Table of Contents

Who should read this?

Small and medium-sized Irish employers, HR managers, compliance officers, and business owners who may receive worker reports about wrongdoing at work or need to establish reporting policies.

Readers will learn the exact requirements of the 2022 Act, how to design a compliant channel, handle disclosures step-by-step, maintain records, and reduce legal exposure under the updated protected disclosures regime.

Key Takeaways

Since December 2023 certain employers must operate a compliant internal protected disclosures channel.
Acknowledge reports within 7 days and provide feedback within 3 months as statutory requirements.
Document everything thoroughly as the burden of proof now lies with the employer in penalisation claims.
Interpersonal grievances are not protected disclosures; use the grievance procedure instead.
Failure to comply risks WRC claims, compensation up to 5 years’ pay, and potential criminal offences for directors.

Protected Disclosures Ireland: Small Employer Guide

When an employee raises a serious concern about wrongdoing at work, the last thing a small employer wants is to find out they have handled it wrong by reading the Workplace Relations Commission decision. The law governing protected disclosures in Ireland changed substantially with the 2022 Act, and the grace period for getting your house in order is long gone. This guide sets out who must have a reporting channel, how it should work, and what happens when a disclosure lands.

What is a protected disclosure in Ireland?

A protected disclosure is a report by a worker about a "relevant wrongdoing" that they reasonably believe to be true and that came to their attention through work. Unlike an ordinary grievance, a protected disclosure triggers statutory protections for the person reporting it, and statutory obligations for the employer receiving it. The framework lives in the Protected Disclosures Act 2014, as amended by the Protected Disclosures (Amendment) Act 2022 which took effect on 1 January 2023.

"Worker" is broader than "employee". It includes current and former employees, contractors, agency staff, trainees, volunteers, and in many cases board members and shareholders working in a business. The protections follow the role, not the title.

Which employers must have an internal reporting channel?

Since 17 December 2023, every private sector employer with 50 or more employees must operate an internal protected disclosures channel. The 2022 Act removes that 50-employee floor for public sector bodies and for private employers in sectors such as financial services, anti-money-laundering, transport safety, offshore oil and gas, and product safety. Those employers must have a channel regardless of headcount.

A small employer below the 50-employee threshold outside those regulated sectors is not required to have a formal internal channel. But workers still keep the right to make a protected disclosure, and they can go externally to a prescribed person or the Protected Disclosures Commissioner at any time. A voluntary internal channel is often the cheapest way to catch a problem before it reaches a regulator.

Author's tip: Even if you are well under 50 staff, write a short protected disclosures policy. It signals that the business takes concerns seriously, and it gives your managers a playbook if something lands in their inbox at 10pm on a Friday.

What makes a reporting channel compliant?

The amended Act sets the minimum design standards. An internal channel must:

Be secure and confidential, protecting both the reporting person and anyone named in the report.
Accept reports in writing, orally, or at the reporter's request, in a physical meeting.
Route reports to a designated person who can act independently.
Acknowledge receipt in writing within 7 days.
Provide feedback to the reporter within three months, including any action taken or planned.

The designated person can be internal, such as a HR director or compliance officer, or an external third-party provider, provided the employer ensures the outsourced service meets the Act's standards. Anonymous reports must still be processed, and if the reporter later becomes identifiable, the full confidentiality protections apply retrospectively.

How should you handle a disclosure in practice?

Treat the first 7 days as the most important window. A proper acknowledgement is itself a statutory obligation, and a missed one is evidence of a process failure. Log the report, confirm receipt in writing, and open a file with access restricted to the designated person and any specialist advisers.

Next, run an initial assessment. If there is no prima facie evidence of a relevant wrongdoing, close the file and record why. If there is, move to a proportionate investigation. Keep minutes, preserve evidence, and keep the reporter informed in writing at each milestone. Feedback within three months is not optional.

The 2022 Act shifted the burden of proof in penalisation claims. If a worker alleges that they were penalised for making a disclosure, it is now on the employer to prove the treatment was "wholly unrelated" to the report. Contemporaneous documentation is the difference between a successful defence and a costly award.

