Public Interest Disclosures Regulation 2022

The Regulation relies on two procedural concepts taken from the Act and uses them as its operational anchors: awareness/training duties under s 48 of the Act, and agency annual returns under s 78 of the Act. The Regulation’s language is deliberately narrow; it introduces only a small set of in‑Regulation definitions and otherwise cross‑refers to the Act.

Key defined terms in the Regulation

• public interest disclosure policy: defined in the Regulation to mean the policy described in Part 4 of the Act (s 3). The Regulation does not itself define the content of that policy; the Act contains the substantive definition and procedural obligations for the policy.
• the Act: defined as the Public Interest Disclosures Act 2022 (s 3). The Regulation repeatedly refers to specific Act provisions by section number (for example, s 48(1)(b) and s 78(4)).

Operational concepts imposed by the Regulation

• “Associated with the agency”: the Regulation requires action “as soon as reasonably practicable after a public official becomes associated with the agency” (s 4(1)). The Regulation uses “becomes associated” as the triggering event but does not define the phrase; the Act’s definitions and interpretive provisions govern its scope (s 3 note referencing the Act and the Interpretation Act 1987).
• Training scheduling: the Regulation distinguishes between a non‑fixed standard (“within a reasonable time”) and two fixed backstop deadlines, creating a composite timing rule. For persons listed in the Act’s s 48(2) the Regulation requires training within a reasonable time and no later than the later of two specified dates (s 4(2)(a)-(b)(i)-(ii)). This creates both a flexible standard and a measurable ceiling.
• Refresher intervals: refresher training must be provided at intervals of not more than three years (s 4(3)).
• Annual return content: the Regulation prescribes a list of discrete data points to be reported about each voluntary public interest disclosure (s 5(1)(a)-(h)) and additional aggregate/qualitative information for purported disclosures that are not PIDs (s 5(2)(a)-(c)). The Regulation introduces the reporting distinction between actual voluntary disclosures and “purported” disclosures, and it repeats the Act’s definition of “purported public interest disclosure” in a note to s 5.
• Annual return form and categorisation: voluntary disclosures must be reported in two categories: category 1 , relating to the agency; category 2 , other voluntary disclosures (s 6(1)). Where one agency provides a return for another, separate returns must be provided for each agency (s 6(2)).

What the Regulation does not do

• It does not define the substantive content of the public interest disclosure policy, the substantive scope of “public official”, or the thresholds for “serious wrongdoing” , those definitions are in the Act (s 3 note).
• It does not prescribe sanctioning or enforcement mechanisms; enforcement and offences, if any, lie in the Act rather than the Regulation (no penalty provisions appear in the Regulation text).

Taken together, the Regulation translates high-level Act obligations into concrete administrative steps: how and when to give the policy to newly associated public officials, timing rules for initial and refresher training, and a standardised list and categorisation for data to be supplied in agency annual returns.

This Regulation imposes obligations on agencies and, indirectly, on public officials and persons for whom an agency is responsible for training under the Act. The text identifies the parties affected by reference to the Act’s actors and to the Regulation’s procedural triggers.

Primary addressees

• Agencies: The Regulation repeatedly directs action to “an agency” , agencies must take specified steps when a public official becomes associated with them (s 4(1)); ensure specified training is given (s 4(2)-(3)); and include specified information in annual returns about voluntary public interest disclosures (s 5). The form requirement for annual returns applies to agencies that provide them and requires categorisation and separate returns where one agency is acting for another (s 6(1)-(2)). The Regulation therefore places ongoing administrative and reporting duties squarely on agencies.
• Public officials: The Regulation’s operational trigger is when “a public official becomes associated with the agency” (s 4(1)). The immediate effect is that public officials are beneficiaries of the awareness step (they must be given, directed to, or told how to access the agency’s public interest disclosure policy). Public officials who occupy roles listed in Act s 48(2)(a)-(c) (persons for whom the agency is responsible for training) must receive training within the prescribed timeframes (s 4(2)) and periodic refresher training (s 4(3)). The Regulation relies on the Act for the definition and scope of the term “public official” (s 3 note).
• Persons for whom the agency is responsible for training under the Act: The Regulation imposes timing obligations for training on those persons (s 4(2)-(3)). The Regulation does not itself list which roles are included; it references Act s 48(2) for that list.

