New Zealand’s whistleblower law, the Protected Disclosures (Protection of Whistleblowers) Act 2022, protects people who report serious wrongdoing at work. It replaced the Protected Disclosures Act 2000 on 1 July 2022. This plain-English guide explains what the Act covers, who it protects, where to report, and what organisations must do.
On this page
- The Act at a glance
- What changed from the 2000 Act
- What is a protected disclosure?
- Who is a discloser?
- What is serious wrongdoing?
- Who can you report to?
- Can I report anonymously?
- What protections do whistleblowers get?
- What organisations must do when they receive a disclosure
- Public sector procedures
- Private sector obligations
- The role of the Ombudsman
The Act at a glance
What it protects
Reports of serious wrongdoing in or by an organisation, made by someone who works or worked there.
Who is protected
Employees and former employees, contractors, secondees, homeworkers, volunteers, board members and members of the Armed Forces.
Where to report
Your own organisation, or directly to an appropriate authority such as the Ombudsman, at any time.
Your protections
Confidentiality, no retaliation, and immunity from civil, criminal and disciplinary proceedings.
Anonymous reports
Allowed. Your identity must be kept confidential whether or not you give your name.
Not protected
Disclosures made to the media or on social media.
What changed from the 2000 Act?
The 2022 Act continues the 2000 Act’s purpose: to facilitate the disclosure and investigation of serious wrongdoing in the workplace, and to protect employees and other workers who report concerns. It made these improvements:
- extending the definition of serious wrongdoing to cover private sector use of public funds and authority, and behaviour that is a serious risk to the health and safety of any individual
- allowing people to report serious wrongdoing directly to an appropriate authority at any time, while clarifying the ability of the appropriate authority to decline or refer the disclosure
- strengthening protections for disclosers by specifying what a receiver of a disclosure should do
- clarifying internal procedure requirements for public sector organisations and requiring them to state how they will provide support to disclosers
- clarifying the potential forms of adverse conduct disclosers may face.
Organisations in both the public and private sectors have responsibilities under the Act as receivers of protected disclosures, and some are also appropriate authorities.
What is a protected disclosure?
A disclosure is protected when the discloser:
- believes on reasonable grounds that there is, or has been, serious wrongdoing in or by the discloser’s organisation, and
- discloses information about that in accordance with the Act, and
- does not disclose it in bad faith.
Good to know: you don’t need to prove the wrongdoing, and you don’t need to mention the Act when you report. If you’re unsure, you can ask the Ombudsman for advice first, and that request is itself protected.
Who is a discloser?
A discloser, in relation to an organisation, is an individual who is (or was formerly):
- an employee
- a homeworker within the meaning given in section 5 of the Employment Relations Act 2000
- a secondee to the organisation
- engaged or contracted under a contract for services to do work for the organisation
- concerned in the management of the organisation (for example, a member of its board or governing body)
- a member of the Armed Forces (in relation to the New Zealand Defence Force)
- a volunteer working for the organisation without reward or expectation of reward.
What is serious wrongdoing?
Serious wrongdoing is an act, omission or course of conduct that falls into one or more of the categories in section 10 of the Act. Some categories apply fully to the private sector and some only in limited ways:
| Type of serious wrongdoing | Public sector? | Private sector? |
|---|---|---|
| An offence | Yes | Yes |
| A serious risk to public health, public safety, the health or safety of any individual, or the environment | Yes | Yes |
| A serious risk to the maintenance of the law, including the prevention, investigation and detection of offences, or the right to a fair trial | Yes | Yes |
| An unlawful, corrupt or irregular use of public funds or public resources | Yes | Yes, but not the use of private sector funds or resources |
| Oppressive, unlawfully discriminatory or grossly negligent conduct, or gross mismanagement, by a public sector employee or someone acting on behalf of a public sector organisation or the Government | Yes | Yes, but not the use of private sector powers |
What is not serious wrongdoing?
Things like dissatisfaction with an organisation’s leadership, or more minor misconduct, may not amount to serious wrongdoing and so may not be covered by the Act. The Act also does not cover employment issues that are more properly dealt with under the Employment Relations Act.
If you’re unsure whether your concern counts, contact the Ombudsman for advice, or check your organisation’s policies for handling other staff complaints.
Who can you report serious wrongdoing to?
You can make a protected disclosure to your own organisation, following its internal procedures or by going to its head or deputy head, or directly to an appropriate authority at any time. You do not have to go internally first.
Important: disclosures made to the media or on social media are not protected under the Act.
Who is an appropriate authority?
An appropriate authority is a trusted external party you can approach if you are not confident about raising a concern within your own organisation. They include:
- the head of any public sector organisation
- any officer of Parliament: the Ombudsman, the Controller and Auditor-General and the Parliamentary Commissioner for the Environment
- the bodies listed in Schedule 2 of the Act, such as the Serious Fraud Office, the Independent Police Conduct Authority and the Financial Markets Authority (FMA)
- the membership body of a profession, trade or calling with the power to discipline its members.