In practice, this means: any disciplinary, performance, or restructuring decision that touches a reporter needs an independent, well-documented rationale that predates or clearly stands apart from the disclosure. In our experience, if you skip that step, you fight the case on the employee's terms.

What are "relevant wrongdoings" and what is not?

Relevant wrongdoings include criminal offences, breaches of legal obligations, miscarriages of justice, danger to health and safety, damage to the environment, misuse of public funds, and gross mismanagement by a public body. Breaches of EU financial services, product safety, or data protection law are also covered.

The 2022 Act clarifies that an "interpersonal grievance" affecting only the reporter is not a relevant wrongdoing. This is important as many small employers confuse a personal complaint about a manager's conduct with a protected disclosure. The right route for a personal grievance is your grievance procedure for small employers, not the disclosures channel. If the same facts also point to systemic wrongdoing affecting other workers, the disclosure protections apply to that element.

What records must you keep?

Every report requires a written record, including anonymous ones. Keep:

The report, any attachments, and a log of communications with the reporter.
The designated person's assessment and decisions.
Minutes of any investigation meetings.
The final outcome and the feedback you sent to the reporter.

Store the file in a GDPR-compliant manner, with tight access controls. Our notes on document retention rules for Irish companies and your written data retention policy should cover how long to hold the material and how to delete it safely. Tie the process into your broader GDPR compliance framework so no one handling a disclosure has to guess what good looks like.

A clean trail also protects your company records in the event of a WRC inspection or a Labour Court appeal, and confirms that any confidentiality agreement your team signed is consistent with the statutory right to make a disclosure.

What are the consequences of getting it wrong?

Protected disclosure claims go to the WRC in the first instance, with appeals to the Labour Court. Interim relief is available in the Circuit Court to pause a dismissal pending a decision, and the Court of Appeal has confirmed that the statutory route is generally exclusive of a parallel common law claim. WRC data shows protected disclosure complaints rose by around 201% between 2022 and 2023, and the WRC now prioritises these cases for faster hearing dates.

Beyond the compensation awards, which can reach up to five years' remuneration for penalisation, including dismissal, the 2022 Act introduced new criminal offences for hindering a disclosure, breaching confidentiality, or retaliating against a reporter. Directors and senior managers can be personally prosecuted.

Wrapping up

The law governing protected disclosures in Ireland is no longer a theoretical compliance topic. As of April 2026, the 2022 Act applies in full, the WRC is prioritising these claims, and the burden of proof sits with the employer. Decide whether you need a formal channel, document what you already do, and train your designated person. If your annual leave policy and other employment policies are tidy, extending the same discipline to a disclosures policy is a short step. Open Forest can help you build a policy that meets the Act and fits the size of your team, without pretending you are a multinational bank.

About the Author:

Connect:

Laura Ryan is a practising Barrister at the Bar of Ireland. She graduated from the Honourable Society of King’s Inns in 2024, having previously qualified and practised as a Chartered Accountant in a big four accounting firm.

Legal

May 2026

Protected Disclosures Ireland: Small Employer Guide

Key Takeaways

Zero Hour Contract Ireland: 2018 Act Rules Explained

Director Service Agreement Ireland: Founder Guide

Written Statement of Terms Ireland

Equity Crowdfunding in Ireland

WRC Claim Ireland: Employer Response Guide

Employee Handbook Ireland 2026 Compliance Essentials

Restrictive Covenants in Irish Employment

Fixed-Term Contracts Ireland: Employer Guide

Right to Request Remote Working Ireland: Employer Guide

Redundancy Process Ireland: 2026 Employer Playbook

Frequently Asked Questions

What is a protected disclosure in Ireland?

Which employers must have an internal reporting channel?

What makes a reporting channel compliant?

What are relevant wrongdoings?

Explore our other topics

Reckless Trading Ireland: Director Liability Guide

Cost to register an Irish Company with Price Calculator: 2026 Full Fee Breakdown

Director's Loan Account Ireland: Section 239 & Tax Rules