Secondary and indirect effects

• Agencies that arrange for another agency to exercise their functions: The Regulation requires that where an agency arranges for another agency to provide an annual return on its behalf, the providing agency must give a separate annual return for each agency to which the arrangement relates (s 6(2)). The s 6 note cites Act s 81(2) as authorising such arrangements.
• Internal agency training officers, compliance teams and records managers: Although not named in the Regulation, these roles will have practical responsibilities to meet the Regulation’s record, delivery and timing requirements for policy circulation, training delivery, refresher scheduling and annual return compilation (s 4; s 5; s 6).

Not directly affected

• The Regulation does not impose duties directly on members of the public, private-sector businesses, or persons who are not “public officials” or not within an agency’s training responsibility. The Regulation contains no express obligations for non‑agency entities. The Regulation’s definition section points readers to the Act and the Interpretation Act 1987 for further definitions that affect scope (s 3 note).

In sum, the Regulation places procedural, training and reporting duties on agencies and creates rights of access to the policy and training obligations for public officials. The boundaries of who counts as an affected public official or agency remain those in the Act (s 3 note), so final scope questions invoke the Act’s definitions.

This Regulation establishes a small number of specific duties for agencies and corresponding practical entitlements for public officials. Those duties are procedural and record‑keeping in nature.

Awareness duties (s 4(1))

• Duty: When a public official becomes associated with an agency, the agency must, as soon as reasonably practicable, do one of three things (s 4(1)):
  • give the public official a copy of the agency’s public interest disclosure policy (s 4(1)(a)); or
  • direct the public official to the page of the agency’s public website or intranet on which the policy is published (s 4(1)(b)); or
  • otherwise give the public official directions for accessing a copy of the policy (s 4(1)(c)).
• Practical right/entitlement for the public official: the public official is entitled to receive a copy of, or direction to, the agency’s policy, or directions for access, promptly after becoming associated with the agency. The Regulation does not prescribe which of the three options the agency must choose; the agency has discretion among the alternatives, but must act “as soon as reasonably practicable”.

Training duties (s 4(2)-(3))

• Duty: For any person for whom the agency is responsible for training under Act s 48(2), the agency must ensure the person is given the training:
  • within a reasonable time after the person becomes associated with the agency (s 4(2)(a)); and
  • no later than the later of two specified dates: (i) six months after commencement of the Act’s s 48; and (ii) three months after the person commences in a role mentioned in Act s 48(2)(a)-(c) (s 4(2)(b)(i)-(ii)).
• Duty: The agency must ensure refresher training occurs at intervals of not more than three years (s 4(3)).
• Rights: Persons covered by Act s 48(2) have an implied right to receive initial training within the deadlines and periodic refresher training at least every three years.

Annual return content duties (s 5(1)-(2))

• Duty: Agencies must include in annual returns prescribed information in relation to each voluntary public interest disclosure received or dealt with during the return period (s 5(1)). The list is specific and includes:
  • how the agency received the disclosure, and the date received (s 5(1)(a));
  • whether the disclosure was a purported public interest disclosure (s 5(1)(b));
  • the nature of the alleged serious wrongdoing (s 5(1)(c));
  • relationship between maker and the public official alleged to have committed wrongdoing, if applicable (s 5(1)(d));
  • whether the wrongdoing involved one public official or more (s 5(1)(e));
  • action taken by the agency to deal with the disclosure, including the date on which the agency ceased to deal with the disclosure (s 5(1)(f));
  • if investigated, a description of the results of the investigation (s 5(1)(g));
  • corrective action taken, proposed or recommended, if applicable (s 5(1)(h)).
• Duty: For purported public interest disclosures that were not in fact PIDs, the agency must also include (s 5(2)(a)-(c)):
  • the number of such disclosures received in the period (s 5(2)(a));
  • the number of such disclosures made by public officials (s 5(2)(b));
  • the reasons the agency did not deal with, or ceased dealing with, each disclosure as a public interest disclosure (s 5(2)(c)).
• Rights: The prescribed data‑points create an expectation of transparency in annual reporting.