Appropriate authorities should handle protected disclosures in accordance with the Act. Special provisions limit who the appropriate authorities are for disclosures relating to intelligence and security or international relations information.
Can I report anonymously?
Yes. A disclosure can be made anonymously, although it can be harder for the receiver to investigate or keep you updated. Whether or not you give your name, the receiver must use their best endeavours to keep your identity confidential, unless you consent or disclosure is essential, for example to prevent a serious risk to someone’s health or safety.
What protections do whistleblowers get?
A discloser is protected for a disclosure made in accordance with the Act, even if they turn out to be mistaken and there is no serious wrongdoing. The protections are:
- Confidentiality of the discloser’s identity, as above.
- No retaliation. An employer must not dismiss, disadvantage or treat a discloser less favourably because of their disclosure. If it does, the discloser may have a personal grievance under the Employment Relations Act.
- No victimisation by anyone, with remedies available under the Human Rights Act 1993.
- Immunity from civil, criminal and disciplinary proceedings for making the disclosure.
These protections also extend to people who volunteer supporting information for the disclosure.
When is a whistleblower protected?
Protection applies to a disclosure made under an organisation’s internal procedures, to the head or deputy head of the organisation, or to an appropriate authority. A discloser stays protected even if:
- they are mistaken and there is no serious wrongdoing
- they don’t refer to the Act by name
- they technically fail to comply with some of the Act’s requirements, as long as they have substantially complied
- they also tell someone else in confidence to get advice about whether or how to make a protected disclosure.
Someone who provides further information in support of a disclosure is also protected, provided they do not act in bad faith and they disclose to their organisation or to an appropriate authority in accordance with the Act.
What must an organisation do when it receives a protected disclosure?
Within 20 working days of receiving a protected disclosure, the receiver (the organisation or an appropriate authority) should acknowledge receipt, consider whether it warrants investigation, check whether it has been made elsewhere, and deal with it by doing one or more of the following:
- investigating the disclosure
- addressing any serious wrongdoing by acting or recommending action
- referring the disclosure to an (or another) appropriate authority
- deciding that no action is required.
The receiver should then tell the discloser, with reasons, what it has done or is doing. If it can’t complete these steps within 20 working days, it should start the process, tell the discloser how long it expects to take, and keep them updated. The Ombudsman’s Guidance for receivers explains this in more detail.
What procedures must public sector organisations have?
Every public sector organisation must have appropriate internal procedures, which must:
- comply with the principles of natural justice
- set out a process for what the organisation will do as the receiver of a protected disclosure
- identify who in the organisation a protected disclosure may be made to
- refer to the requirement not to retaliate, or threaten to retaliate, against the discloser or treat them less favourably
- describe the circumstances when a disclosure might be referred on
- describe how the organisation will provide practical assistance and advice to disclosers
- describe how the organisation will meet the duty of confidentiality.
The organisation must publish information widely, and republish it regularly, about its procedures and how to use them. Procedures written before July 2022 should be reviewed and updated, because the 2022 Act added new requirements.
What must private sector organisations do?
The first three categories of serious wrongdoing in the table above apply equally to the public and private sectors. The last two can apply to the private sector in certain situations, such as when a private organisation uses public funds or performs a function on behalf of the Government.
Private sector organisations must follow the Act’s provisions, including those that apply when they receive a protected disclosure. They are not required to establish internal procedures, but a clear whistleblowing policy and reporting channel is best practice and makes the Act’s protections far easier for staff to rely on.
Some private sector organisations may also be appropriate authorities. For example, the membership body of a profession, trade or calling with the power to discipline its members should handle protected disclosures in accordance with the Act.
What is the role of the Ombudsman?
As well as being an appropriate authority, the Ombudsman has a wide role supporting the operation of the Act. It can give information and guidance to people considering a disclosure about how to make one and the protections available, and to organisations that are unsure what to do with a disclosure they have received.
Make the Act work in practice
The law sets out the protections, but people still need to trust the channel. The most common reason New Zealanders give for staying silent is fear of their employer. An independent, external reporting line removes that barrier.
Whistleblowers, operated by Incident Response Solutions Limited, gives New Zealand organisations an independent, PDA-compliant disclosure service: secure reporting by phone, web, email and post, anonymous options, 24/7 availability and expert handling of every disclosure.
Key resources
- Protected Disclosures (Protection of Whistleblowers) Act 2022 (legislation.govt.nz)
- Guidance for receivers (Ombudsman New Zealand)
- Speaking Up model standards (Public Service Commission)
- Government to review how agencies handle whistleblowers (our news)
- Whistleblower service FAQs
