NZ Laws and Legislation
What you need to know.
What is the Protected Disclosures Act?
The Protected Disclosures (Protection of Whistleblowers) Act 2022 (PDA) is a law that helps people to report serious wrongdoing happening in their workplace, without having to worry that action will be taken against them.
The purpose of the PDA is to promote the public interest by:
- facilitating the disclosure and timely investigation of serious wrongdoing; and
- protecting people who make disclosures in accordance with the PDA.[1]
The PDA applies to employees in both the public sector (government) and private sector, including the not for profit sector.
[1] Section 3.
What is serious wrongdoing?
Serious wrongdoing has a particular meaning under the PDA.[1] It does not apply to all possible wrongdoing that might be going on in your workplace.
Serious wrongdoing includes:
- an offence;
- a serious risk to
- public health
- public safety
- the health or safety of any individual, or
- the environment;
- a serious risk to the maintenance of the law, including the prevention, investigation and detection of offences and the right to a fair trial;
- an unlawful, corrupt or irregular use of public funds or public resources; and
- oppressive, unlawfully discriminatory, or grossly negligent conduct or gross mismanagement by
- a public sector employee, or
- a person performing a function or duty or exercising a power on behalf of a public sector organisation (the government).
These different types of serious wrongdoing falling under the Act depend on whether you are working in the public or private sector. They are summarised below:
Serious wrongdoing definition applicable to all organisations (public and private) |
Serious wrongdoing definition applicable to public sector organisations and parties that perform public functions or use public money |
Offences. |
Unlawful, corrupt or irregular use of public funds or resources – applies to the public or private sector but does not include the use of private sector funds or resources. |
Conduct that seriously risks public health, public safety, the health and safety of any individual, or the environment. |
Conduct by an official that is oppressive, improperly discriminatory, or grossly negligent, or that constitutes gross mismanagement – applies to a person performing a power on behalf of a public sector organisation. |
Conduct that seriously risks the maintenance of the law, including the right to a fair trial, and the prevention, investigation and detection of offences. |
|
Dissatisfaction with the leadership of an organisation that falls short of gross mismanagement or more minor misconduct is unlikely to amount to serious wrongdoing under the Act.
If you are unsure about whether the information you want to disclose relates to serious wrongdoing, you can contact the Ombudsman for advice.
If what you have witnessed in your workplace is not serious wrongdoing, you might still want to report it. However you should be aware that the protections under the PDA will not apply to you. It is a good idea to have a look at your workplace policies to see if there is one that explains how it will handle staff complaints.
Who is protected?
The PDA protects people who disclose serious wrongdoing in their workplace. To make a protected disclosure you must be someone who is or has been:
- an employee of the organisation (ie, a salary or wage earner);
- a secondee to the organisation;
- contracted to do work for the organisation;
- involved in the management of the organisation (including a member of a board or governing body);
- a volunteer to the organisation;
- a homeworker (within the meaning of section 5 of the Employment Relations Act 2000); or
- a member of the Armed Forces (with the New Zealand Defence Force).[1]
A person who discloses information in support of, or relating to, a protected disclosure by someone else is also entitled to protection, as long as they meet the requirements of the PDA.[2] If you are considering providing information in support of someone else’s protected disclosure, you can contact the Ombudsman for further information and guidance.
When is my disclosure protected?
Your disclosure will be protected if:
- you believe on reasonable grounds that there is, or has been, serious wrongdoing in your workplace (even if your belief is mistaken);
- you disclose information about the serious wrongdoing in accordance with the PDA (even if you do not mention the Act)
- to your employer in accordance with any internal procedures or to the head or deputy head of your organisation, or
- to an appropriate authority;
- you substantially comply with the PDA’s requirements (even if you don’t technically comply); and
- you disclose information confidentially to another person, to seek advice about whether or how to make a protected disclosure. [1]
Your disclosure won’t be protected if:
- you act in bad faith; or[2]
- the information you’re disclosing is protected by legal professional privilege.[3]
Legal professional privilege means information that is confidential legal advice. It might be emails, memos or reports written to or by a lawyer in your workplace, or a lawyer who was advising your workplace. It might also be correspondence about a legal action taking place in Court. Sometimes, it can be difficult to work out whether material is legally privileged. You can contact the Ombudsman for advice about this if you are unsure.
