Who is a whistleblower under the law?

The whistleblower laws cover you if you are a current or former employee or officer and you report misconduct about the company or its managers or other employees.

You are also covered if you are or were a supplier or contractor to the company, or work or worked for one of the company’s suppliers or contractors (whether paid or unpaid).

Your spouse and family members are covered too.

See INFO 238 for the full list.

What types of reports does the law protect?

What is protected?

The protections cover you if you are a whistleblower under the law and you report misconduct or a breach of the law by the company or its managers or employees to specific people. See the section below on ‘Who must I report my concerns to for the protections to apply?’ for further details of the people to whom you can report to attract the protections.

For example, you will be covered if you report fraud, ripping off the company or its customers or suppliers, or misleading people to make a sale.

It’s not only misconduct or breaches of the law. You will be covered if you raise an improper state of affairs or circumstances about the company, such as a business practice that causes consumer harm.

You must have reasonable grounds to suspect the misconduct you report. That is, there must be a reasonable basis for your concerns that the company, or certain related companies or their officers or employees have committed misconduct, breached certain laws, or acted improperly.

If you have reasonable grounds to suspect misconduct, your reasons for reporting the misconduct or your personal opinions about the people involved do not stop you from being protected. Your motive for reporting is irrelevant; the test is whether you have reasonable grounds.

What is not protected?

If your report is solely about a personal grievance you are having in the workplace, you will not be protected by the whistleblower laws. See the section below on 'Are personal work-related grievances covered by the whistleblower protections' for further details.

You cannot be protected for a report you know is false. It must be an allegation you have reasonable grounds to suspect is the case.

Who must I report my concerns to for the protections to apply?

To qualify for whistleblower protections, you should report your concerns to:

• a director, officer, senior manager, auditor, or actuary of the company that the concerns relate to, or people holding these positions in a related company,
• people authorised by a company to receive whistleblower reports – such as dedicated whistleblower hotlines,
• ASIC or APRA, or
• a lawyer, for the purpose of obtaining legal advice or legal representation about the whistleblower protections.

You can report your concerns directly to any of these people. Keep in mind that while the company may encourage you to raise concerns with your immediate supervisor as a first step, if you do so you may not always qualify for the whistleblower protections. If it’s important for you to be protected as a whistleblower, report directly to a person in the categories described above.

The tax law also contains specific whistleblower protections for reports about tax avoidance behaviour and other tax issues. You can also be protected for reports to the Australian Taxation Office.

How can I report my concerns to ASIC?

You can report your concerns to ASIC. You don’t have to report to the company first, but you can if you wish.

As a first step, we need you to summarise your concerns in writing. This helps us to respond quickly with what further information we may need and what documents to ask for. After we receive that, we will let you know if we need further help from you. 

Report your concerns through our online form.

We keep all concerns reported to us confidential and won’t reveal your identity, information that might identify you, or information about your report unless we are compelled or authorised to do so by law.

There are some limits on what we can tell you about what we are doing with the information you provide to us. See Information Sheet 152 Public comment on ASIC's regulatory activities (INFO 152) for more information.

Can I report anonymously?

Yes. You don’t have to give your name or identify yourself to be protected as a whistleblower.

It may be hard for the company or ASIC to follow up your concerns or update you if you don’t give some way to contact you, but the law will still protect you.

How am I protected under the law?

It’s against the law for a person to reveal your identity as a whistleblower unless you agree or it is done when referring your report to ASIC, APRA or the Australian Federal Police. However, a company or person may disclose information that could identify you if it is for the purpose of investigating your report and they have taken steps to reduce the risk that you will be identified.

It’s also against the law for a person to cause you detriment, harm you or threaten you for reporting misconduct or because they suspect you have reported or may report misconduct. For example:

• your employer can’t sack you, demote you, discriminate against you, or harass or intimidate you because you reported misconduct or your employer suspects you reported misconduct
• if you are a supplier or a contractor to a company, the company can’t threaten your contract or business arrangements because you reported misconduct or it suspects you reported misconduct.

If they do, you can seek compensation, to be reinstated to your job, or other remedies through the courts. You can also report their actions to ASIC.

People can’t take legal action against you because you report misconduct. For example:

• a company can’t enforce a non-disclosure clause in your employment contract or in a settlement of an employment dispute to prevent you from reporting misconduct. People can’t stop you from speaking up about suspected misconduct, including to ASIC or APRA
• you can’t be charged with a criminal offence for reporting misconduct, and
• a person or company can’t bring civil proceedings against you because of your report.

That said, the whistleblower laws don’t give you immunity if you were involved in the misconduct you report, though your report can’t be used against you. If you cooperate, ASIC will likely take this into account. See Information Sheet 172 Cooperating with ASIC (INFO 172) if this applies to you. ASIC also has an immunity policy for certain types of markets offences.

If you need to rely on any of these protections or any of these examples become relevant to you, we encourage you to seek legal advice. The circumstances relating to your situation will be unique and ASIC does not give individual legal advice.

I’ve reported misconduct to my employer and now I’m being victimised. What can I do?

