Who Investigates Whistleblower Complaints? A Legal Guide for Employers and Businesses

Workplace whistleblowing can be a daunting topic-both for businesses and for the individuals raising concerns. If someone reports possible wrongdoing within your company, handling the situation ethically and legally is critical. But one question is at the heart of this process: who investigates whistleblower complaints in the UK, and what steps are businesses expected to take?

In this guide, we’ll walk you through the key processes, explain your legal obligations, and give practical advice on how to handle whistleblower complaints professionally-so you can build trust, stay compliant, and protect your reputation. Let’s break down exactly what you need to know.

What Is a Whistleblower Complaint?

Before we get to the details of who investigates whistleblower complaints, let’s clarify what a whistleblower complaint actually is. In simple terms, a whistleblower complaint is when an employee, contractor, or sometimes even an external party raises concerns about wrongdoing in the workplace. This could cover a wide variety of issues, including:

• Fraud or financial mismanagement
• Health and safety breaches
• Discrimination or harassment
• Breach of legal duties or regulations
• Environmental violations
• Any criminal offence by the business or its staff

In the UK, whistleblower complaints are protected under the Public Interest Disclosure Act 1998 (PIDA). This Act encourages employees to raise concerns about serious wrongdoing without fear of reprisal.

If you operate a UK business with employees, dealing with such complaints appropriately is not only best practice-it’s a legal duty.

Who Investigates Whistleblower Complaints in the UK?

Understanding who investigates whistleblower complaints depends on the nature of the concern, your business size, and the seriousness of the allegation. Generally, investigation routes fall into three main categories:

1. Internal Investigation by the Business

Most whistleblower complaints start with an internal investigation. For many SMEs, this means handling the concern via senior management, HR, or a dedicated compliance officer. Your conflict of interest policy should specify who is responsible for receiving and investigating such reports.

• In smaller businesses, it’s often a director or owner.
• In larger companies, you may have a whistleblowing officer, compliance team, or specialist HR lead.

Regardless of role, the person(s) investigating must be impartial and properly trained in whistleblowing procedures.

2. Escalation to an External Body

Sometimes, the complaint relates to a regulated activity or the whistleblower doesn’t trust the internal process. In these cases, it might be appropriate-or even mandatory-for the complaint to be handled by an external authority, including:

• The Health and Safety Executive (HSE) - for health and safety breaches
• The Financial Conduct Authority (FCA) - for financial services wrongdoing
• The Information Commissioner’s Office (ICO) - for data protection and GDPR concerns
• Other regulators-for example, the Environment Agency for environmental matters

If the concern is criminal (like fraud), it may also be appropriate to involve the police.

3. Appointing an Independent Third Party

Occasionally, if the complaint involves senior leadership, or if your business lacks in-house expertise, you may bring in an external, independent investigator (often a lawyer or specialist HR consultant) to ensure fairness and impartiality. This adds credibility and neutrality to the process-reducing the risk of perceived bias.

No matter who investigates the whistleblower complaint, your legal obligation is to ensure a prompt, fair, and thorough investigation, and to take the process seriously at every stage.

How Long Do You Have To File a Whistleblower Complaint?

For employees raising whistleblowing complaints, there’s technically no fixed deadline within the company process. However, if the whistleblower believes they have suffered “detriment” (such as dismissal or other negative treatment) because of their complaint, legal time limits apply if they wish to take the matter to an Employment Tribunal.

• The standard time limit to bring a whistleblowing claim for unfair dismissal is 3 months (less one day) from the date of the detriment or dismissal.

As a business owner, you should encourage prompt reporting and always respond to whistleblower complaints quickly-not only to comply with best practices, but to rectify any problems before they escalate to external legal action.

How To Investigate a Whistleblower Complaint Properly

Let’s dive into what makes a whistleblower investigation lawful and effective in the UK. Mishandling a complaint isn’t just bad for morale-it can open you up to legal liability. Here’s a step-by-step guide:

1. Acknowledge Receipt and Ensure Confidentiality

• Promptly acknowledge that the complaint has been received-this reassures the whistleblower that you take their concern seriously.
• Emphasise that their identity (and the investigation) will be handled confidentially, as far as possible.
• Remind all parties that victimisation or retaliation is unlawful under the Public Interest Disclosure Act.

For more, see our guidance on protected disclosures and whistleblower safeguards.

2. Assess the Complaint

• Decide if the issue raised falls within the scope of your whistleblowing policy, or should be addressed under another process (such as a grievance or disciplinary procedure).
• Determine if urgent action is needed to prevent ongoing harm-especially in health and safety scenarios.

3. Appoint an Appropriate Investigator

• Select an impartial person-ideally someone not directly involved with the alleged wrongdoing.
• If in doubt, consider an external investigator for transparency.

