The short answer: two overlapping systems

In shortHMPPS has a mandatory internal duty to report wrongdoing and a separate legal protection for protected disclosures; a report through a published HMPPS channel is normally both.

People often use 'whistleblowing' for any report about something wrong at work, but in HMPPS there are two systems with different rules.

The Civil Service Code adds a third strand: civil servants who have concerns should start by talking to their line manager, or if that would be difficult, to their department's nominated officers, and can report to the Civil Service Commission if they feel their concerns are not being addressed.

All three can apply to the same concern, so it helps to understand which route fits which kind of problem.

Two systems with different rules

The internal duty to report

  • Set out in the Counter Corruption and Reporting Wrongdoing Policy Framework (re-issued 10 May 2022).
  • Mandatory: staff must report suspicions at the earliest opportunity; failing to report corruption or serious wrongdoing may itself be a disciplinary matter.
  • The channels are designed for security and criminal matters, and they come with confidentiality rules.

The legal protection

  • Comes from the Public Interest Disclosure Act 1998, which inserted Part IVA into the Employment Rights Act 1996.
  • Does not require a particular HMPPS channel; it protects you if you meet the legal conditions.
  • In most cases a report through a published HMPPS channel is also a protected disclosure to your employer.
Which route fits which concern (as at 3 October 2026)
ConcernTypical routeSource
Corruption, contraband, an inappropriate relationship with a prisonerIntelligence system corruption function, LCCM, Counter Corruption Unit or the Integrity HotlineCounter Corruption framework paras 4.54 to 4.59
Wrongdoing by a senior managerNational Counter Corruption TeamCounter Corruption framework
Bullying, harassment, discrimination or victimisationIndependent Review, Resolution and Investigation Service (IRRIS) interim grievance processWritten answers, 9 July 2026
Use of force that may breach rightsReport to the Governor and Prison Group Director for investigationUse of Force Policy Framework paras 4.1 to 4.2
A concern that does not fit those routes, or you are unsureLine manager or nominated officer; Civil Service Commission as a last resortCivil Service Code
You need confidential legal advice firstPOA legal advice (members), a solicitor or the charity ProtectPOA; Protect

The HMPPS reporting channels in detail

In shortReport through the intelligence system, your LCCM, the Counter Corruption Unit or the Integrity Hotline; you can be anonymous, but you will see little of what follows.

HMPPS strongly encourages people to give their name, because it makes investigation easier, but anonymity is available. If you are named, your identity is restricted to counter corruption staff unless you are needed as a witness, and a risk assessment is carried out first.

The framework also commits to protecting reporters from victimisation. Triage of corruption intelligence is within 72 hours according to the framework, though what that triage produces is not published.

Intelligence system corruption function
In prisons the primary route.
LCCM
Your Local Counter Corruption Manager, normally a Deputy Governor grade.
Counter Corruption Unit
The central unit you can report to.
Integrity Hotline
Independently run by Crimestoppers, with an online form that accepts anonymous reports.
National Counter Corruption Team
Allegations about senior managers go here.
  • What happens next is largely not visible to you.
  • The framework describes a criminal investigation taking primacy in corruption cases, with the police Senior Investigating Officer deciding priority and HMPPS consulting on any HR decision that could affect the criminal case.
  • You may be asked for a witness statement, and you may not receive detailed feedback while an investigation is live.
  • If you are not told what is happening, ask the person you reported to what you can expect and when, but do not press for details of an ongoing criminal investigation.
Free toolMisconduct process navigatorA free, private walk-through of the published stages of an HMPPS conduct case, from informal conversation to appeal, with the points to check in your own establishment's policy. It does not store what you type.Open the free process navigator

What counts as a protected disclosure in law

In shortA protected disclosure conveys information you reasonably believe is in the public interest and tends to show a listed wrong, such as a criminal offence or a danger to safety.

Section 43B of the Employment Rights Act 1996 defines a qualifying disclosure as any disclosure of information which, in the reasonable belief of the worker, is made in the public interest and tends to show one or more of the matters listed below.

Disclosure of information
You need to convey facts, not just make allegations or state an opinion.
Reasonable belief
You do not have to be right, but your belief must be reasonable.
Public interest
A personal grievance about your own contract is not enough unless it affects others. The GOV.UK guidance says that personal grievances do not qualify unless they are in the public interest, and that the wrongdoing can be past, present or likely future.
  • A criminal offence has been, is being or is likely to be committed.
  • A person has failed, is failing or is likely to fail to comply with a legal obligation.
  • A miscarriage of justice has occurred, is occurring or is likely to occur.
  • The health or safety of any individual has been, is being or is likely to be endangered.
  • The environment has been or is likely to be damaged.
  • Sexual harassment has occurred, is occurring or is likely to occur (added from 6 April 2026).
  • Information tending to show any of those matters has been or is likely to be deliberately concealed.