Annual return form duties (s 6)

• Duty: The annual return must separate voluntary public interest disclosures into two categories and report separately on each: category 1 , relating to the agency; category 2 , other voluntary disclosures (s 6(1)).
• Duty: If an agency arranges for another agency to provide an annual return on its behalf, the providing agency must give a separate annual return for each agency concerned (s 6(2)). The s 6 note cites the Act (s 81(2)) as authorising such arrangements.

Discretion and limits

• The Regulation leaves content of training, the exact mechanism for providing the policy, and standards of “reasonable time” to agency discretion and the Act’s broader requirements. It prescribes timing maxima and data points rather than processes or sanctions.

Record obligations implied by duties

• The Regulation’s reporting duties create an implicit record‑keeping requirement: agencies need to record receipt dates, investigation outcomes, actions, cessation dates and reasons for declining to treat purported disclosures as PIDs (s 5). The Regulation does not prescribe document formats but requires the information to be included in annual returns.

Interplay with Act rights and duties

• The Regulation relies on the Act for substantive definitions and for the identity of persons owed training (s 3 note). Where the Regulation is silent on rights, the Act determines legal rights and enforcement (s 3 note).

In short, the Regulation imposes concrete duties on agencies about policy circulation, timing of training (including a measurable hard deadline and three‑year refresher cycle), and specific annual reporting content and categorisation. The Regulation grants public officials a right to access policy and training as described, while leaving programmatic detail to agency implementation within the set timing constraints.

The Regulation contains no express penalty provisions, civil remedies, or enforcement mechanisms. It prescribes administrative duties (policy circulation, training timing and content of annual returns) but does not itself specify sanctions for non‑compliance. The text provides only procedural obligations and cross‑references to the Act for broader legal effect.

Direct textual observations

• The Regulation’s sections (1-6) set out name, commencement, definitions, awareness/training rules, annual return content and annual return form. None of those sections includes offence provisions, financial penalties, or administrative enforcement mechanisms.
• The Regulation’s definition section expressly directs readers to the Act and the Interpretation Act 1987 for definitions and other provisions that affect interpretation and application (s 3 note). This suggests that enforcement and sanctioning, if any, are expected to be located in the Act rather than in this Regulation.

Practical consequences

• Agencies cannot locate a statutory fine, criminal offence, or express administrative power to compel compliance within the Regulation itself. Responsibility for monitoring and enforcement must therefore be found in the Act or other relevant legislation. The Regulation’s obligations will therefore be enforced, if at all, by reference to the Act’s enforcement architecture rather than by any measure created in the Regulation.
• Because the Regulation requires specific information to be included in annual returns (s 5; s 6), agencies are likely to face practical scrutiny from whichever body or official receives those returns under the Act. The absence of in‑Regulation penalties means that compliance will be maintained through administrative oversight, reputational incentives, internal governance, and the Act’s own enforcement framework.

Compliance oversight and remedies

• The Regulation itself does not identify the recipient of agency annual returns nor who will audit or review them; the Act contains the statutory scheme for returns and their disposition (see s 3 note). Agencies must therefore consult the Act to identify enforcement points and remedies.
• Where agencies arrange to have another agency prepare returns on their behalf, s 6(2) requires separate returns for each agency, but again there is no enforcement mechanism in the Regulation to remedy failure to supply separate returns; the Act must be consulted for available enforcement or corrective pathways.

In summary, the Regulation prescribes duties but does not set penalties or enforcement mechanics. Agencies must therefore look to the Act for enforcement-related provisions; the Regulation functions as an administrative implementation tool rather than as a sanctions instrument.

