Whistleblower Policy (New Zealand)
WHISTLEBLOWER POLICY
Protected Disclosures (Protection of Whistleblowers) Act 2022
[Organisation Name] | NZBN [Organisation NZBN]
[Organisation Address]
Effective Date: [Effective Date]
1. PURPOSE AND SCOPE
This Whistleblower Policy ("Policy") is established by [Organisation Name] (NZBN [Organisation NZBN]) ("the Organisation") to comply with the Protected Disclosures (Protection of Whistleblowers) Act 2022 ("the Act") and to encourage the reporting of serious wrongdoing within or by the Organisation.
The Organisation is committed to operating with integrity and in compliance with all applicable New Zealand laws. This Policy creates a safe and trusted environment for workers to raise concerns about serious wrongdoing without fear of retaliation, consistent with the protections provided by the Act.
This Policy applies to all workers of the Organisation including employees, contractors, temporary and agency workers, directors, officers, and volunteers.
2. WHAT IS A PROTECTED DISCLOSURE?
Under the Protected Disclosures (Protection of Whistleblowers) Act 2022, a protected disclosure is a disclosure of information about serious wrongdoing in or by an organisation made by a worker to an appropriate authority in accordance with the Act.
"Serious wrongdoing" is defined in section 10 of the Act and includes:
- Unlawful, corrupt, or irregular use of public funds or public resources.
- Conduct that constitutes a serious risk to public health, public safety, or the environment.
- Conduct that constitutes a serious risk to the maintenance of law, including the prevention, investigation, and detection of offences.
- Conduct that is an offence.
- Conduct that is oppressive, improperly discriminatory, or grossly negligent, or that constitutes gross mismanagement.
For a disclosure to be protected under the Act, the discloser must believe on reasonable grounds that the information is true or likely to be true, the disclosure must be made to an appropriate authority, and the purpose of the disclosure must be to have the serious wrongdoing investigated.
This Policy also encourages workers to report other concerns about potential breaches of law, the Organisation's Code of Conduct, or internal policies, even where the conduct may not constitute serious wrongdoing under the Act. Such reports will be considered under this Policy and referred to appropriate internal processes.
3. HOW TO MAKE A DISCLOSURE
3.1 Internal Disclosure — Workers may make a protected disclosure to the Organisation's designated internal disclosure contact:
Name: [Internal Contact Name] Role: [Internal Contact Role] Email: [Internal Contact Email] Phone: [Internal Contact Phone]
3.2 Alternate Contact — If the disclosure relates to the conduct of the internal contact named above, or if the discloser has a reasonable concern about making the disclosure to that person, the disclosure may instead be made to: [Alternate Contact]
3.3 External Disclosure — Workers have the right under the Act to make a protected disclosure directly to an appropriate authority external to the Organisation. External disclosures may be made to the relevant authority without first making an internal disclosure, provided the worker has reasonable grounds for believing the serious wrongdoing has occurred. See section 7 of this Policy for details of relevant external authorities.
3.4 What to include — When making a disclosure, workers should provide as much relevant information as possible, including: a description of the conduct of concern; the names and roles of any persons involved (if known); dates and locations of the conduct; any supporting evidence or documents; and the discloser's contact details (unless making an anonymous disclosure).
4. CONFIDENTIALITY
The Organisation recognises that confidentiality is critical to maintaining trust in this Policy and to encouraging disclosures. [Confidentiality Measures]
Section 18 of the Protected Disclosures (Protection of Whistleblowers) Act 2022 imposes obligations on appropriate authorities that receive protected disclosures to take all reasonable steps to protect the identity of the discloser from being disclosed without the discloser's consent. The Organisation adopts the same standard for all internal disclosures received under this Policy.
Notwithstanding the above, there may be circumstances in which the identity of the discloser must be disclosed — for example, if required by court order, or if it is necessary to disclose to comply with a statutory obligation. The Organisation will notify the discloser before making any such disclosure, unless it is not practicable to do so.
5. INVESTIGATION PROCESS
[Investigation Process]
Target timeframe for investigation completion: [Investigation Timeframe].
