Skip to main content

Working With Whistleblowers in UK Journalism

How to engage, assess, protect, and work with whistleblower sources in the UK: from PIDA protections to managing legal risk, verifying their materials, and the editor’s responsibilities.

Last reviewed: Next review due:

What whistleblowing means in UK journalism

A whistleblower is a person — typically an insider with privileged access — who discloses wrongdoing in the public interest. In UK journalism, this usually means a current or former employee, contractor, or official who provides a journalist with information about misconduct that the employing organisation is concealing or would conceal.

Whistleblowing is not a simple moral act. It exposes the source to significant professional and personal risk. It places the journalist under an ethical obligation of care that begins before first contact and does not end at publication. And it raises practical journalism questions — about verification, bias, and public interest — that require careful judgement at every stage.

The Public Interest Disclosure Act 1998 (PIDA) provides statutory employment protection for UK whistleblowers who make qualifying disclosures through prescribed channels. Disclosure to a journalist is protected under PIDA only in specific, limited circumstances. Understanding this framework is essential before you engage — because your source may not realise the limits of their legal protection.

The PIDA framework: what your source needs to know

Qualifying disclosures

Must relate to: criminal offence; breach of legal obligation; miscarriage of justice; health and safety danger; environmental damage; or concealment of any of these. Mere policy disagreement or general unhappiness with management does not qualify.

Reasonable belief test

The worker must reasonably believe the information disclosed tends to show wrongdoing. The belief does not have to be correct — but it must be objectively reasonable. A vague feeling is not enough.

Disclosure to media (s.43G)

Media disclosure is protected only if: (a) the worker reasonably believes they would be subject to detriment if they raised it internally or with a prescribed regulator; (b) there is no prescribed regulator and internal disclosure is not reasonably practicable; or (c) the wrongdoing is of an exceptionally serious nature. The disclosure must not be made for personal gain and must be reasonable in all circumstances.

What PIDA does not cover

PIDA protects against employment detriment — it does not protect a source from prosecution under the Official Secrets Act 1989, the Computer Misuse Act 1990, or criminal confidentiality obligations. Civil servants and intelligence employees have much more limited protection.

When whistleblower assessment is critical

  • 1Before first substantive contact — have you considered whether the source could be identified merely by the fact that a journalist approached them?
  • 2Before receiving any documents — have you considered the security of the handover channel?
  • 3Before making any promises — have you understood the limits of what you can legally guarantee?
  • 4When assessing motivation — is the source primarily public-interest-driven or primarily grievance-driven?
  • 5Before going back to the organisation for comment — have you considered whether doing so might identify your source?
  • 6When deciding how to handle the story — have you considered what minimum detail is necessary to serve the public interest without unnecessarily exposing the source?
  • 7At publication — have you redacted any identifying details that are not necessary to the story?

Red flags when engaging a source

  • The source is unwilling to provide any documentary corroboration — they want you to print allegations on their word alone.
  • The allegations relate solely to personal grievances (pay, promotion, treatment) rather than broader public wrongdoing.
  • The source has an active employment tribunal claim against the organisation — their disclosure may be litigation strategy.
  • The source is offering the same story to multiple outlets simultaneously without telling you.
  • The documents appear too complete or too conveniently structured — consider whether they could be fabricated.
  • The source is pressing for an unrealistic publication deadline that does not allow adequate verification.
  • The source wants to be identified in the story — consider whether this changes your public interest assessment.

Whistleblower investigation checklist

  • I have briefed my editor at the earliest possible stage and obtained editorial authorisation to proceed.
  • I have assessed the source's motivation and documented my assessment in the editorial file.
  • I have established a secure communication channel (Signal, SecureDrop) before receiving any sensitive material.
  • I have advised the source (without giving legal advice) to consider consulting a lawyer or the NUJ before disclosing material that may affect their employment.
  • I have received and documented a chain of custody for all materials provided by the source.
  • I have independently verified the key allegations through documents or additional sources — not relying solely on the whistleblower's account.
  • I have considered what minimum information is necessary to tell the story without unnecessarily identifying the source.
  • I have obtained a right of reply from the subject organisation before publication, with care taken not to identify the source in the approach.
  • I have had the story read by a media lawyer before publication given the significant legal risk.
  • I have agreed with the source what contact I will maintain with them after publication.

