Key legislative developments
Public sector reform
As set out in our previous article, the Public Interest Disclosure Act 2013 (Cth) (PID Act) has long been criticised for its perceived shortcomings, with the Moss Review recommending an extensive list of improvements. With stage 1 completed, stage 2 reforms to the PID Act were progressed through the Public Interest Disclosure and Other Legislation Amendment (Whistleblower Protections) Bill 2025 (“PID Bill”). The PID Bill proposed significant amendments, including:
-
Amendments to the Ombudsman Act 1976 (Cth) to establish a new dedicated whistleblower ombudsman, within the office of the Commonwealth Ombudsman. The whistleblower ombudsman would provide independent oversight of the PID Act to ensure the proper making of disclosures and the appropriate conduct of investigations.
-
Clarification and strengthening of protections, immunities and support for disclosers who act within the framework of the PID Act.
-
Addressing the perceived complexities of the PID Act by ensuring that rights, obligations and procedures are both clear and accessible. For example, the PID Bill proposes to articulate the exact actions that are required in responding to a disclosure and ensuring that disclosures about wrongdoing are investigated under the appropriate framework.
Following public consultation, the Albanese Government indicated in November 2025 that the submissions received have informed its approach in “further developing” the Bill. Finalisation of the stage 2 reforms can be expected in 2026.
Private sector reform
Private sector whistleblower laws are contained in Part 9.4AAA of the Corporations Act 2001 (Cth) (“Corporations Act”), as well as the Taxation Administration Act 1953 (Cth) (“Taxation Act”) and sector-specific legislation. The Department of Treasury is in the process of conducting a statutory review of the Corporations Act and the Taxation Act, which may have implications for the wider reform of the private sector whistleblower framework. Corporations should remain alert to any resulting amendments and be prepared to adapt existing whistleblower systems in response to any legislative changes.
This is a key area for corporates to watch in 2026.
Whistleblower Protection Authority
The concept of a Whistleblower Protection Authority was first announced by the Australian Government in 2023. Its purpose was to create a new, independent statutory authority responsible for providing information, advice and assistance to current and potential whistleblowers, across both public and private sectors.
The Whistleblower Protection Authority Bill 2025 (“WPA Bill”), introduced to Parliament in February 2025, sought to establish a Whistleblower Protection Authority and Commissioner to receive disclosures of wrongdoing and whistleblower mistreatment, and to support whistleblowers, for example, in preparing legally compliant disclosures and reducing their risk of exposure to criminal sanctions.
In August 2025, after reviewing submissions from stakeholders and evidence from Australian whistleblowers with lived experience in the current frameworks, the Legal and Constitutional Affairs Legislation Committee completed its inquiry into the WPA Bill. The Committee recommended that the Senate not pass the WPA Bill, in light of the stage 2 reforms of the PID Act currently underway, and potential reforms to the private sector whistleblowing regime. Noting concerns as to remaining “structural or broader issues in the whistleblower framework”, along with concerns that a separate Whistleblower Protection Authority may result in duplication or conflicts of interest with other regulatory and oversight bodies, it recommended that the evidence received during the inquiry instead inform the Government’s ongoing reviews of the PID Act, Corporations Act and Taxation Act frameworks.
Practical effect of Australia’s whistleblower laws: private sector vs public sector
The scope of whistleblower protections in the public and private sectors was demonstrated through the outcomes delivered in the Boyle and TerraCom proceedings, respectively (see our previous update on these landmark cases here).
Public sector: whistleblowing vs protecting public interest
Richard Boyle’s case exemplifies the “slippery slope” nature of preparing a public interest disclosure, without proper legal guidance or protection.
Boyle was a former ATO employee who made a whistleblower disclosure asserting that his employer had engaged in aggressive and unethical debt recovery tactics. He initially made his disclosure through the ATO’s internal whistleblower channel, after using his iPhone to secretly gather supporting evidence (in the form of photographs and audio recordings at his workplace). While many of Boyle’s assertions of tax office wrongdoing were substantiated, he was charged in connection with his covert recording of conversations with colleagues and taxpayer information. In August 2025, Boyle pleaded guilty to four of those criminal charges, after the CDPP dropped 23 charges earlier in the year. Consequently, for Boyle, this meant that his initial potential maximum sentence of 161 years was reduced to a 12-month good behaviour bond.
When sentencing Boyle, Judge Kudelka of the District Court of South Australia undertook a balancing exercise which acknowledged that “blow[ing] the whistle, is well-recognised to be in the public interest” but also the gravity of the actions taken by Boyle in breaching confidentiality, privacy and protected information laws. Her Honour recognised that “blowing the whistle can be a tough gig” but “the message today needs to be clear that whistleblowing is not a green light for an individual to commit crimes in the name of what they believe is for the greater good”. The Courts must “deter people from engaging in…vigilante justice”, to ensure that any steps taken in support of a whistleblower disclosure must not “undermin[e] the integrity and accountability of the Commonwealth public sector”. Whistleblowers preparing to make a public interest disclosure must therefore tread very carefully and consider applicable laws, regulations and policies to avoid facing criminal liability or other adverse consequences.
Private sector: exposure to corporate and personal liability
In August 2025, ASIC obtained its first enforcement outcomes for contraventions of the Corporations Act whistleblower provisions in its proceedings against ASX-listed coal mining company, TerraCom Limited (“TerraCom”). The proceedings concerned the alleged detriment suffered by Justin Williams, who had made a whistleblower disclosure asserting that TerraCom, his former employer, had falsified its coal quality results.