The Organisation will conduct all investigations fairly, impartially, and consistently with the principles of natural justice. Any person whose conduct is the subject of a disclosure will be given an appropriate opportunity to respond to the allegations, consistent with the requirements of natural justice and the good faith obligations under the Employment Relations Act 2000.
The outcome of an investigation will not necessarily be communicated in full to the discloser, particularly where doing so would breach the privacy rights of any person involved or compromise confidentiality. However, the Organisation will inform the discloser whether the matter was investigated and, where possible, the general outcome.
6. PROTECTION AGAINST RETALIATION
The Organisation strictly prohibits retaliation against any worker who makes a protected disclosure in good faith under this Policy or the Protected Disclosures (Protection of Whistleblowers) Act 2022, or who participates in an investigation under this Policy.
Under section 19 of the Act, it is unlawful for any person to take detrimental action against a worker in retaliation for making a protected disclosure. Prohibited retaliatory conduct includes: [Retaliation Examples].
If a discloser believes they have suffered or are at risk of suffering retaliation as a result of making a disclosure, they should: [Retaliation Reporting Process].
A worker who suffers retaliation for making a protected disclosure may raise a personal grievance under the Employment Relations Act 2000, bring civil proceedings under section 19 of the Act, or make a complaint to the Ombudsman or relevant authority.
Any employee or manager who retaliates against a discloser will be subject to disciplinary action, up to and including termination of employment. The Organisation may also be liable to pay compensation to the discloser.
7. EXTERNAL APPROPRIATE AUTHORITIES
Workers have the right to make protected disclosures to external appropriate authorities under the Act. Workers do not need to first make an internal disclosure before approaching an external authority, provided they have reasonable grounds for believing the serious wrongdoing has occurred.
Relevant external appropriate authorities for the Organisation include: [Relevant Authorities].
The Office of the Ombudsman is designated under the Act as a general appropriate authority that can receive protected disclosures about serious wrongdoing by any organisation, including private sector organisations. Workers who are uncertain which external authority to contact may contact the Office of the Ombudsman at www.ombudsman.parliament.nz.
Workers may also seek independent legal advice before making a disclosure. The New Zealand Law Society can assist in finding a lawyer: www.lawsociety.org.nz.
8. FALSE OR MALICIOUS DISCLOSURES
The protections of the Protected Disclosures (Protection of Whistleblowers) Act 2022 apply only to disclosures made in good faith. A discloser who makes a disclosure knowing it to be false, or who makes a disclosure motivated primarily by malice or personal grievance rather than concern about serious wrongdoing, will not benefit from the protections of the Act or this Policy.
Workers who make false or malicious disclosures may be subject to disciplinary action by the Organisation, and may be liable in civil proceedings for defamation or other causes of action.
The Organisation will not treat a disclosure as false merely because an investigation does not substantiate the concern. The Organisation recognises that workers may make disclosures in good faith based on incomplete or imperfect information.
9. GOVERNING LAW AND REVIEW
This Policy is governed by the laws of New Zealand, including the Protected Disclosures (Protection of Whistleblowers) Act 2022, the Employment Relations Act 2000, and the Privacy Act 2020.
This Policy will be reviewed at least annually and updated as necessary to remain consistent with applicable New Zealand law and best practice. All workers will be notified of material changes to this Policy.
For questions about this Policy, please contact [Internal Contact Name] at [Internal Contact Email].
Chief Executive / Authorised Representative
________________
Signature
What Is a Whistleblower Policy (New Zealand)?
A Whistleblower Policy in New Zealand sets the organisation's rules and expectations on whistleblowing and the responsibilities of staff and users, supporting compliance with the Companies Act 1993.
The Protected Disclosures (Protection of Whistleblowers) Act 2022 (PDA 2022) replaced the earlier Protected Disclosures Act 2000 and came into force on 1 July 2022. The 2022 Act represented a significant strengthening of whistleblower protections in New Zealand, expanding the categories of serious wrongdoing that can be disclosed, broadening the definition of workers protected, adding the Ombudsman as a general appropriate authority for all organisations, and strengthening anti-retaliation protections.
Under the Act, a protected disclosure is a disclosure of information about serious wrongdoing in or by an organisation made by a worker to an appropriate authority. Serious wrongdoing is defined in section 10 of the Act and encompasses unlawful, corrupt, or irregular use of public funds or resources; conduct posing a serious risk to public health, safety, or the environment; conduct constituting an offence; and oppressive, improperly discriminatory, or grossly negligent conduct constituting gross mismanagement.