Tools for whistleblower investigations

Use our Source Protection Guide for secure communication protocols and our Investigation Risk Register to track legal and editorial risks across the investigation.

Source Protection GuideInvestigation Risk Register

Common mistakes

  • Making promises you cannot keep — particularly guarantees of absolute anonymity under UK law.
  • Not briefing your editor early enough — leaving the editor to manage a story they have not authorised is a serious editorial failure.
  • Using insecure communication channels (WhatsApp, standard email) for sensitive source contact.
  • Publishing sufficient detail that, even without naming the source, identifies them to their employer.
  • Not verifying the source's account independently — relying entirely on a single account is insufficient for significant allegations.
  • Approaching the subject organisation for comment in a way that signals who provided the information.
  • Failing to consider whether the source may be subject to non-disclosure obligations that could expose them to civil liability beyond PIDA.
  • Abandoning contact with the source after publication — they may need support when facing retaliation.

Related guides

Secure Source Handovers
SecureDrop, Signal, encrypted USB — practical protocols for receiving materials safely.
Source Protection Law
UK legal framework for protecting source identity, including PACE production orders.
Handling Document Dumps
Receiving and analysing large datasets from sources responsibly.
Digital Security
Secure devices and communications for sensitive investigative work.

Primary sources

Frequently asked questions

What legal protection do UK whistleblowers have?
The Public Interest Disclosure Act 1998 (PIDA) protects workers who make a "qualifying disclosure" — a disclosure of information that the worker reasonably believes shows wrongdoing in one of six categories: criminal offence, legal obligation breach, miscarriage of justice, health and safety danger, environmental damage, or deliberate concealment of any of these. Protection requires that the disclosure is made in good faith and to an appropriate body. Disclosures to the media are protected only as a last resort under s.43G PIDA — there are specific requirements including reasonableness of the belief and appropriateness of the media as recipient. PIDA protection means protection from retaliation at work, not immunity from criminal prosecution for disclosing official secrets.
How do I distinguish a genuine whistleblower from a disgruntled employee?
Motivation does not determine veracity — a disgruntled employee can still provide accurate, important information. But motivation affects how you assess the material. Ask: what do they hope to achieve? If the primary goal appears to be personal benefit (a settlement, revenge, reinstatement) rather than public interest, weigh their material more carefully. Look for corroborating documentation. A genuine whistleblower will usually be able to identify the specific wrongdoing in detail and provide or point to verifiable evidence. A source motivated primarily by grievance tends to make broader, harder-to-verify allegations.
Can I promise a source total anonymity?
You should be honest about the limits of what you can promise. In the UK, police and courts can seek production orders under PACE 1984 (Schedule 1) for journalistic material. The Investigatory Powers Act 2016 gives agencies powers to obtain communications data that may reveal source identity. Total anonymity is not something any journalist can guarantee under UK law. You can and should promise not to identify the source voluntarily, to use the strongest available technical protections, and to resist legal compulsion to the maximum extent possible. Consult your NUJ representative or a media lawyer before making specific promises.
What is the editor's role in a whistleblower investigation?
Your editor must be brought in as early as possible — not after the story is written. The editor needs to make the public interest judgement and authorise the investigation, be involved in decisions about how much to pay a source (if anything — payment can complicate legal protections and ethical standing), assess the legal risk and arrange legal review, and be aware of any promises made to the source so they can be honoured or negotiated if circumstances change. An investigation that the editor has not authorised lacks the editorial protection that comes from institutional support.
Are there specific sectors where UK whistleblowing is most common?
UK whistleblowing is most active in the NHS (patient safety and financial fraud), financial services (regulatory breaches, market manipulation), local government (procurement fraud, planning corruption), central government and defence (policy misrepresentation, contract irregularities), and charities (financial mismanagement, safeguarding failures). The sector affects which regulator a whistleblower should approach — NHS England, the FCA, HMRC, the Charity Commission — before going to the media, and this affects the legal protection available under PIDA.

Related guides

Media LawSource Protection Law in the UKRead →Media LawData Protection & the Journalism ExemptionRead →InvestigativeSecure Source HandoversRead →InvestigativeHandling Data Leaks and Document DumpsRead →Digital SecurityDigital Security HubRead →BlogWhistleblower Protection for UK JournalistsRead →

Primary sources