[1] Section 11.
[2] Section 9. Acting in bad faith is doing something for dubious motives, e.g. intimidation
[3] Section 39.
What protections do I have?
When you make a protected disclosure, you will be protected in the following ways:
- Your identity must be kept confidential unless certain exceptions apply (see confidentiality below).[1]
- You will be protected from civil, criminal and disciplinary proceedings that might otherwise arise ‘because of making the disclosure’.[2]
- You will be protected from retaliatory action or unfavourable treatment by your employer.[3]
- You will be protected by the anti-victimisation provisions of the Human Rights Act 1993.
These are explained below, and if you need further advice, you can contact the Ombudsman.
Confidentiality
When you make a protected disclosure, the person you make it to must use their best endeavours to keep confidential any information that would identify you, unless one of the exceptions in the Act applies.[4] This is a very strong obligation to keep your identity confidential.
If your employer is a public sector organisation, they must refuse any request for official information if release of that information might identify you.[5]
There are limited exceptions to the confidentiality requirement:
- where you consent to release of the identifying information, or
- if there are reasonable grounds to believe that release of the identifying information is essential:
- for the effective investigation of the disclosure;
- to prevent a serious risk to public health, public safety, the health or safety of any individual, or the environment;
- to comply with the principles of natural justice;[1] or
- for an investigation by a law enforcement or regulatory agency for the purpose of law enforcement.
You might be thinking about making an anonymous protected disclosure. If you are, it is important to think about whether your workplace will be able to investigate the information if it does not know who you are, or cannot ask you further questions.
The Ombudsman can provide information and guidance to you and your workplace about the circumstances in which anonymous disclosures may be made under the PDA.
Will I be told if my identity is going to be revealed? The Ombudsman recommends that your workplace or the appropriate authority you have made a disclosure to speak to you if it looks like identifying information will need to be disclosed for one of the specified reasons. If, when you make your disclosure, you have serious concerns about confidentiality or some other risk to you, it is important to be open about this with your employer or the appropriate authority you are making a disclosure to. Providing this information can be useful for when they are assessing any risks arising from your disclosure, and when planning action to provide you with support. The PDA sets a high threshold for when identifying information may be disclosed: it must be essential to disclose the particular information, for one of the listed reasons. A decision to disclose information that identifies or risks identifying the person who made the disclosure should not be made lightly. If you think your confidentiality has been breached you can contact the Privacy Commissioner.[2] |
[1] ‘Natural justice’ is a duty to act fairly. It is the right to a fair process and a fair hearing, free from bias. For example, it might mean that an alleged wrongdoer needs to be provided with more information about the allegations, in order to have the opportunity to respond to the allegations.
Immunity from civil, criminal and disciplinary proceedings
proceedings for having done so.[1] This applies even if there is a prohibition or restriction on disclosing the information (though not where the information being disclosed is protected by legal professional privilege).[1]
An example of this is if your employment agreement states that you cannot disclose confidential information that you receive from a client or customer, or cannot disclose information outside of your workplace. As long as this information is not protected by legal professional privilege, you can disclose it in order to make your protected disclosure. You cannot be disciplined by your organisation, and you cannot be prosecuted or sued because you have disclosed the information.
What if I was involved in the wrongdoing, too? The protections provided by the PDA only apply to retaliation or detrimental effects that you might experience because you made the protected disclosure. This includes immunity from civil and criminal liability for having disclosed what might have been confidential information when you made the protected disclosure. However, this does not mean that you are protected from civil or criminal liability if you were involved in the wrongdoing, too. Action can still be taken against you for any wrongdoing that you committed. |
[1] Section 39.
Protection from retaliatory action or unfavourable treatment
Your employer must not retaliate or threaten to retaliate against you because you have made, or intend to make, a protected disclosure.
If you’re an ‘employee’ within the meaning of the Employment Relations Act 2000,[1] and you’ve experienced or been threatened with retaliatory action by your employer as a result of making a protected disclosure, you may have a personal grievance that:[2]
- you’ve been unjustifiably dismissed;
- your employment or conditions of employment have been affected to your disadvantage; or
- you have been required to retire or resign.