For a disclosure to attract the Act's protections, the discloser must believe on reasonable grounds that the information disclosed is true or likely to be true, the disclosure must be made to an appropriate authority (internal or external), and the purpose must be to have the serious wrongdoing investigated. The discloser must also be a worker — a term broadly defined to include employees, contractors, sub-contractors, homeworkers, and volunteers.
A Whistleblower Policy translates these statutory requirements into clear internal procedures. It identifies who workers should report to, how reports will be handled and investigated, how the discloser's identity will be protected, and what happens if a worker suffers retaliation. It also educates workers about their rights under the Act and the external appropriate authorities available to them.
For New Zealand organisations, a Whistleblower Policy is an essential component of good corporate governance and compliance infrastructure, sitting alongside a Code of Conduct, Anti-Bribery Policy, and Data Protection Policy.
When Do You Need a Whistleblower Policy (New Zealand)?
A Whistleblower Policy is needed by all New Zealand organisations, but it is particularly important in certain contexts.
All employers — the Protected Disclosures (Protection of Whistleblowers) Act 2022 applies to all organisations, both private sector and public sector. While the Act does not expressly require every organisation to have a written whistleblower policy, the established standards expectation — and the expectation of regulators and corporate governance bodies — is that all organisations of any scale maintain a written policy. Without a written policy, workers may not know how or to whom to report concerns, and the organisation has no documented framework for investigating and responding to disclosures.
Regulated industries — organisations operating in financial services, healthcare, aged care, education, construction, or other regulated industries are subject to heightened regulatory expectations. Regulatory bodies such as the Financial Markets Authority, the Reserve Bank of New Zealand, and WorkSafe New Zealand all have whistleblower disclosure functions and expect regulated entities to maintain strong internal reporting mechanisms.
Government contracts — New Zealand government agencies frequently require suppliers and contractors to maintain a whistleblower policy as a condition of contracting. A documented policy demonstrates compliance with this requirement.
Listed companies — New Zealand companies listed on the NZX are subject to NZX Corporate Governance Code provisions regarding risk management and whistleblowing. The NZX Corporate Governance Code recommends that listed issuers have a written whistleblower policy that encourages workers to raise concerns about unethical conduct.
After a wrongdoing incident — if an organisation has experienced fraud, corruption, financial misconduct, or any other serious wrongdoing, implementing or updating a whistleblower policy is a critical step in preventing recurrence and demonstrating to parties that the organisation takes governance seriously.
When scaling — as organisations grow, the risk of wrongdoing increases simply because there are more people and processes involved. A whistleblower policy confirms that concerns can be escalated appropriately regardless of who is involved.
What to Include in Your Whistleblower Policy (New Zealand)
A well-drafted New Zealand Whistleblower Policy should include the following key elements to comply with the Protected Disclosures (Protection of Whistleblowers) Act 2022 and to be effective in practice.
Scope and definitions — clearly identify who the Policy applies to (all workers, including employees, contractors, and volunteers) and define the key terms used, including "protected disclosure", "serious wrongdoing", and "appropriate authority", consistent with the definitions in sections 5 and 10 of the Act.
What can be reported — explain what types of conduct constitute serious wrongdoing under the Act and can be the subject of a protected disclosure. Also encourage reporting of other concerns about breaches of internal policies or law, even if they do not rise to the level of serious wrongdoing under the Act.
Internal disclosure channels — designate a specific internal contact (name, role, and contact details) for receiving internal disclosures. Also designate an alternate contact for situations where the primary contact is implicated in the alleged wrongdoing.
Anonymous reporting — specify whether anonymous disclosures are accepted and, if so, through which channels. Explain the limitations that may apply to anonymous disclosures.
Confidentiality — commit to protecting the identity of disclosers and the information disclosed, consistent with section 18 of the Act and the Privacy Act 2020. Specify the limited circumstances in which confidentiality may need to be breached.
Investigation process — describe how disclosures will be assessed and investigated, including the timeframe for acknowledgement, assessment, and completion. Commit to natural justice principles.
