Content updated on May 7, 2026
New Zealand has had dedicated whistleblower protection legislation since 2000, making it one of the first countries in the world to introduce such a framework. The Protected Disclosures (Protection of Whistleblowers) Act 2022, which came into force on 1 July 2022, replaced the original Act and addressed a number of gaps that had become apparent over more than two decades of use. The framework has since been further updated, most recently in January 2025. For organisations operating in New Zealand, understanding what the Act requires (and what it does not) is essential to building a reporting environment that actually works.
What Changed From the 2000 Act
The 2022 Act extended the definition of serious wrongdoing to cover the private sector's use of public funds and authority, and to cover behaviour that poses a serious risk to the health and safety of any individual, meaning that issues such as bullying and harassment can now qualify as serious wrongdoing in a way they could not under the previous legislation.
Other key changes include the ability for disclosers to report directly to an appropriate authority at any time, without needing to go through internal channels first, and clearer obligations on receivers of disclosures to follow specific steps when a report is made.
The Act has been amended twice since coming into force. Sport and recreation was added as a category in July 2024 following the Integrity Sport and Recreation Act 2023, and defence information was updated in January 2025 under the Inspector-General of Defence Act 2023.
What the Act Requires
For Public Sector Organisations
Public sector organisations are required to establish and publish internal procedures for receiving and handling protected disclosures. They must also be ready to receive disclosures as appropriate authorities, since reporters can now go directly to a relevant authority at any time.
For All Organisations
Whether public or private, all organisations must follow the Act's requirements when they receive a protected disclosure. Within 20 working days of receiving a report, the receiver should:
- Acknowledge receipt and confirm the date the disclosure was received
- Assess whether it warrants investigation
- Check whether the disclosure has been made through another channel
- Address the matter reported by appropriate means
- Inform the discloser about the actions taken or being taken
When it is impracticable to complete all of these actions within 20 working days, the receiver should still do so as soon as reasonably practicable.
For Private Sector Organisations
Private sector organisations must follow the provisions of the Act when receiving a protected disclosure, but are not required by the Act to establish their own internal procedures. That does not mean internal channels are optional in practice. Organisations without a trusted internal reporting channel are more likely to find employees going directly to external authorities or the media — at which point the organisation loses any ability to manage the situation internally.
Protections for Disclosers
The Act protects any individual who is or was a worker for the organisation about which they are reporting. This includes employees, contractors, homeworkers, volunteers, and seconded staff. Employers are prohibited from retaliating against whistleblowers, and individuals who believe they have experienced retaliation can seek remedies through the Employment Relations Authority or the Human Rights Commission.
The Act places a strong emphasis on confidentiality. Employers and appropriate authorities are required to keep the identity of the whistleblower confidential unless the whistleblower consents or disclosure is necessary for the investigation.
The Impact So Far
The Ombudsman has received a marked increase in protected disclosures since the Act came into force, a sign that greater clarity around protections is encouraging more people to come forward. Research from the ACFE's 2024 Report to the Nations found that 43% of occupational frauds were detected by a tip, more than three times the number detected by the next most common method. Effective internal reporting channels do not just satisfy a legal obligation. They are one of the most reliable tools an organisation has for detecting misconduct early.
Making Internal Reporting Channels Work
While the Act does not mandate internal procedures for private sector organisations, the case for building them is strong. Organisations that invest in accessible, trusted reporting channels give employees a safe route to raise concerns before they escalate. Those that do not are more exposed to external disclosures, regulatory scrutiny, and the reputational consequences of misconduct that could have been caught earlier.
An effective channel needs to be easy to find, genuinely confidential, and supported by a clear process for what happens after a report is submitted. Employees who do not know the channel exists, or who do not trust it, will not use it.
Whispli helps New Zealand organisations build that infrastructure with secure, anonymous reporting, case management tools that keep investigators on top of their obligations under the Act's 20-working-day framework, and data security standards that meet the confidentiality requirements the Act demands.
%201.avif)
%201%20(2).avif)
%201%20(1).avif)
