Australia's Whistleblower Protection Authority Bill 2025: what boards and executives should do now

The short version

The Whistleblower Protection Authority Bill 2025 would create an independent national body to support whistleblowers and deal with mistreatment. It is a private senators' bill, it is before the Senate, and it is not law ¹. A Senate committee majority recommended in August 2025 that the Senate not pass it, while dissenting senators supported reform ². None of that changes what Australian companies must do today.

What does apply today is Part 9.4AAA of the Corporations Act. Its protections reach all Australian companies, and its formal policy requirement applies to a narrower group ^{4 6}. For boards and executives, the bill is a useful prompt to check that the existing framework actually works in practice — not a reason to wait.

What the bill proposes

According to the bill and its explanatory memorandum, the bill would establish a Whistleblower Protection Authority led by a Commissioner ^{1 3}. As proposed, the Authority would:

• receive disclosures and refer them to, or facilitate their investigation by, appropriate agencies;
• provide advice and support to whistleblowers and potential whistleblowers;
• monitor how disclosures are handled, investigate detrimental action and support court proceedings; and
• operate with an advisory council and oversight by a parliamentary joint committee.

The explanatory memorandum describes a remit across Commonwealth whistleblower laws, including the corporate, tax and public interest disclosure regimes ³. It is framed as a body that works across those existing laws — not a new comprehensive code of employer duties.

One detail is often misread. The bill's referral duty in clause 18 is aimed at public officials. It is not a blanket new duty on private-company directors ³. Clauses 10, 21 and 22 deal with referral, monitoring, investigating detrimental action and court support. The proposal does not create an in-force implementation deadline or require companies to purchase a particular reporting service. Any eventual obligations, investigatory powers and penalties would need to be assessed against the final enacted text and its commencement provisions.

Where it stands in Parliament

The bill was introduced on 11 February 2025, lapsed at the end of the previous Parliament on 21 July 2025 and was restored to the Senate Notice Paper on 23 July 2025 ¹. At our check on 12 October 2026 it was listed as before the Senate, with no passage and no assent ¹.

The Senate Legal and Constitutional Affairs Legislation Committee reported on 29 August 2025. The majority recommended that evidence from the inquiry be considered in reviews of the public interest disclosure, corporate and tax whistleblower regimes, and that the Senate not pass the bill ². Evidence before the committee raised concerns about unclear private-sector scope, overlap with existing regulators, potentially conflicting functions and the intrusiveness of proposed powers ². Senators Pocock and Shoebridge lodged dissenting reports supporting reform ².

A committee recommendation is not a decision of Parliament. The bill has not been rejected by the Senate; it remains before it. We do not forecast whether it will be enacted, amended or left to lapse.

What already applies to Australian companies

Whatever happens to the bill, the Corporations Act already gives whistleblowers rights and gives companies obligations.

Protections apply to every company

All Australian companies are subject to the whistleblower protections in Part 9.4AAA ⁴. Those protections cover confidentiality of identity and protection from detriment. They apply even where the company is not required to have a formal policy ⁷.

The formal policy duty is narrower

A formal whistleblower policy is required for public companies, large proprietary companies and proprietary companies that are trustees of registrable superannuation entities ⁶. ASIC relief exempts certain small not-for-profit companies limited by guarantee with annual revenue under $1 million from the policy requirement — but not from the confidentiality and detriment protections ⁷.

Reports do not have to arrive through the hotline

A qualifying disclosure can be made to an eligible recipient informally, outside the official channel ⁴. The discloser needs reasonable grounds to suspect misconduct — they do not need to prove it — and can remain anonymous ⁴. Personal work-related grievances are generally excluded, but a matter that mixes a grievance with misconduct, systemic issues or retaliation may still be protected ⁴.

Whistleblowers do not have to report internally first. Disclosures made directly to ASIC or APRA can qualify for protection ⁵. An internal channel must never be presented as a gate in front of the regulators.

Why this lands on boards, directors and executives

Officers and senior managers are eligible recipients under the law ⁴. That means a director or executive who hears a concern over coffee may be holding a protected disclosure, and personally carries confidentiality and non-detriment obligations that cannot be outsourced ⁴.

CEOs, CFOs, COOs and CROs will often be senior managers, but this depends on what they actually do, not only on the title ⁴. There is no automatic liability by job title. Regulatory enforcement against a company and personal exposure for an individual are different questions, and each depends on the facts.

Confidentiality is precise, not a slogan

A discloser's identity, or information likely to identify them, cannot be disclosed except on lawful grounds — for example with consent, to ASIC, APRA or the AFP, or to a lawyer for advice about the protections ^{4 5}. There is a separate investigation exception: information may be shared where reasonably necessary to investigate, but that does not cover the person's identity itself, and all reasonable steps must be taken to reduce the risk of identification ⁴.

In practice, that rules out two common shortcuts. 'We guarantee anonymity' overstates what any organisation can promise. And 'the board needs to know' does not authorise circulating a disclosure. A director who receives a concern should not forward it to the full board or the CEO by default. Board reporting should be de-identified and limited to people who need to know.

Fairness on both sides

• Treat people named in a disclosure fairly and give them a proper opportunity to respond.
• Assess retaliation risk early and plan to manage it.
• Route conflicts around anyone implicated, including senior executives and directors.
• Preserve evidence and control who can access case records.
• Keep employment decisions about the discloser separate and documented.
• Get independent legal advice where needed. Using an external provider does not make communications privileged automatically.

Actions by role

These are practical governance steps under current law. They do not depend on the bill passing.

A 30/60/90 day readiness plan

This is our recommended pacing for a well-governed review, not a statutory timetable. It does not defer existing obligations: urgent safety concerns, retaliation risks, confidentiality breaches and applicable legal reporting deadlines must be addressed immediately or within their required timeframes.

1. 30
   First 30 days

   Know your position

   • Confirm whether a formal policy is required and locate the current version.
   • List eligible recipients: officers, senior managers, auditors, actuaries and any authorised third party.
   • Brief the board on current obligations and the bill's status, labelled clearly as a proposal.
2. 60
   Days 31 to 60

   Close the gaps

   • Update the policy against RG 270, including regulator routes and the fact that internal reporting is not required first.
   • Set confidentiality, escalation and conflict procedures, and a retaliation risk assessment step.
   • Train eligible recipients and the people likely to receive informal concerns.
3. 90
   Days 61 to 90

   Prove it works

   • Test the channel end to end, including anonymous follow-up.
   • Agree the de-identified board reporting format and the review cycle.
   • Record decisions and the evidence behind them so you can show what was done and why.
4. Recommendation only. Not a statutory timeframe.

How WBS International can support you

Whistleblowing.services (WBS International) provides whistleblowing services commercially. We are not a statutory authority, and no law requires you to use us or any other vendor. Our services support your compliance programme; they do not guarantee full compliance and do not replace legal advice.

Depending on the scope we agree with you, we can provide:

• a scoped needs assessment of your current arrangements;
• appointment as an authorised recipient, which must be formally set out in your policy and onboarding — it is not automatic;
• anonymous and confidential reporting through our existing channels, with anonymous two-way messaging;
• restricted case handling with access limited to need-to-know users;
• triage and escalation routes designed to bypass conflicted people;
• investigator support within the agreed scope;
• training for report receivers;
• de-identified reporting for boards; and
• periodic programme review.

Service availability and scope are confirmed in your contract. An internal channel never prevents anyone from reporting to ASIC, APRA or another regulator ⁵.