As regards corporate liability, Judge Jackman of the Federal Court of Australia found TerraCom to have contravened the prohibition against whistleblower victimisation under s 1317AC by causing “detriment to Mr Williams in the form of hurt, humiliation, distress and embarrassment, and damage to reputation”. That detriment arose from the “tone and content” of three market announcements made by Terracom, to the ASX and in the media, in response to Mr Williams’ disclosure and in the aftermath of Terracom’s termination of his employment.
When determining the appropriate penalty to be imposed, the Court turned its mind to the purpose of a civil penalty regime, which is “the promotion of the public interest” and “deterrence, specific and general, of further contraventions”. The Court referred specifically to the need to ensure that a company maintain both a whistleblowing policy compliant with s 1317AI of the Corporations Act and a “corporate culture conductive to compliance”. TerraCom was ordered to pay a penalty of $7.5 million. That sum was reflective of the seriousness of TerraCom’s detrimental conduct, balanced against its admission to contravening various whistleblowing protections under the Act, the fact that TerraCom did have in place a whistleblower policy drafted in compliance with s 1317AI, and had engaged legal advisors to review its policy and prepare training.
As regards director and officer liability, however, the Federal Court dismissed ASIC’s separate claims against TerraCom’s then Chair, Deputy Chair, CEO and CFO. ASIC had alleged breaches of the duty of care and diligence under s 180 of the Corporations Act, as well as the giving of false or misleading information to the ASX in breach of s 1309(2). Judge Jackman concluded that ASIC held a “plainly untenable” position in alleging that TerraCom’s directors and officers had failed to act with the necessary care and diligence in (1) further investigating the findings of a PwC report obtained by TerraCom to investigate the whistleblowing allegations; and (2) authorising the ASX announcements. His Honour also found that TerraCom’s Chair, Mr King, did not breach s 180 by failing to read PwC’s report. This was in circumstances where appropriate mechanisms had already been implemented to manage, review and report on the investigations, such that it was not necessary for Mr King himself to personally read PwC’s findings.
The Court criticised ASIC, stating that the regulator “should have known that the proceedings against the [directors and officers] had no realistic chance of success”. This factor is relevant to subsequent costs awards against ASIC, who did not lodge an appeal in respect of these proceedings.
ASIC’s review of corporate whistleblower programs
In a report published in December 2025 (“Benchmarking Report”), ASIC benchmarked a range of whistleblowing policies and programs across corporate Australia. Companies of differing types, sizes and industries were approached by ASIC to complete a questionnaire – in the first project of its kind to be undertaken by the corporate regulator – to assess their statutory compliance and the extent to which they had adopted ASIC’s previous recommendations.
The Benchmarking Report found that:
-
Of the 134 companies surveyed, there were significant variations in the adoption of good practices amongst the whistleblowing programs.
-
Program maturity varied between industries – the mining sector scored highly, compared with healthcare and social assistance industries.
-
Unlisted companies tended to have less mature practices than other company types.
-
Organisations with more mature practices usually reported higher disclosure rates.
What to expect in 2026
Despite the finalisation of the Boyle and TerraCom proceedings in 2025, providing important new clarification as to the scope of public and private sector whistleblower laws, the law in this area is a work in development.
Looking at the year ahead, the effectiveness of whistleblower protections pursuant to the Corporations Act and the Taxation Act are likely to face scrutiny as part of Treasury’s review. Further, while recommendations for a cross-sector whistleblower protection authority were dismissed, stage 2 reforms of the PID Act and the potential for a whistleblower ombudsman remain in play, which may assist public sector whistleblowers with preparing compliant disclosures.
Without a strong corporate culture of accountability, a whistleblowing reporting system alone may not be enough to reduce a company’s exposure to liability and reputational risk. Companies who contravene the Corporations Act by victimising or causing detriment to a person for making a disclosure may be liable to pay compensation to a whistleblower who suffers loss or damage.
By way of current example, ANZ is involved in a whistleblowing lawsuit commenced by a former trader who alleges that he was unlawfully dismissed for reporting on alleged attempts to manipulate the bank bill swap rate. The case is still before the Courts (NSD719/2020). Meanwhile, proceedings against Super Retail Group (“SRG”) by two former employees were settled in late 2025 for a significant undisclosed sum (without admission of liability). The employees had made disclosures regarding the allegedly “dysfunctional nature” of SRG’s workplace, including as to a relationship between the former CEO and HR Executive, and asserted that SRG had engaged in victimising conduct by publishing an ASX announcement in 2024 regarding the dispute. The whistleblowers’ employment was terminated after they published a media statement in response to SRG’s ASX announcement, alleging that their whistleblowing disclosures (made via the company’s internal reporting system) were not treated appropriately.
Further, ASIC has indicated that it may repeat its benchmarking project. In advance, it has encouraged companies to review the Benchmarking Report to compare their own practices and policies against the findings, consider areas for improvement and tailor the recommendations to their individual circumstances.
Given this evolving landscape, organisations should take stock of their whistleblower frameworks and accountability culture for the year ahead by:
-
Reviewing whistleblower policies and procedures on a periodic basis (approximately every two years) to identify any gaps and ensure thorough compliance with current laws.
-
Reviewing how external and internal investigations into whistleblower disclosures are to be conducted, including how legal professional privilege, confidentiality, privacy and data protection will be maintained. This is essential in ensuring that any allegations involving serious or controversial matters, which may expose an organisation to risk or reputational damage, are addressed in a timely and effective manner.
-
Providing regular training to directors, officers and employees about the organisation’s whistleblower program and the strict statutory obligations and protections that arise, taking particular care regarding prevention of detriment (including through market or customer announcements or other communications following a whistleblower disclosure).