4. Gather and Assess Evidence

• Interview relevant witnesses and collect documentation.
• Maintain meticulous records-good note-taking here can protect your business if external scrutiny follows.

5. Communicate Progress

• Keep the whistleblower informed, within the limits of confidentiality and legal restrictions.
• A clear explanation-even if brief-shows you’re taking their complaint seriously.

6. Make Findings and Decide on Action

• Conclude whether the complaint is upheld and what action to take (disciplinary measures, changes to procedures, external reporting, etc.).
• Communicate the outcome, as appropriate, to both the whistleblower and those affected.

For more detailed tips on conducting an internal workplace investigation, see our practical article: Workplace Investigations: Employee Rights & Fair Disciplinary Procedures in the UK.

How Should You Handle Whistleblower Complaints in Your Business?

Having a robust, clear whistleblowing policy is a must for any UK business. Your policy should cover:

• How employees (and others) can raise concerns
• Who is responsible for receiving and investigating whistleblower complaints
• How confidentiality and protection from retaliation will be managed
• Timeframes for responding to and investigating complaints
• A step-by-step outline of your investigation process
• Scenarios where concerns must be referred to external authorities

It’s wise to train managers on how to handle whistleblower complaints sensitively and lawfully. You should also make clear reference to your whistleblowing policy in your staff handbook or conduct policies.

Proper handling not only builds staff trust, but also minimises the risk of costly Employment Tribunal claims or reputational damage.

What Laws Must Businesses Follow When Dealing With Whistleblower Complaints?

Several pieces of legislation shape your duties during the whistleblowing process:

• Public Interest Disclosure Act 1998 (PIDA): Gives employees legal protection when they raise concerns about wrongdoing in the public interest, and makes it unlawful for you to dismiss or victimise them for doing so.
• Employment Rights Act 1996: Allows staff to bring claims for unfair dismissal or detriment due to whistleblowing.
• GDPR and Data Protection Act 2018: Require you to handle whistleblowers’ personal data (and investigation records) securely-see our full primer on business data protection duties.
• Other sector-specific rules and regulators may apply, such as the Health and Safety at Work Act, FCA rules for financial firms, or ICO rules on privacy.

Failing to comply with these laws can trigger costly fines, tribunal claims, and substantial reputational damage.

What If a Whistleblower Complaint Goes to an External Regulator?

In some instances-perhaps where the whistleblower doesn't feel confident in the internal process, or where a legal duty exists to report (such as serious health and safety risks)-the complaint may be escalated to an independent regulator.

• If so, cooperate fully with their requests for information or evidence.
• Consider early legal advice to protect your business’s position and manage risk.
• Remember, many regulators can impose penalties if you fail to cooperate or if they decide the internal handling was inadequate.

For more on regulator investigations, see our guidance: Handling ICO Complaints: A Step-by-Step Business Guide.

Should You Get Expert Legal Help With Whistleblower Investigations?

Whistleblower complaints often raise complex issues-balancing confidentiality, fair process, employment rights, and the risk of legal proceedings. Even a well-meaning employer can trip up, especially when emotions run high or senior figures are implicated.

A legal expert can help you:

• Review and strengthen your whistleblowing policy and procedures
• Step in as an independent investigator (to ensure impartiality)
• Guide you through risk, compliance, and fair process
• Mitigate the chances of an Employment Tribunal claim (or defend your business if one arises)

Addressing these legal requirements upfront will protect your business as it grows-don’t leave such crucial issues to chance.

What Are the Risks of Mishandling Whistleblower Complaints?

Ignoring or poorly managing whistleblower complaints can have serious consequences, including:

• Unfair dismissal or detriment claims (uncapped compensation for certain types of detriment)
• Regulatory investigations and fines
• Potential criminal liability for certain types of breach (such as health and safety laws or fraud)
• Severe reputational damage-both with employees and the wider public

Setting up your legal foundations early-including strong policies and trained managers-will help avoid these issues.

Key Takeaways: Investigating Whistleblower Complaints

• Most whistleblower complaints are investigated first by the business, but serious cases or conflicts of interest may be handled by independent external bodies or regulators.
• Your whistleblowing policy should specify clearly who investigates whistleblower complaints and outline impartial procedures.
• Respond to whistleblower complaints quickly and ensure confidentiality, fairness, and protection from retaliation at every stage.
• Key UK laws include the Public Interest Disclosure Act 1998, Employment Rights Act 1996, and data protection rules-non-compliance can lead to fines or tribunal claims.
• Escalation to an external regulator may be required for certain types of wrongdoing-always cooperate fully if requested.
• Seek tailored legal advice early to protect your business from risk, especially where serious allegations or senior staff are involved.

If you want to build a rock-solid whistleblowing process-or need help managing a current complaint-you can reach our team on 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.