Anti-retaliation protections — clearly prohibit retaliation against disclosers, list examples of prohibited conduct, and explain the remedies available to a discloser who suffers retaliation under section 19 of the Act.
External appropriate authorities — list the external authorities relevant to the organisation's industry to which workers may make protected disclosures, including the Ombudsman as the general appropriate authority.
False disclosures — clarify that the Act's protections do not apply to false or malicious disclosures, while making clear that a good faith disclosure that is not substantiated will not be treated as false.
Governing law — state that the Policy is governed by New Zealand law, including the Protected Disclosures (Protection of Whistleblowers) Act 2022, the Employment Relations Act 2000, and the Privacy Act 2020. Commit to annual review. The forms-legal.com Whistleblower Policy (New Zealand) provides a ready-to-use template that meets New Zealand legal requirements.
Cite this page
Reference this free template in an article, syllabus, or research note:
Forms Legal. (2026). Whistleblower Policy (New Zealand) (New Zealand) [Legal document template]. Forms Legal. https://forms-legal.com/new-zealand/business/corporate/whistleblower-policy-new-zealand
"Whistleblower Policy (New Zealand) (New Zealand)." Forms Legal, 2026, https://forms-legal.com/new-zealand/business/corporate/whistleblower-policy-new-zealand.
@misc{formslegal-whistleblower-policy-new-zealand,
author = {{Forms Legal}},
title = {Whistleblower Policy (New Zealand) (New Zealand)},
year = {2026},
howpublished = {\url{https://forms-legal.com/new-zealand/business/corporate/whistleblower-policy-new-zealand}},
note = {Free legal document template. Based on Companies Act 1993}
}Also available for these jurisdictions:
Frequently Asked Questions
The Protected Disclosures (Protection of Whistleblowers) Act 2022 (PDA 2022) replaced the Protected Disclosures Act 2000 and came into force on 1 July 2022. It significantly expanded whistleblower protections in New Zealand. The Act protects workers — broadly defined to include employees, contractors, and volunteers — who make protected disclosures about serious wrongdoing in or by an organisation. Serious wrongdoing is defined in section 10 and includes unlawful, corrupt, or irregular use of public funds; conduct constituting a serious risk to public health, safety, or the environment; conduct that constitutes an offence; and oppressive, improperly discriminatory, or grossly negligent conduct. The Act requires organisations to require that workers are aware of their rights and the available reporting channels. Under section 19, it is unlawful to take detrimental action against a worker in retaliation for making a protected disclosure. The Act designates both internal and external appropriate authorities, including the Ombudsman as a general receiving authority for all organisations. All New Zealand employers — private sector and public sector — are affected by the Act and should maintain a whistleblower policy that reflects its requirements.
The Protected Disclosures (Protection of Whistleblowers) Act 2022 does not expressly require organisations to accept anonymous disclosures. However, the Act's protections for workers who make protected disclosures apply only to identified disclosers — a worker whose identity is not known cannot benefit from the anti-retaliation protections because the employer cannot know who to protect. Whether to accept anonymous disclosures is therefore a policy choice for each organisation. Many organisations choose to accept anonymous disclosures to maximise reporting rates, recognising that some workers may fear retaliation despite formal protections. Anonymous disclosures can be helped through third-party ethics hotlines, secure online portals, or drop-boxes. The limitation of anonymous disclosures is that they may be more difficult to investigate because the investigator cannot seek clarification from the discloser or assess their credibility. A whistleblower policy should be transparent about whether anonymous disclosures are accepted and the limitations that may apply.
Section 19 of the Protected Disclosures (Protection of Whistleblowers) Act 2022 makes it unlawful for any person to take detrimental action against a worker in retaliation for making a protected disclosure. Detrimental action is broadly defined and includes dismissal, demotion, reduction in pay or hours, denial of promotion, change in job duties or location, harassment or intimidation, threats of any of the above, and any other action that adversely affects the worker's employment, terms of engagement, or working conditions. A worker who suffers retaliation for making a protected disclosure has several remedies available: they may raise a personal grievance under the Employment Relations Act 2000 (within 90 days of the employer's action); bring civil proceedings against the person who took the retaliatory action under section 19 of the Act; make a complaint to the Ombudsman; or report the matter to the relevant external authority. A worker who suffers retaliation may be entitled to remedies including reinstatement, reimbursement of lost wages, and compensation for hurt and humiliation. An employer who retaliates against a whistleblower also faces reputational and regulatory risk.
