New Zealand’s 2026–2028 Open Government Partnership Action Plan includes a commitment to review how organisations apply the Protected Disclosures (Protection of Whistleblowers) Act 2022, and to make the consequences of retaliating against whistleblowers clearer. For any organisation that receives protected disclosures, it signals closer scrutiny ahead.
What has been committed
Under commitment NZ0032, Te Kawa Mataaho Public Service Commission, which administers the Act, will:
- Review agency practice in applying the Act, with a draft practice review published for public comment and a final report expected in 2027.
- Publish information on the consequences for organisations that unlawfully retaliate against whistleblowers.
- Scope a community of practice for public sector organisations that receive disclosures, similar to the existing forum for Official Information Act practitioners.
The plan sets out milestones running from mid-2026 through to the end of 2027, including desk research, engagement with agencies and stakeholders, and potential “stretch” work such as publishing data on the number and themes of protected disclosures. Large private sector organisations that receive disclosures, such as banks and utilities, are listed among the stakeholders who may be engaged.
Why the government is doing this
The commitment is frank about the gaps in the current system. It notes that:
- there is no data showing whether the Act is achieving its purpose of encouraging disclosures and protecting the people who make them
- the consequences for organisations that retaliate against whistleblowers are unclear, which may discourage people from coming forward
- many organisations that can receive disclosures rarely do, and may lack the experience to apply the Act’s protections correctly
- potential disclosers can be put off by uncertainty over whether their concern is “serious” enough, or by the requirement not to act in bad faith
It also cites the 2025 Public Service Census (which we also covered in our look at workplace harassment): while 90% of public servants said they knew what to do if they witnessed wrongdoing, only 70% said they felt safe to speak up. Meanwhile, demand is rising. The Ombudsman recorded a 300% increase in protected disclosure matters since the 2022 Act came into force.
The guidance already in place
The review builds on guidance released in 2025. In September 2025 the Public Service Commission released:
- Updated Speaking Up model standards, which set out the expectations on public sector organisations to support effective reporting and managing of wrongdoing concerns (we looked at why independence matters under the standards in an earlier article); and
- New guidance for complainants, Your Complaint, Your Rights, to help people understand their rights when speaking up about bullying, harassment, or discrimination in public sector workplaces.
Also in 2025, the Office of the Ombudsman published guidance for receiving and dealing with protected disclosures: Guidance for receivers | Ombudsman New Zealand.
What this means for organisations
More disclosures, combined with a formal review of how they are handled, means organisations should expect their processes to be tested. Practical steps to take now:
- Check your procedures against the Act. Public sector organisations must have internal procedures and publish information about them. Make sure yours reflect the 2022 Act and the Ombudsman’s Guidance for receivers. Our guide to the Act is a quick refresher.
- Look at the 20-working-day guidance. Section 13 sets out how a receiver should acknowledge, assess and respond to a disclosure. Can you show you meet it?
- Make anti-retaliation real. With the Commission set to publish the consequences of retaliation, organisations will want clear safeguards for disclosers, especially in the months after a report is made.
- Protect confidentiality in practice. Identity protection is the safeguard people most want before reporting. Restrict access to disclosure records and avoid informal handling through managers’ inboxes.
- Keep a record. If the stretch goal of publishing disclosure data goes ahead, organisations with good records of volumes, themes, timeframes and outcomes will be well placed.
Where independence helps
Many of the problems the review targets, such as inconsistent handling, low confidence in confidentiality and fear of retaliation, are hardest to solve when disclosures go through the same management chain they concern. An independent provider brings consistent, experienced handling, secure records and a reporting route that staff can trust.
Whistleblowers, operated by Incident Response Solutions Limited, offers New Zealand organisations an independent, PDA-compliant disclosure platform with secure reporting by phone, web, email and post, anonymous options, 24/7 support, and regular reporting and policy review to help you demonstrate compliance.
Explore our Services or call 0800 WITNESS (0800 948 637) to discuss how we can help you prepare.
About the author: Campbell McKenzie is the founder and director of Incident Response Solutions, which operates Whistleblowers. He was a director at PwC New Zealand for 12 years, leading its national forensic technology practice, and was a founding member of the NZ Police Electronic Crime Laboratory. He has worked on numerous investigations arising from whistleblowing disclosures.