Who you tell: employer, prescribed person or wider disclosure

In shortDisclosures to your employer or a prescribed person are the easiest to protect; wider disclosures such as to the media only count if the section 43G conditions are met.

GOV.UK keeps a list of prescribed persons, last updated on the page we read on 15 September 2026. When we searched it for entries relating to prisons, probation, the Ministry of Justice, the Prisons and Probation Ombudsman, HM Inspectorate of Prisons or Independent Monitoring Boards, we found no dedicated entry.

Bodies such as the National Crime Agency (for bribery and corruption), the Serious Fraud Office and the Health and Safety Executive appear for their areas. Check the live list before you rely on it, and take advice on which body, if any, fits your disclosure.

The tiered scheme

  1. Easiest to protectYour employer

    Includes your line manager and the HMPPS channels above.

  2. Also protectedA prescribed person

    A regulator or body named in regulations, where you reasonably believe the information and allegations are substantially true and the matter falls within the body's remit.

  3. Hardest to protectWider disclosure

    For example to the media, an MP or on social media: protected only if the section 43G conditions are met.

The section 43G conditions

In summary, for a wider disclosure to be protected, all of the following must be met. Section 43H deals separately with exceptionally serious failures.

  • You reasonably believe the information and allegations are substantially true.
  • You do not make the disclosure for personal gain.
  • One of three preconditions applies: you reasonably believe you would suffer a detriment if you told your employer or a prescribed person, or that evidence would be concealed or destroyed, or you have already made substantially the same disclosure to your employer or a prescribed person.
  • It is reasonable in all the circumstances, taking into account factors such as who you told, how serious the matter is, whether it is continuing and what happened to earlier disclosures.

Confidentiality, the Official Secrets Acts and 'gagging' clauses

In shortGagging clauses cannot stop a protected disclosure, but the Official Secrets Acts and confidentiality duties still apply, so use the official channels first.

The practical effect is simple. Use the official channels first.

Do not take copies of documents, photograph screens or forward emails to a personal account without advice, because that can create a separate breach even where your concern is genuine, and it may include personal data about prisoners. If you need to show someone evidence, ask your adviser how to do it safely.

Prison Act 1952 s.40D also makes some unauthorised photography, recording and transmission inside a prison an offence.

What the law does and does not override

Overridden: gagging clauses

  • Section 43J of the Employment Rights Act says any provision in an agreement between a worker and employer is void so far as it purports to preclude the worker from making a protected disclosure.
  • GOV.UK says confidentiality clauses cannot stop you making a protected disclosure to a lawyer, your employer or a prescribed body.
  • That includes settlement agreements and contracts.

Not carved out: other duties

  • The Civil Service Management Code reminds staff on appointment, retirement or resignation that they are bound by the criminal law, including the Official Secrets Acts, and by their duty of confidentiality to the Crown.
  • The Civil Service Code says the duty not to disclose official information without authority continues after you leave.
  • The Counter Corruption framework, in a footnote, acknowledges that disclosures made for whistleblowing purposes are likely to be unauthorised disclosures and tells staff to check the MoJ whistleblowing policy to see whether a disclosure is protected.

Confidentiality, rumours and false reports

In shortAfter reporting, do not discuss your suspicions beyond the report; false or malicious reports are misconduct, but honest, reasonable ones are what the system exists for.

A report made in good faith, on a reasonable belief and on factual information, is what the system exists for, even if it turns out to be mistaken. But if you report because of a personal dispute, or embellish what you saw, you risk both your protection and a conduct case.

The safest approach is to stick to what you personally saw, heard or know, record it in writing with dates, avoid speculation and avoid confronting the person concerned. If you feel unsafe, say so in your report; the framework describes wellbeing risk assessments and practical measures.

  1. Write down what you saw or heard: dates, times, places, people and what was said, separating fact from opinion.
  2. Note how you know it and whether anyone else was present or has the same information.
  3. Decide the right channel using the table above. For security or corruption matters use the HMPPS channels; for bullying or discrimination consider IRRIS.
  4. Make the report, keep a record of when and to whom, and ask what to expect next.
  5. Do not discuss it with colleagues, investigate yourself, or confront the person concerned. Do not warn them, ask them to stop, or ask colleagues for support.
  6. If you are worried about reprisals, get advice from your POA rep, a solicitor or Protect before or straight after reporting.

Two points in the framework that are easy to miss

Do not discuss it

  • Once you have made a report, you should not discuss your suspicions with others beyond making the report.
  • The framework says that discussing them with anyone not investigating the matter could be considered bullying and harassment and dealt with under PSI 06/2010.

False or malicious reports

  • False or malicious reports made through the reporting channels are themselves misconduct and dealt with under the same policy.
  • These rules do not penalise honest reports; they protect people from rumour and protect the integrity of investigations.

If you are treated badly after reporting

In shortReporters must not be victimised; record what happens, raise it, and act fast because the tribunal time limit is now six months from 1 October 2026.