If you think that this has happened and you would like to consider a personal grievance, it is important to get legal advice early on. The Employment Relations Act has time limits within which you must raise your personal grievance with your employer.
If you are an employee or any other type of worker[1] covered by the PDA, and you are treated less favourably than others because you have made or intend to make a protected disclosure,[2] you may also be able access the anti-victimisation protections in section 66 of the Human Rights Act 1993. Unlike for a personal grievance, you do not need to be covered by the Employment Relations Act.
What if I report the information but it does not meet the threshold of ‘serious wrongdoing’? Both employees making a disclosure, and those receiving them, should be aware that a disclosure of information is protected, as long as: · the employee believes on reasonable grounds that there is, or has been, serious wrongdoing · information is disclosed to the employer or an appropriate authority in accordance with the PDA, and · the employee does not disclose in bad faith. This means that, even if an employee is mistaken as to the nature or accuracy of the information (ie the allegations do not amount to serious wrongdoing), the matter should still be treated as a protected disclosure.[3] In these circumstances, an employee is still protected by the confidentiality provisions of the PDA, has immunity from any civil, criminal or disciplinary proceedings, and is protected from retaliatory action, unfavourable treatment and victimisation. |
[1] See #Who is protected?.
[2] Or you have encouraged someone else to make a protected disclosure, or you have given information in support of a protected disclosure.
[3] In accordance with section 11.
How do I make a protected disclosure?
Who can I disclose to?
You can make a protected disclosure about serious wrongdoing in your workplace at any time, to:
- your organisation; and/or
- an appropriate authority.[1]
An appropriate authority includes the head of any public sector organisation, any officer of Parliament (i.e. Ombudsman, Auditor General or Parliamentary Commissioner for the
Environment), or the membership body of a profession with the power to discipline its members.[1]
An appropriate authority does not include a Minister, a member of Parliament or the media.[2] However, you can make a protected disclosure to a Minister, if you believe on reasonable grounds that your organisation or the appropriate authority to whom you made your disclosure has not acted to address the matter.[3]
The PDA lists examples of appropriate authorities and the types of concerns they might consider, in Schedule 2.
If you need help deciding who to make a protected disclosure to, you can contact the Ombudsman for advice.
If you decide to make a disclosure to your organisation, you need to make it:
- in accordance with any internal procedures; or
- to the head or deputy head of your organisation.
Internal procedures for your organisation
If you are considering making a disclosure to your organisation, the first thing to do is find out whether your workplace has internal procedures for making protected disclosures.
Public sector organisations are required to publish internal procedures for receiving and dealing with protected disclosures.[1] Private sector organisations (and non-for profit) may have internal procedures.
If your workplace has internal procedures, you can make your disclosure in accordance with those procedures. You can also make your disclosure to the head or deputy head of your organisation in any case.
Things to look for in the procedures:
- Who should you make the disclosure to?
- How should you make the disclosure? For example, does it have to be in writing, or sent to a particular email address?
- What information do you need to provide?
- What practical assistance and advice is available to you (such as a support person)?
- How will your organisation meet its duty to keep your identity confidential?
[1] Section 29.
What should I disclose?
When making your protected disclosure, you should provide information that you believe demonstrates the serious wrongdoing. Think about what documents or evidence you can provide to support this. Try to keep your disclosure clear and factual. You might be feeling stressed or worried, but try to avoid emotional or speculative language: a disclosure written in factual professional language is likely to be taken more seriously and will be easier to look into.
Include any serious concerns you might have about confidentiality or some other risk to you, and any practical support you think you need. Providing this information can be useful for when your organisation or the appropriate authority (the receiver) is assessing any risks arising from your disclosure, and when planning action to provide you with support.
What happens when I make a protected disclosure?