The Regulation is an implementation instrument that operates by reference to the Public Interest Disclosures Act 2022 and the Interpretation Act 1987. Its interplay with these instruments, and with internal agency governance, is direct and deliberate.

Primary legal cross-references

• The Regulation defines “the Act” as the Public Interest Disclosures Act 2022 (s 3). Many obligations in the Regulation are explicitly framed as requirements “for the purposes of the Act” (for example, the awareness and training provisions state “For the purposes of the Act, section 48(1)(b)” in the heading and proceed to prescribe actions) (s 4 heading and text). The annual return provisions are similarly framed “,the Act, s 78(4)” (s 5 title; s 6 title).
• The s 3 note directs readers to the Act and the Interpretation Act 1987 for definitions and other provisions that affect interpretation and application (s 3 note). Where the Regulation uses terms not fully defined in the Regulation itself (for example, agency, public official, serious wrongdoing, voluntary public interest disclosure), their legal meaning comes from the Act and the Interpretation Act.

Operational interactions with Act provisions

• Training and awareness obligations in the Regulation operationalise the Act’s s 48 duty and the Regulation references the relevant Act subsections (s 4(1) references Act s 48(1)(b); s 4(2) references Act s 48(2)). The Regulation imposes timing requirements that must be read alongside Act s 48, including who is captured by Act s 48(2) and the nature of the training that must be provided.
• Annual returns: the Regulation gives content and form for the annual return obligations under Act s 78(4) (s 5 and s 6). The Regulation therefore supplements Act s 78(4) by prescribing the data fields and categorisation framework that an agency’s return must contain.
• Agency arrangements: s 6(2) contemplates inter‑agency arrangements and cites Act s 81(2) in the s 6 note as the statutory authorisation by which one agency may exercise another’s functions. The Regulation therefore requires separate returns where an agency provides a return on behalf of another, consistent with the Act’s delegation/arrangement rules.

Interaction with administrative law and internal governance

• The Regulation’s requirements sit alongside agencies’ internal governance, records management, privacy obligations and information‑management regimes. Because the Regulation prescribes specific data to be included in annual returns (s 5), agencies must reconcile those reporting duties with privacy obligations and information security. The Regulation does not itself reconcile or prioritise competing statutory duties (for example, secrecy or privacy statutes); agencies must rely on the Act and other applicable laws (including the Interpretation Act where relevant) to resolve conflicts (s 3 note).
• The Regulation’s “reasonable time” formulations (s 4(2)(a)) will interact with administrative law principles of reasonableness and procedural fairness where disputes arise about timings but the Regulation does not itself define those standards. The Act’s interpretive provisions and the Interpretation Act 1987 will therefore be relevant.

Gaps and delegation

• The Regulation delegates substantive definitions and enforcement to the Act. It supplies specific timing and reporting mechanics but leaves substantive thresholds to the Act. For any action that affects rights, remedies or sanctions, the Act is the primary legal instrument (s 3 note).

In short, the Regulation is a targeted subordinate instrument whose primary legal effect is to operationalise and detail certain procedural duties found in the Public Interest Disclosures Act 2022, with definitional and enforcement issues left to the Act and interpretive guidance left to the Interpretation Act 1987.

The Regulation text supplied records only its initial naming and commencement linkage; it contains no in‑text record of amendments, repeal or variation. The Regulation’s own s 1-2 state the instrument’s name and commencement linkage and a Note identifies the context for commencement.

Textual facts

• Section 1 gives the instrument’s formal name: “This Regulation is the Public Interest Disclosures Regulation 2022” (s 1).
• Section 2 states commencement: the Regulation “commences on the day on which the Public Interest Disclosures Act 2022, Schedule 3 commences” (s 2). The provision includes a note: “See the Act, Schedule 1, section 6.”
• No further sections amend, repeal or vary the Regulation or refer to prior versions. The Regulation as provided contains six operative clauses and explanatory notes; none record later modification.