  • Tribunal time limit6 monthsFrom 1 October 2026 (it was three months before); Acas early conciliation first, which pauses the clock
  • Dismissal for a protected disclosureNo minimum serviceSection 108(3) ERA
  • Ordinary unfair dismissal2 years until 31 Dec 2026Six months for dismissals with an effective date of termination on or after 1 January 2027

HMPPS policy says reporters must not be victimised, and the law protects workers from detriment and dismissal for making a protected disclosure.

If you think you are being treated worse because of a report, such as being moved, excluded, given worse shifts, subjected to hostility, or disciplined, write down what happened, when, and who was involved.

Raise it with your manager or HR, or through the grievance route if it is bullying or harassment, and speak to your POA rep. IRRIS runs an interim grievance process for bullying, harassment, discrimination and victimisation complaints, decided by someone outside your line management.

The transitional rules for acts before 1 October 2026 are not something we have verified, so act urgently if the treatment began before that date.

Paid toolMisconduct Response PackChecklists, a personal timeline builder and question lists for the days after you are told there is a concern, to take to your POA rep or solicitor. It supports advice; it does not replace it.See the Misconduct Response Pack

Getting independent advice

In shortProtect, the POA legal advice scheme and a solicitor can each advise; have your notes and timeline ready before you ring.

Protect
A specialist UK whistleblowing charity with a free, confidential advice line for people worried about wrongdoing at work; it advises on whether a concern qualifies, which channel to use and what to do if you are victimised.
POA Legal Advice Scheme
For members, covering some work-related matters, though rule 19.8 of the version we read says there is no initial advice or assistance for proceedings started before you joined or re-joined. Check the current handbook.
A solicitor
Can advise on your particular circumstances.

Before you ring anyone

  • Have your notes ready and your timeline of what happened and when.
  • Ask what the advice covers and whether it is confidential.
  • If you are a POA member, ask your branch which route they recommend.
  • Consider the Misconduct Response Pack, which includes a timeline builder and question lists for those conversations.
  • Use the free misconduct process navigator to see the published stages if a conduct process starts.

Common mistakes and what to remember

In shortProtection depends on the substance and the route, not the word 'whistleblowing'; put facts in writing, use a channel and take advice.

Each of these can reduce protection or create a separate problem.

An email to your manager that sets out facts and says you are concerned about a possible criminal offence can qualify. A vague complaint that the place is badly run might not. Where possible, put it in writing, state facts, and say why you think it matters to others.

Remember that you are not alone and that reporting is the lawful and expected thing to do. HMPPS's own policy says failing to report corruption may itself be a disciplinary matter.

Common mistakes

  • Waiting until the situation has become impossible to ignore.
  • Telling colleagues informally rather than using a channel.
  • Confronting the person.
  • Copying documents.
  • Posting online.
  • Mixing a personal grievance with a public interest concern.
  • Assuming that because a manager knows, the report has been made.

Frequently asked questions

Do prison officers have to report corruption?

Yes. The Counter Corruption framework says all HMPPS staff must report suspicions of wrongdoing and corruption at the earliest opportunity, and failing to report corruption or serious wrongdoing may be a disciplinary matter and, in some circumstances, a criminal offence. Use the published channels and keep a record of what you reported.

Can I report anonymously?

Yes, through the Integrity Hotline run independently by Crimestoppers and an anonymous online form, according to the framework. HMPPS strongly encourages giving your name so the report can be investigated, and says that if you are named your identity is restricted to counter corruption staff unless you are needed as a witness.

Am I protected if I blow the whistle?

You are protected if you are a worker, you reasonably believe the disclosure is in the public interest and shows one of the listed categories, and you make it to the right person.

Disclosures to your employer or a prescribed person are the most straightforward. Whether a specific disclosure is protected is a legal question, so take advice.

Can my employer stop me from whistleblowing with a confidentiality clause?

No. Under section 43J of the Employment Rights Act 1996, a contractual provision is void so far as it purports to stop a protected disclosure, and GOV.UK says confidentiality clauses cannot prevent protected disclosures to a lawyer, your employer or a prescribed body. Other duties, such as the Official Secrets Acts, still apply.

Can I go to the press or post online about wrongdoing?

Only with great care. Wider disclosures are protected only if the section 43G conditions are met, including belief that the information is substantially true, no personal gain, a qualifying precondition and reasonableness. Unauthorised comments to the press may also be a disciplinary offence under HMPPS policy. Get advice first.

What if I report something and I am wrong?

A good-faith report on a reasonable belief should not be treated as misconduct, even if mistaken. False or malicious reports are misconduct under the Counter Corruption framework. Stick to facts you know, avoid speculation and record the basis for your belief.

How long do I have to bring a tribunal claim if I am victimised?

Most tribunal claims now have a six-month time limit from 1 October 2026, after Acas early conciliation which pauses the clock. Transitional rules for earlier acts are not verified here, so act quickly and take advice. There is no minimum service for dismissal because of a protected disclosure.

Sources