Australia’s whistleblower protection regime is set out in Part 9.4AAA of the Corporations Act 2001 (Cth), which provides comprehensive protections for individuals who disclose information about misconduct in corporations, superannuation entities, and regulated financial entities. The protections include employment protection (prohibition on victimisation), civil remedies for detriment suffered, and criminal penalties for conduct that intentionally causes detriment. A company with more than 100 employees must have a whistleblower policy — and from 1 January 2020, all companies must comply with the disclosure and protection framework regardless of size.

This guide covers the types of eligible disclosures, who can make a disclosure, the employment protections available, and the obligation to have a whistleblower policy.

Key takeaways

  • Whistleblower protection is governed by Part 9.4AAA of the Corporations Act 2001 — applicable to corporations, superannuation entities, and regulated financial entities.
  • An eligible disclosure is information that the discloser reasonably believes relates to misconduct or an improper state of affairs in relation to the entity.
  • The disclosure can be made internally (to the company, a director, an officer, or the company’s auditor) or externally (to ASIC, APRA, a prescribed Commonwealth authority, or a lawyer).
  • Employment protection prohibits the entity from engaging in conduct that detrimentally affects the discloser — including dismissal, demotion, harassment, and discrimination.
  • Companies with more than 100 employees must have a whistleblower policy — s.1317AI.
  • Confidentiality of the discloser’s identity must be maintained — disclosure of the identity is a criminal offence unless authorised.

Who can make an eligible disclosure

The protection extends to a broad range of disclosers — s.1317AAA:

Category Who
Officers Directors, company secretaries, and senior managers
Employees Any person employed by the entity
Contractors Contractors, subcontractors, and their employees
Associates Persons who have had dealings with the entity
Relatives and dependants Spouses, children, and dependants of any of the above

The broad range of eligible disclosers means that whistleblower protection is not limited to employees — it extends to contractors, suppliers, and family members.

What is an eligible disclosure

Under s.1317AAA, an eligible disclosure is information that the discloser reasonably believes:

  1. Relates to misconduct or an improper state of affairs in relation to the entity.
  2. The information indicates conduct that constitutes an offence against Commonwealth laws.
  3. The information represents conduct that is contrary to certain provisions of the Corporations Act.
  4. The information relates to conduct that represents a danger to the public or the financial system.

The discloser must have a reasonable belief — not a mere suspicion. The test is objective: would a reasonable person in the discloser’s position believe the information relates to misconduct?

What is not an eligible disclosure

  • Personal workplace grievances (unless they involve misconduct)
  • Information that is already publicly known
  • Information that is protected by legal professional privilege

Internal disclosures

An internal disclosure is made to:

  • The entity itself
  • A director, officer, or senior manager of the entity
  • An auditor or auditor of the entity
  • A person authorised by the entity to receive disclosures

An internal disclosure is protected if the discloser reasonably believes the information relates to misconduct and the discloser reasonably believes the information is true or could be true — s.1317AAA(2).

Qualifying condition

Before making an internal disclosure, the discloser must have reasonable grounds to suspect the information concerns misconduct and the information is true or could be true. This is a lower threshold than the “reasonably believes” test for external disclosures.

External disclosures

An external disclosure is made to:

  • ASIC (Australian Securities and Investments Commission)
  • APRA (Australian Prudential Regulation Authority)
  • A prescribed Commonwealth authority
  • A lawyer (for the purpose of obtaining legal advice or legal representation)

An external disclosure is protected if:

  1. The discloser reasonably believes the information relates to misconduct.
  2. The discloser has reasonable grounds to suspect the information concerns misconduct.
  3. The discloser reasonably believes the information is true or could be true.
  4. The disclosure is not vexatious, frivolous, or made to abuse the process.

Employment protections

The core employment protection is in s.1317H:

  • A person must not cause or threaten any detriment to a person because the person has made, or may make, an eligible disclosure.
  • Detriment includes dismissal, demotion, harassment, discrimination, harm, and injury.
  • The prohibition applies to the entity, its officers, employees, and agents.

Civil remedies

A person who suffers detriment as a result of victimisation can seek civil remedies from the Federal Court or Federal Circuit Court, including:

  • Compensation for the detriment suffered
  • Injunctions to prevent further victimisation
  • Restoration of the position the person would have been in but for the victimisation

Criminal penalties

Under s.1317Q, a person who intentionally engages in conduct that causes detriment to a person because they made an eligible disclosure commits a criminal offence. The maximum penalty is 5 years’ imprisonment or a fine, or both.

Confidentiality

Under s.1317AE, a person must not disclose information that identifies or is likely to identify a person who has made an eligible disclosure, unless:

  • The disclosure is required or authorised by law.
  • The disclosure is made for the purposes of legal proceedings.
  • The disclosure is necessary to prevent or lessen a serious threat to life, health, or safety.

Breach of the confidentiality obligation is a criminal offence with a maximum penalty of 5 years’ imprisonment.

Whistleblower policy

Under s.1317AI, a public company and a large proprietary company (more than 100 employees) must have a whistleblower policy. The policy must:

  1. Set out the protections available to disclosers.
  2. Explain how disclosures will be investigated.
  3. Explain how the entity will ensure confidentiality.
  4. Explain how the entity will support disclosers and deal with victimisation.
  5. Set out the process for making a disclosure.

The policy is not mandatory for smaller proprietary companies, but it is recommended. The policy must be made available to all officers and employees.

Common pitfalls

1. Not having a whistleblower policy

Companies with more than 100 employees must have a whistleblower policy. Failure to have one is a breach of the Corporations Act and exposes the company to regulatory action.

2. Identifying the discloser

Disclosing the identity of a whistleblower is a criminal offence. The entity must maintain confidentiality — even internally, the discloser’s identity should be shared only on a need-to-know basis.

3. Dismissing the discloser

Dismissing an employee because they made an eligible disclosure is prohibited. The discloser can seek civil remedies — and the employer may face criminal penalties if the dismissal was intentional.

4. Ignoring the disclosure

Receiving a disclosure and taking no action is a breach of the entity’s obligations. The entity must investigate the disclosure and take appropriate action.

Putting it into practice

Five steps to manage whistleblower compliance:

  1. Publish a whistleblower policy — if you have more than 100 employees, this is mandatory.
  2. Designate a disclosure channel — a confidential channel for receiving disclosures, typically managed by the audit committee or an independent person.
  3. Train managers and officers — they must know how to receive, handle, and protect the identity of disclosers.
  4. Investigate every disclosure — take each disclosure seriously and investigate promptly.
  5. Monitor post-disclosure treatment — track the discloser’s treatment for 12 months after the disclosure to ensure no victimisation occurs.
You can take advantage of the free 14 days trial and explore Leave Balance.

A leave management system that tracks disclosures, protects discloser identities, and monitors post-disclosure treatment helps ensure compliance with the Corporations Act whistleblower protection regime.

Sources

This article is general information, not legal advice. Whistleblower protection law is complex and depends on the entity type and the nature of the disclosure — consult an Australian employment lawyer for specific situations.