Implications for lawyers or compliance officers

• The Regulation’s text as provided appears to be the enacted primary version; any amendment history, if it exists, would be recorded in public law databases, government gazettes, or subsequent amending instruments. The Regulation itself contains no chronicle of amendments.
• Because the Regulation’s commencement is tied to the Act (s 2), any change in the Act’s Schedule 3 commencement would affect when the Regulation takes effect. The internal note referring to the Act, Schedule 1, s 6 indicates that commencement is controlled by the Act’s own commencement machinery.

What to check in practice

• Practitioners and agencies should, as a standard step, verify the currency of the Regulation in official legislative databases and the Government Gazette for any amending instruments or revocations. The supplied text contains no amendment entries and no transitional or saving provisions; absent external confirmation, the instrument here is the original operative text.
• Any administrative guidance, practice notes or agency circulars that interpret the Regulation will be external to the Regulation and not recorded in this instrument. Such guidance may effectively modify agency behaviour without amending the Regulation itself.

In sum, the Regulation’s in‑text amendment history is silent; the instrument as supplied records its name and commencement relationship to the Act and contains no subsequent amendment entries.

The Regulation contains no reference to litigation, and the text does not name any cases or judicial decisions. It is an administrative subordinate instrument prescribing procedural requirements; the instrument as supplied does not record any judicial consideration, declaratory relief, or contested proceedings concerning its validity or application.

Textual facts

• No section of the Regulation cites or summarises cases, court decisions, tribunal determinations or precedent.
• No transitional or saving provision references litigation outcomes or court orders.

What follows for practitioners

• Because the Regulation is procedural and prescriptive about training and reporting, litigation stemming from it would likely concern: (a) whether an agency complied with the timing obligations (s 4); (b) disputes about whether a disclosure was treated as a public interest disclosure and the adequacy of reasons for not treating it as such (s 5(2)(c)); (c) whether annual returns complied with the content and categorisation requirements (s 5; s 6); or (d) judicial review of administrative decisions made under the Act that were informed by the Regulation’s implementation steps. None of these legal avenues are referenced in the Regulation text itself.
• Practitioners seeking precedent on enforcement or interpretation of the Regulation must therefore turn to the Act’s litigation history and to judicial treatment of the Act’s provisions. The Regulation’s s 3 note directs readers to the Act for definitions and other provisions that affect interpretation and application.

Practical next steps to locate litigation

• Check the Public Interest Disclosures Act 2022 for any cases that interpret s 48 or s 78 (the Act provisions the Regulation supplements). If courts have considered the Act’s obligations, their reasoning may bear on ambiguous terms used by the Regulation (for example, “reasonable time”, “associated with”, or the scope of persons in s 48(2) of the Act).
• Search administrative law and employment/jurisdiction databases for judicial review decisions relating to public interest disclosure policies and agency reporting obligations. The Regulation itself does not provide a litigation map.

In short, this Regulation contains no litigation history or citations; any judicial development affecting its operation will appear in case law addressing the Act or the administrative decisions taken under it.

The Regulation is compact but contains several features that create implementation pitfalls or interpretive ambiguities for agencies. These are practical “gotchas” anchored in the Regulation’s text.

“Associated with the agency” is the trigger but not defined here (s 4(1))

• The Regulation requires action “as soon as reasonably practicable after a public official becomes associated with the agency” (s 4(1)). The phrase “becomes associated” is not defined in the Regulation; the Act and the Interpretation Act 1987 control that definition (s 3 note). Agencies that treat the phrase narrowly (for example, excluding casual contractors or volunteers) risk later challenge if the Act’s definition is broader.

Three alternative methods to give policy, one must be chosen (s 4(1)(a)-(c))

• The agency must do one of: give a copy; direct to web/intranet page; or otherwise give directions for accessing the policy. The Regulation leaves agencies free to choose, but “as soon as reasonably practicable” adds an open standard. Risk arises where agencies rely solely on a web link without evidence the individual received or could access the web/intranet (for example where intranet access is restricted). The Regulation does not prescribe proof of delivery or the medium for “giving” a copy.