Within 20 working days[1] of receiving a protected disclosure, your organisation or the appropriate authority (the receiver) should:[2]
- acknowledge receipt of your disclosure;
- consider whether it warrants investigation;
- check with you whether you have made the disclosure to anyone else; and
- deal with the matter by doing one or more of the following:
- investigating the disclosure;
- addressing any serious wrongdoing by acting or recommending action;
- referring the disclosure elsewhere — to an appropriate authority, or back to your organisation (after consulting with you);[3] and/or
- deciding that no action is required.
The receiver should inform you, with reasons, what they have done or are doing to deal with the matter. When it is impracticable to complete all these actions within 20 working days, the receiver should commence the process, inform you of a timeframe within which it expects to deal with the matter and keep you updated.
If the receiver decides that no action is required, it must inform you of that decision, with reasons. Reasons may include that:[4]
- the receiver doesn’t consider you meet the requirements of the PDA to be an employee that has made a protected disclosure about serious wrongdoing;
- the length of time since the alleged wrongdoing makes an investigation impractical or undesirable; or
- the matter is better addressed by other means.
What can I do if I believe my disclosure is not being addressed?
You may believe on reasonable grounds that the receiver of your protected disclosure has not acted as it should or has not dealt with the matter so as to address the serious wrongdoing. If so, you may make a further disclosure to:
- an appropriate authority, including an Ombudsman (which you can do at any time);
- a Minister;[1] or
- the Speaker, for organisations supporting Parliament.[2]
If you are concerned about the way that the receiver is handling your disclosure, you can contact the Ombudsman for advice.
Although you can make a protected disclosure to the Ombudsman if you work in the private sector, the Ombudsman’s options for dealing with the matter may be to refer it to a relevant appropriate authority or Minister.
If your disclosure is about a public sector organisation, there is a range of things that the Ombudsman can do.
[1] Section 14.
[2] A further disclosure may be made to the Speaker if it relates to serious wrongdoing in or by an Officer of Parliament (Auditor-General, Ombudsman, Parliamentary Commissioner for the Environment), the Office of the Clerk of the House of Representatives, or the Parliamentary Service.
Special rules for international relations and intelligence and security information
Some protected disclosures can only be made to particular appropriate authorities (as well as to your workplace).[1]
International relations information
If your disclosure relates to international relations information, the only appropriate authority you can disclose to is an Ombudsman.
If you are not happy with the way your workplace or the Ombudsman is handling your disclosure, you can only make a further disclosure to the Prime Minister or other Minister responsible for foreign affairs and trade.[1]
Intelligence and security information
If your disclosure relates to intelligence and security information, the only appropriate authority you can disclose to is the Inspector-General of Intelligence and Security (IGIS). An Ombudsman cannot provide advice or guidance on disclosures of intelligence and security information. Such advice or guidance should be sought from IGIS.[2]
If you are not happy with the way your workplace or IGIS is handling your disclosure, you can only make a further disclosure to the Prime Minister or other Minister responsible for the intelligence and security agency.
If you wish to make a protected disclosure about serious wrongdoing in or by IGIS, which includes reference to intelligence and security information, you must make that disclosure to the Prime Minister.[3]
Referral of protected disclosures
A protected disclosure may be referred from one appropriate authority to another.[1]
An appropriate authority can also refer a protected disclosure back to your workplace, and your workplace can refer a protected disclosure to an appropriate authority.
The original receiver must consult with you and the intended recipient before referring the disclosure. You will still be protected under the PDA after a referral.
If an appropriate authority refers your disclosure back to your workplace, your workplace must inform the appropriate authority what it is doing to deal with the matter.
[1] Section 16.
Appropriate authorities
You’ll find information about appropriate authorities and their particular areas of responsibility in Schedule 2 of the PDA, and Appendix 1 of this guide. It’s sensible to approach the authority whose responsibilities relate most closely to the subject matter of your concern as they should be best placed to deal with the disclosure.
It’s okay if you do not make your protected disclosure to the right appropriate authority, as disclosures can be referred between appropriate authorities in certain circumstances. If you’re not sure which authority to approach, you can you can contact the Ombudsman for advice.
The Ombudsman is also an appropriate authority, and can receive all protected disclosures (except for those relating to intelligence and security information). Read on to learn more about what the Ombudsman can do under the PDA.
What can the Ombudsman do?
