Is a charity legally required to have a whistleblowing policy?

England and Wales: This page sets out the position in full. Scotland: the same answer, because the same statute applies and it imposes no policy duty anywhere in Great Britain — but whether OSCR is a prescribed person a whistleblower can go to was not verified, so do not assume it. Northern Ireland: the same answer again, under Northern Ireland’s own parallel Order — but whether the Commission there is a prescribed person under that Order was not confirmed, and is not assumed here.

Does the law require a whistleblowing policy?

No. The Public Interest Disclosure Act 1998 protects the worker who raises a concern. It imposes no duty to hold a whistleblowing policy.

Whistleblowing is when a worker reports wrongdoing at their organisation, inside it or to an outside body. This page is for trustees in England and Wales. There, the Charity Commission is a prescribed person. The page also has notes for Scotland and Northern Ireland.

Like the other policy pages in this hub, it assumes you have already mapped your governing document. The policy matters most once the charity employs people. If you are still deciding whether it can, see cost the post properly before you decide you can afford it.

Whistleblowing law is described everywhere as “the whistleblowing rules”. People fairly assume that rules with that name must tell organisations what to have. They do not.

The Public Interest Disclosure Act 1998 works by inserting protections into employment law. It gives a worker who makes a protected disclosure a right not to be dismissed or subjected to detriment for making it. Every operative provision points at how the worker is treated afterwards. None of them points at the employer’s filing cabinet.

The charity regulator’s framing follows the same shape. Its guidance on reporting serious wrongdoing refers to whistleblowing policies for staff if you have them. That wording is conditional on its face. That is not a regulator quietly requiring something. It is a regulator telling you what to do with a document you may or may not hold.

In this guide’s must and should terms, the policy is a should at most. Even that is qualified.

Do funders require a whistleblowing policy?

Some may. This guide read one funder’s terms: the National Lottery Community Fund’s. It requires a policy in its terms for larger grants. That is the strictest policy requirement in this guide.

This is the finding, and it is worth stating as one. This guide covers the whole policy set: safeguarding, financial controls, reserves, data protection, complaints, conflicts, risk, investment, health and safety, equality and the rest. Across all of it, the strictest single requirement found anywhere is a whistleblowing clause in one funder’s grant terms.

Not a statute. Not a regulator. A funder.

That funder is the National Lottery Community Fund. The condition sits in its terms for larger grants. That document is titled, verbatim, “Standard terms and conditions for funding over £20,000”. This guide’s record of the clause reads, verbatim: “a written policy, publicised internally, staff trained on it, reviewed at least every two years”.

The clause has four limbs. Three of them are about what happens after adoption. Set that against a legal duty of zero. It is the clearest example in this guide of why “required” is a question you have to ask of whom.

Then the caveat, which matters as much as the finding. This rests on one funder’s published terms, read directly.

No single list sets out the policy conditions funders attach to grants. Funders are independent contracting parties, and each sets its own. So do not read a review cycle off this page and apply it to your own grant. Your funder’s own published terms are the authority for your funder, and nothing else is.

The Charity Commission as a prescribed person

The Charity Commission is a prescribed person: a worker can take a concern to it and keep their legal protection.

A worker may raise a concern with their employer and get nowhere. The worker can then take it outside, and the statutory protection follows them to certain named recipients. Those recipients are prescribed persons, listed by order. The Charity Commission for England and Wales is one of them.

That is useful to know, and it is often misdescribed.

It does not mean the Commission requires you to have a policy. It does not mean you must tell staff about the Commission, though a good policy does.

Being a prescribed person means a worker who takes a concern to the Commission keeps their protection. That is why an honest whistleblowing policy names the external route. It does not imply the board is the end of the line.

The position outside England and Wales is less settled. This page will not fill the gap.

Northern Ireland has its own parallel Order with the same structure, so the same no-policy-duty answer holds there. Whether the Commission there, or OSCR in Scotland, is a prescribed person under the relevant instrument was not confirmed. If the external route matters to your charity, check the current prescribed persons list for your nation. Do not rely on this guide for it.

Are volunteers protected as whistleblowers?

No. The statutory protection needs worker status, and a volunteer does not have it. The single most damaging mistake here is a warm, inclusive policy that tells volunteers they are protected. They are not. The statutory protection requires worker status, and a volunteer who blows the whistle does not get it.

Who counts as a worker is on decide the status: employee, worker or self-employed.

That does not make a policy pointless for a volunteer-run charity. An internal route for raising concerns is worth having on its own merits. It is the right thing to offer people who give you their time.

But one sentence in the policy matters. Say what the policy offers as a matter of the charity’s own practice. Do not describe it as legal protection.

A second-order trap sits here, and it belongs to another hub. Writing volunteer arrangements in language that looks contractual can itself push a volunteer towards worker status, with employment rights attached. The factors that do it are:

• payments beyond genuine expenses
• a rota with a real sanction behind it
• a binding disciplinary procedure
• promises of future paid work

They are set out in write a volunteer agreement that does not create a contract and are not re-argued here. If your whistleblowing policy is about to acquire a disciplinary limb that applies to volunteers, read that material first.

Does the annual return ask about whistleblowing?

No. Whistleblowing is not one of the annual return’s named policies. The Commission’s annual return asks whether each of 13 named policies and procedures was in place at the end of the period. Its guidance also names 6 it says it expects most charities to have. Whistleblowing is on neither list.

Put the three findings side by side and the pattern is clear. No statute requires it. The charity regulator does not ask about it or expect it. And one funder demands more of it than anyone else demands of anything.

The classification this guide gives the row is funder-condition-only. If you hold a grant, that is the document to check. If you do not, the decision is yours to make on the merits.

Common mistake: believing the whistleblowing statute requires a whistleblowing policy

The Act is described everywhere as “whistleblowing law”. So people assume a policy duty is inside it. It is not. The Act protects workers from detriment and imposes no policy duty on the organisation at all. The Commission’s own wording is conditional — whistleblowing policies for staff if you have them.

Common mistake: telling volunteers the policy protects them

Charities think about staff and volunteers together, so the policy addresses both. The statutory protection requires worker status. A volunteer who blows the whistle does not get it. A policy implying otherwise misleads at the exact moment someone is relying on it.

Worked example

Saltmarsh Trust holds a grant large enough to fall under its funder’s standard terms. Its whistleblowing policy runs to a single page, was adopted several boards ago, and has never been mentioned to staff.

Nothing in law required Saltmarsh to write that policy. But having taken the grant, Saltmarsh is bound by the terms attached to it. Those terms go further than the document alone:

• the policy has to be publicised internally
• staff have to be trained on it
• it has to be reviewed on the cycle the funder sets

Saltmarsh fails on all three.

None of that is a legal breach. It is a breach of grant conditions. That is a different thing, with its own consequences. The breach is also invisible to anyone reading the policy itself.

The fix is not a better document. It is an internal briefing, a note of who attended, and a review date in the board calendar.

With whistleblowing decided, the last policy in this set is the volunteer policy.