their employer), then to a prescribed person (an external regulator), then to a Minister of Government, and in limited circumstances more broadly — for example, to a solicitor or to the media.

The Protected Disclosures (Amendment) Act 2022 made substantial changes. It extended the scope of protected disclosures to cover breaches of specified EU law in areas such as financial services, data protection, public procurement, environmental law, food safety, and public health. It broadened the definition of 'worker' to include contractors, volunteers, board members, shareholders, job applicants, and former workers. It removed the good faith requirement as a threshold for protection and replaced it with a 'reasonable belief' standard. It mandated formal internal reporting channels for employers with 50 or more employees. It increased maximum compensation to five years' remuneration. It introduced interim relief for dismissed workers. And it established the Office of the Protected Disclosures Commissioner as a new independent public office.

The policy must comply with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, since the processing of personal data in connection with disclosures — including the identity of the reporting person and any person who is the subject of a report — is subject to GDPR's full data protection principles. The Data Protection Commission (DPC) has regulatory oversight of GDPR compliance in Ireland.

For employers in the financial services sector, additional whistleblowing obligations arise under Central Bank of Ireland regulations, including the Central Bank (Supervision and Enforcement) Act 2013 and various sectoral codes. These obligations dovetail with, but are not replaced by, the 2022 Act.

A well-drafted Whistleblower Policy is an essential part of any Irish organisation's governance and compliance framework, protecting both the organisation and its workers, and demonstrating a commitment to ethical business conduct and the rule of law.

The Office of the Protected Disclosures Commissioner (OPDC), established by the 2022 Act, plays an important institutional role in the Irish whistleblowing landscape. The Commissioner maintains a secure online portal for workers who cannot or prefer not to use an employer's internal reporting channel, and publishes guidance for both workers and employers on the operation of the regime. The Commissioner also publishes an annual report on protected disclosures received and their outcomes.

The Protected Disclosures Acts 2014 to 2022 sit alongside the Criminal Justice (Corruption Offences) Act 2018. Workers who report corruption offences under the 2018 Act through their employer's protected disclosures channel are entitled to full legal protection under the 2014 Act, and a whistleblower policy should cross-reference the organisation's anti-bribery policy to confirm this is clear to all staff. Solicitors advising Irish organisations on employment law and regulatory compliance consistently identify a well-designed whistleblower policy as one of the most valuable governance investments an organisation can make — enabling early detection and remediation of wrongdoing before it escalates into a regulatory investigation, media controversy, or criminal prosecution, and demonstrating to regulators and investors a genuine commitment to ethical business conduct and the rule of law in Ireland.

An Irish Whistleblower Policy is needed by any organisation that employs workers or engages contractors in Ireland, because the substantive protections against penalisation under the Protected Disclosures Acts 2014–2022 apply to all workers regardless of employer size. However, the formal mandatory obligations to have a documented internal reporting channel apply specifically to private sector employers with 50 or more employees and to all public sector bodies.

You need a Whistleblower Policy if your organisation: employs 50 or more workers and is therefore mandatorily required by section 6A of the Protected Disclosures Act 2014 (as inserted by the 2022 Act) to establish, maintain, and operate a secure internal reporting channel meeting specified requirements; is a regulated financial services entity subject to Central Bank of Ireland oversight, where additional obligations to have a whistleblowing reporting channel arise under sectoral rules, including the Central Bank (Supervision and Enforcement) Act 2013 and the European Union (Capital Requirements) Regulations 2014; is a public sector body of any size, which must operate an internal reporting channel regardless of employee numbers; operates in a sector with heightened regulatory scrutiny — such as healthcare, pharmaceuticals, construction, financial services, or public procurement — where regulators may inquire about the existence and operation of a whistleblower reporting channel as part of a compliance assessment; has experienced a whistleblowing report and wishes to confirm that it handles the report in a manner consistent with the Act and that it protects itself against a penalisation complaint before the Workplace Relations Commission (WRC); or wishes to demonstrate to investors, insurers, and counterparties that it operates to high governance standards.

For organisations with fewer than 50 employees that are not in a regulated sector, the 2022 Act does not currently mandate a formal internal reporting channel, but the protections against penalisation still apply if a worker makes a protected disclosure. In practice, having a simple, clear whistleblower policy — even a short document that identifies who reports should be made to, confirms the confidentiality of reports, and prohibits retaliation — is strongly advisable for all employers. The WRC has been clear in its decisions that the absence of a functioning reporting channel is not a defence to a penalisation claim, and it may be treated as an aggravating factor when assessing compensation.