The Protected Disclosures (Protection of Whistleblowers) Act 2022 designates a range of external appropriate authorities that workers can make protected disclosures to, without first making an internal disclosure. The Office of the Ombudsman is designated as a general appropriate authority for all organisations — the Ombudsman can receive protected disclosures about serious wrongdoing by any organisation, private or public sector. Other designated appropriate authorities include: the New Zealand Police (for criminal offences); the Serious Fraud Office (for serious or complex fraud); the Financial Markets Authority (for financial markets misconduct); WorkSafe New Zealand (for serious health and safety breaches); the Commerce Commission (for competition and fair trading breaches); the Reserve Bank of New Zealand (for registered bank misconduct); and the Privacy Commissioner (for serious privacy breaches). Workers can make a protected disclosure to an appropriate authority without first exhausting internal reporting channels if they have reasonable grounds to believe the serious wrongdoing has occurred. A whistleblower policy should list the external authorities most relevant to the organisation's industry and activities.
When a whistleblower disclosure is received, the organisation must investigate it fairly and impartially. Key principles that apply to the investigation process in New Zealand include: confidentiality — the identity of the discloser should be protected throughout the investigation, consistent with section 18 of the Protected Disclosures (Protection of Whistleblowers) Act 2022 and the Privacy Act 2020; natural justice — any person whose conduct is under investigation must be informed of the allegations against them (at an appropriate stage) and given a reasonable opportunity to respond, consistent with the principles of natural justice under New Zealand administrative law; independence — where practicable, the investigation should be conducted by someone who is independent of both the discloser and the persons implicated; proportionality — the depth and formality of the investigation should be proportionate to the seriousness of the alleged wrongdoing; and good faith — the investigation must be conducted genuinely and not as a sham process. Under the Employment Relations Act 2000, if the investigation leads to disciplinary action against an employee, the employer must follow a fair ERA-compliant disciplinary process. The organisation should document the investigation process and outcome to demonstrate that concerns were taken seriously and addressed appropriately.
This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer
Found an error? Let us knowRelated Documents
You may also find these documents useful:
Code of Conduct (New Zealand)
Create a comprehensive New Zealand Code of Conduct for your organisation, compliant with the Employment Relations Act 2000, Human Rights Act 1993, Health and Safety at Work Act 2015, Privacy Act 2020, and Companies Act 1993. Covers professional behaviour standards, anti-discrimination and harassment obligations, conflicts of interest disclosure, confidentiality and privacy, anti-bribery requirements under the Secret Commissions Act 1910, technology use, health and safety duties, whistleblower protections under the Protected Disclosures (Protection of Whistleblowers) Act 2022, and a fair ERA-compliant disciplinary process. Suitable for New Zealand companies, non-profits, and government entities.
Anti-Bribery Policy (New Zealand)
Create a comprehensive New Zealand Anti-Bribery and Anti-Corruption Policy compliant with the Secret Commissions Act 1910, the Crimes Act 1961 (sections 99–105C including bribery of foreign public officials under the OECD Anti-Bribery Convention), and the Financial Markets Conduct Act 2013. Covers gifts and hospitality thresholds, facilitation payments, political and charitable contributions under the Electoral Act 1993, third-party due diligence, record keeping under the Tax Administration Act 1994, reporting channels, anti-retaliation protections, and consequences of breach. Suitable for New Zealand companies, export businesses, and regulated entities.
Data Protection Policy (New Zealand)
Create a comprehensive New Zealand Data Protection Policy compliant with the Privacy Act 2020, including mandatory privacy breach notification requirements under sections 113–116. Designates a Privacy Officer as required by section 211, covers all 13 Information Privacy Principles (IPPs), overseas disclosure under IPP 12, individual rights of access and correction, health information under the Health Information Privacy Code 2020, data retention under the Tax Administration Act 1994, and security safeguards under IPP 5. Suitable for New Zealand companies, non-profit organisations, and public sector agencies.