The Ombudsman has a key role to provide information and guidance about protected disclosures. This includes if you are seeking guidance about making a protected disclosure. You can contact the Ombudsman for advice.
As an ‘appropriate authority’ the Ombudsman can receive, refer, and investigate protected disclosures.
The Ombudsman also has a special role when a protected disclosure concerns serious wrongdoing in or by a public sector organisation. In some circumstances, the Ombudsman can take over an investigation or investigate together with another appropriate authority.[1] The Ombudsman can also review and guide investigations carried out by public sector organisations.[2]
Information and guidance
You can talk to the Ombudsman if you have made or are thinking about making a protected disclosure. If you do this, the Ombudsman must provide you with information and guidance about any of the following (as relevant):[3]
- the kinds of disclosures that are protected under the PDA;
- how to make a protected disclosure, and who to disclose it to;
- a summary of the role of each appropriate authority;
- the protections available to you;
- how your disclosure might be referred by the original receiver to an appropriate authority or back to your workplace.
An Ombudsman may also provide you with information and guidance about the circumstances in which you might be able to make an anonymous protected disclosure.[1]
What other guidance can the Ombudsman provide?
There might be other reasons that you need some information or guidance during the process of making a protected disclosure. For example:
- your workplace may have said that your disclosure is not protected;
- your workplace may not have told you what it is doing to respond to your disclosure, or it might have been some time since you were last updated;
- you may have concerns about how the investigation is being conducted;
- you may be worried about your confidentiality being breached; or
- you may be worried about reprisal conduct against you.
If you have any of these concerns, the Ombudsman can provide you with advice and information about what to do.
Receiving protected disclosures
The Ombudsman is also an ‘appropriate authority’ who can receive protected disclosures.
When the Ombudsman receives your disclosure they will consider whether it is protected by the PDA, following the procedures discussed above.
The Ombudsman will consider the following:
- Whether you meet the definition of a ‘discloser’ under the Act.
- Does your disclosure relate to ‘serious wrongdoing’ in your workplace?
- Have you made a disclosure in accordance with the PDA?
If your disclosure is not protected, or if the Ombudsman is not the appropriate authority best placed to deal with the matter, the Ombudsman will provide you with advice and information about how you can pursue your concerns. All the information you have provided to the Ombudsman will stay confidential.
Even if your disclosure is not about serious wrongdoing, it might be a matter that the Ombudsman can consider under their general powers in the Ombudsmen Act 1975, to investigate the acts and decisions of public sector organisations.
If your disclosure is protected, the Ombudsman will consider what the best course of action is to address the matter, and will let you know what is happening.
This could include referring the protected disclosure to another appropriate authority or Minister. This may be because another appropriate authority can more suitably and conveniently consider the disclosure.
How does the Ombudsman protect confidentiality?
The Ombudsman has staff authorised to deal with protected disclosures, including requests for information and guidance, and protected disclosures made to the Ombudsman. The Ombudsman and staff are generally bound by an oath of secrecy, and take additional measures to protect the identity of persons making a protected disclosure.
How to contact the Ombudsman
You can ask us for information and guidance, or contact us for the purpose of making a protected disclosure, through our website, or by email, phone or letter. Your enquiries will be treated in confidence, and dealt with by our specialist staff.
Our contact details are as follows:
The Ombudsman
PO Box 10152
Wellington 6143
Phone: 0800 802 602
Email: [email protected]
Ready to make a protected disclosure?
If you think you are ready to make a disclosure about serious wrongdoing in your workplace, but are wondering whether you need further advice, you can look at our Checklist – Can I Make a Protected Disclosure.
If you’re still unsure or thinking it over, you can contact the Ombudsman for confidential assistance.
Appendix 1. Some key appropriate authorities
Commissioner of Police
The role of the New Zealand Police is to serve the community by reducing the incidence and effects of crime, detecting and apprehending offenders, maintaining law and order and enhancing public safety.
If you think that your disclosure relates to criminal offending, you might want to talk to Police in the first instance.
Controller and Auditor-General
The role of the Controller and Auditor-General is to assist Parliament to strengthen the effectiveness, efficiency and accountability of public sector organisations, including local government organisations.