Solicitors advising Irish companies on employment law compliance, and corporate governance advisers working with company boards, regularly include a whistleblower policy in the list of essential governance documents alongside a code of conduct, an anti-bribery policy, a data protection policy, and an equal opportunities policy.

A thorough Irish Whistleblower Policy should contain several key provisions to confirm compliance with the Protected Disclosures Acts 2014–2022 and to give workers clear, practical guidance on how to make a report and what protections they enjoy.

The purpose and scope clause should explain why the policy exists (to comply with the Protected Disclosures Acts 2014–2022 and to foster an open, ethical culture), and should specify who is covered — not just employees, but also contractors, temporary workers, volunteers, board members, shareholders, and former workers, all of whom may qualify as 'workers' under the 2022 Act.

The definition of protected disclosure clause should explain in accessible, plain-English language what constitutes a protected disclosure under section 5 of the 2014 Act: a disclosure of relevant information made by a worker who reasonably believes it tends to show one or more of the categories of wrongdoing listed in the Act, including criminal offences, regulatory breaches, health and safety dangers, environmental damage, misuse of public funds, and breaches of specified EU law. The policy should confirm that workers need not have direct evidence — a reasonable belief based on available information is sufficient.

The internal reporting channel clause must specify how reports are to be made: to a designated disclosure recipient (typically a compliance officer, a board audit committee, or a specific confidential reporting email address), and should provide for a secure, confidential alternative channel (such as an anonymous hotline or an online portal) for workers who are not comfortable reporting to their line manager. For organisations mandated by the 2022 Act to have a formal channel, the clause must confirm that reports will be acknowledged within seven days, that feedback will be provided within three months, and that all reports will be recorded in a secure register.

The confidentiality clause must confirm that the identity of the reporting person will be kept strictly confidential and will not be disclosed without their consent, except as required by law. The clause should also address the confidentiality of the person who is the subject of the report, pending the outcome of the investigation. Breach of confidentiality is a criminal offence under the 2022 Act.

The anti-retaliation clause must make unequivocally clear that the organisation prohibits any form of penalisation — dismissal, demotion, harassment, discrimination, or any other adverse treatment — of a worker who makes a protected disclosure. The clause should set out the remedies available to workers who are penalised: a complaint to the WRC within six months, which may result in reinstatement, re-engagement, or compensation of up to five years' remuneration; and the right to apply to the Circuit Court for interim relief within 21 days of dismissal.

The investigation process clause should outline the steps the organisation will take to investigate a report: initial assessment by the disclosure recipient, appointment of an independent investigator where appropriate, notification to the subject of the report in accordance with fair procedures requirements, completion of the investigation within a reasonable timeframe, and communication of the outcome to the reporting person.

The data protection clause should confirm how personal data processed in connection with disclosures is handled in compliance with GDPR (Regulation (EU) 2016/679) and the Data Protection Act 2018, including the legal basis for processing under GDPR Article 6(1)(c) (compliance with a legal obligation) or Article 6(1)(f) (legitimate interests), the retention period for investigation records (minimum five years under section 6A of the Protected Disclosures Act 2014 as amended by the 2022 Act), and the rights of data subjects in relation to that data. The Data Protection Commission (DPC) at 21 Fitzwilliam Square South, Dublin 2, D02 RD28 is the Irish supervisory authority and enforces GDPR compliance, with powers to impose fines of up to €20 million or 4% of global annual turnover under GDPR Article 83.

The register and reporting obligations clause should confirm that employers mandated by the Protected Disclosures (Amendment) Act 2022 to have an internal reporting channel must register the channel with the Office of the Protected Disclosures Commissioner (OPDC) and comply with annual reporting requirements. The Commissioner publishes an annual report on the operation of the protected disclosures regime. The Workplace Relations Commission (WRC) at Tom Johnson House, Haddington Road, Dublin 4 adjudicates penalisation complaints under section 11 of the 2014 Act, with appeals to the Labour Court under section 14. The Circuit Court of Ireland has jurisdiction to grant interim relief within 21 days of dismissal under section 11A of the 2014 Act. The Central Bank of Ireland imposes additional whistleblowing channel requirements on regulated financial services entities under the Central Bank (Supervision and Enforcement) Act 2013, the European Union (Capital Requirements) Regulations 2014, and the Market Abuse Regulation (Regulation (EU) 596/2014). The Criminal Justice (Corruption Offences) Act 2018, enforced by An Garda Síochána and the Director of Public Prosecutions, provides additional protections for workers who report corruption offences. The forms-legal.com Whistleblower Policy (Ireland) template covers the mandatory elements under the Protected Disclosures Acts 2014–2022.