It’s against the law for a person to cause you detriment, harm you or threaten you for reporting misconduct.

ASIC can investigate allegations that a person caused or threatened you with detriment for reporting misconduct. Report your concerns through our online form. We may be able to bring legal action against a person or company for such conduct, though this action may not result in compensation or other remedies for you.

You can also seek compensation through a court if you suffer loss, damage or injury for making your report, or seek to be reinstated to your job or for other remedies through the courts.

We encourage you to seek advice from a lawyer about whether the whistleblower protections may be relevant for you, and if you have a valid claim for compensation. ASIC does not give individual legal advice and while we may act against individuals or companies for causing detriment, ASIC’s role does not involve taking compensation action on your behalf.

What if my concern is not a matter for ASIC?

Other regulators and law enforcement agencies may be responsible for investigating your concerns.

You are still able to report your concerns to ASIC. By first raising your concerns with us or with APRA, the law can protect you as a whistleblower. This will be important if you are not comfortable first reporting your concerns to the company directly.

If you report something to ASIC that is not within the laws administered and enforced by ASIC, we will refer you to another regulator or law enforcement agency.

Are personal work-related grievances covered by the whistleblower protections?

If your report of misconduct is solely about a personal grievance you are having in the workplace, the whistleblower protections in the law won’t apply.

A personal work-related grievance has implications for you personally and does not also have significant implications for your employer.

Examples include:

• an interpersonal conflict between you and another employee
• a decision relating to your engagement, transfer or promotion
• a decision relating to the terms and conditions of your engagement, or
• a decision to suspend or terminate your engagement, or otherwise to discipline you.

While the whistleblower protections aren’t available for a personal work-related grievance, you may have other employment law protections available to you. Contact the Fair Work Ombudsman or Fair Work Commission for information about workplace rights and obligations.

That said, if one of these examples has happened because you have previously reported misconduct (or a person suspects you have reported or are about to report misconduct), a report about those circumstances will be covered by the whistleblower protections.

Can I report my concerns publicly?

The law will protect you as a whistleblower if you report your concerns about an emergency or matter in the public interest to a journalist or parliamentarian, in certain limited circumstances. If you go public with your concerns in another way, such as by posting on social media, you won’t be covered.

INFO 238 explains the steps you must take to be protected for disclosing to a journalist or parliamentarian in detail. We encourage you to read the steps set out in INFO 238 carefully.

The key steps are summarised below. Before reporting your concerns about an emergency or a matter in the public interest to a journalist or parliamentarian, you must first report them to ASIC or APRA, such as through our online form or by contacting APRA.

Emergency disclosures

You must have reasonable grounds to believe your initial report concerns substantial and imminent danger to the health or safety of one or more people or to the natural environment.

If so, you can report to a journalist or parliamentarian after you write to ASIC or APRA to let us know you intend to make an emergency disclosure.

Public interest disclosures

You must have reasonable grounds to believe that:

• action to address concerns raised in your initial report is not being or has not been taken, and
• reporting your concerns to a journalist or parliamentarian is in the public interest.

If so, you must wait 90 days from when you first reported to ASIC or APRA, then you must write to the regulator you initially contacted again to let them know you intend to make a public interest disclosure.

If you believe you may be eligible to make a public interest disclosure, we encourage you to seek independent legal advice regarding this process.

Does my company have to comply with the whistleblower protections?

All companies in Australia must comply with the whistleblower protections. ASIC encourages companies to have arrangements in place for handling any whistleblower reports they may receive, but only certain companies are required to have a formal whistleblower policy.

Public companies, large proprietary companies and trustees of APRA-regulated superannuation funds must have a whistleblower policy. The whistleblower policy must include information about how you can report your concerns (both within and outside the company) and the protections available to you. Looking at the company’s whistleblower policy first may help.

Where can I go for help to understand the whistleblower protections?

As with any rights and protections under the law, we encourage you to seek advice from a lawyer about how the whistleblower protections may help you. The protections under the law are there for you to pursue, if you need them.

If your company is required to have a whistleblower policy, the policy must explain the protections available to whistleblowers and how the company will support and protect you.

ASIC cannot provide you with legal advice about your personal circumstances.

We can provide you with general information about the protections, and we encourage you to read INFO 238 and INFO 239. We will keep you updated on a regular basis if we investigate your concerns, where we are able to comment on our activities, see INFO 152 Public comment on ASIC's regulatory activities.

Where can I go for support?

Whistleblowers play an important role. Despite this, we appreciate that you can find yourself in difficult and stressful circumstances when you speak up and report misconduct. You may feel isolated from colleagues or fear for your personal or financial safety.

If your company has a whistleblower policy, the policy must set out how it will support and protect you.

There may be other resources available to you as a current or former employee. You can contact the Fair Work Ombudsman or Fair Work Commission for information about workplace rights and obligations.

If you’re feeling overwhelmed, ASIC’s Moneysmart website has information about free financial and personal support services. If you are concerned about your personal safety, we encourage you to contact the police.