The Controller and Auditor-General is independent of the Government, and has the power to make inquiries and report to Parliament.
Some of the matters that the Controller and Auditor-General considers include: conflicts of interest relating to financial gain; procurement; fiscal matters; and public sector management.
Director of the Serious Fraud Office (SFO)
The SFO is responsible for complex or serious fraud investigations and prosecutions. This doesn’t include more common dishonesty offences, which are a Police matter.
If your disclosure relates to potentially significant fraudulent activities, you may want to talk to the SFO in the first instance.
Inspector-General of Intelligence and Security
The role of the Inspector-General is to assist the Minister responsible for the New Zealand Security Intelligence Service (NZSIS) and the Government Communications Security Bureau (GCSB) in the oversight and review of those intelligence agencies.
If your disclosure relates to intelligence and security information, the only appropriate authority is the Inspector-General of Intelligence and Security (IGIS), and not the
Ombudsman.[1] An Ombudsman also cannot provide advice or guidance on such matters, and such advice or guidance should be sought from IGIS. [2]
If you wish to make a disclosure that is or includes intelligence and security information, and that disclosure also relates to serious wrongdoing by or within IGIS, you should make that disclosure to the Prime Minister.[3]
Ombudsman
The Ombudsman is an Officer of Parliament with a number of roles, including:
- investigating public sector administration (acts, decisions and omissions made within the public sector);
- investigating and reviewing decisions on official information requests;
- providing advice and guidance on the PDA, and receiving protected disclosures;
- monitoring places of detention (including prisons, court cells, immigration detention facilities, and health and disability places of detention (including mental health facilities, intellectual disability facilities, aged care facilities, and isolation and quarantine facilities));
- monitoring implementation of the United Nations Convention on the Rights of Persons with Disabilities.
The Ombudsman is independent of the Government, and has the power to investigate and report to Parliament.
If your disclosure relates to general concerns about the actions of a central or local government agency, you may wish to contact the Ombudsman.
If you need advice or information about making a protected disclosure, you should contact the Ombudsman.
Parliamentary Commissioner for the Environment
The Parliamentary Commissioner for the Environment has wide-ranging powers to investigate environmental concerns.
If your disclosure relates to environmental concerns, you may wish to contact the Parliamentary Commissioner for the Environment.
Independent Police Conduct Authority (IPCA)
The IPCA’s role is to consider complaints of misconduct or neglect of duty by any member of the Police, or concerning any practice, policy or procedure of the Police affecting the person or body of persons making the complaint in a personal capacity.
If your disclosure is about Police, you should go to IPCA in the first instance.
Solicitor-General
The Solicitor-General is the Chief Executive of the Crown Law Office.
The Crown Law Office provides legal advice and representation services to the government in matters affecting the executive government, particularly in the areas of criminal, public and administrative law.
The Crown Law Office is not an investigatory body. In practice, while the Solicitor-General may be well placed to co-ordinate a response, most protected disclosures will be referred to another more appropriate agency.
Public Service Commission
The Public Service Commission provides leadership through a range of activities including statutory functions and powers under the State Sector Act 1988. These functions include appointing and developing public service chief executives, and advising the government on the performance of public service departments and agencies. The Commissioner sets the minimum standards of integrity and conduct for the public service which are promulgated in a code of conduct for state servants.
If your disclosure is about the integrity and conduct of the public sector, especially Chief Executives, you may wish to contact PSC.
Health and Disability Commissioner
The role of the Health and Disability Commissioner (HDC) is to investigate complaints about persons or bodies that provide health care or disability services. The Commissioner can make public statements and publish reports on any matter affecting the rights of health and disability consumers and can bring matters that impact on the public interest, particularly public safety, to the attention of any appropriate persons.
If your disclosure relates to health care or disability services, you should contact HDC in the first instance.
Other appropriate authorities
In addition to the authorities listed above, every head of a public sector organisation is an appropriate authority. Some of them have the power to investigate.
Private sector bodies having disciplinary powers over members of a profession or calling are also appropriate authorities.
If you’re not sure which authority to approach, you can contact the Ombudsman for information and guidance.