Two‑tiered timing rule for initial training creates a “later of” backstop (s 4(2)(b))

• Agencies must provide training “within a reasonable time” and no later than the later of (i) six months after commencement of the Act’s s 48; and (ii) three months after the person commences in a relevant role (s 4(2)(a)-(b)(i)-(ii)). The effect is that for persons who begin after commencement, the 3‑month ceiling likely governs; for pre‑existing employees the 6‑month post‑commencement ceiling applies. Agencies that do not map their training schedules against both deadlines may inadvertently miss the later deadline.

“Reasonable time” is open‑ended (s 4(2)(a))

• The Regulation pairs “within a reasonable time” with hard ceilings. “Reasonable time” is an imprecise administrative standard; absence of guidance on factors that determine reasonableness exposes agencies to differing interpretations. The Act is the place to seek more guidance, but the Regulation itself leaves room for dispute.

Refresher training interval is not more than three years , counting and scheduling needed (s 4(3))

• The Regulation requires refresher training at intervals of not more than three years. Agencies must establish systems to calculate the three‑year anniversary for each person, to record training dates and to enforce attendance. Failure to maintain auditable training records creates reporting and governance exposure.

Annual return reporting is data‑intensive and requires qualitative descriptions (s 5)

• The Regulation requires agencies to report, for each voluntary public interest disclosure, a number of discrete items including how the disclosure was received, dates, the nature of the alleged wrongdoing, the relationship between maker and subject (if applicable), the number of officials involved, actions taken, investigation outcomes, corrective action, and the date on which the agency ceased to deal with the disclosure (s 5(1)(a)-(h)). These fields demand accurate record collection and retention. Agencies used to aggregate reporting may need to redesign records systems to capture per‑disclosure details.
• For purported disclosures that are not PIDs, the agency must report the number of such disclosures, the number made by public officials, and reasons for not treating them as PIDs (s 5(2)(a)-(c)). Giving reasons for not treating a disclosure as a PID requires contemporaneous, documented decision‑making. Vague or generic reasons may be scrutinised by oversight bodies or FOI requests.

Categorisation and separate returns (s 6)

• The Regulation requires separate reporting on category 1 disclosures (relating to the agency) and category 2 (other disclosures) (s 6(1)). Agencies must adopt consistent categorisation rules and record them. Where one agency submits returns on behalf of another, the providing agency must produce separate returns for each agency (s 6(2)). That requirement can complicate centralised reporting models or shared services arrangements.

No enforcement or penalty detail in the Regulation

• Because the Regulation contains no enforcement or penalty provisions, agencies might underestimate the seriousness of compliance. The absence of in‑Regulation penalties does not mean breaches are immaterial; the Act likely has enforcement provisions. Agencies should not treat the Regulation’s silence as a lack of risk.

Recordkeeping and evidentiary risks

• Several reporting fields require dates and descriptive conclusions (for example, the date a disclosure was received and the date the agency ceased dealing with it) (s 5(1)(a), (f)). Failure to record these dates contemporaneously may make it difficult to complete the annual return accurately or to justify decisions to third parties.

Overlap with other obligations and privacy considerations

• The Regulation’s reporting requirements may intersect with privacy, confidentiality, employment and criminal disclosure constraints. The Regulation does not resolve such conflicts; agencies must apply the Act and other laws (s 3 note) when preparing returns. Agencies that publish annual summaries must ensure they anonymise or otherwise handle personal information appropriately.

In sum, the principal operational risks arise from ambiguous wording (for example, “associated with”, “reasonable time”), hard deadlines that require scheduling discipline (training timelines, three‑year refresher), recordkeeping demands for detailed per‑disclosure reporting, categorisation requirements, and the need to reconcile reporting with privacy and other statutory duties. These are implementation challenges embedded in the Regulation’s simple wording.

The Regulation prescribes discrete, auditable actions. Below is a practical compliance checklist agencies can adopt, aligned to the precise Regulation text, together with recommended record and governance steps to meet the Regulation’s obligations.

1. Confirm commencement and scope

• Check whether Schedule 3 of the Act has commenced, because the Regulation commences on the same day (s 2). Record the commencement date in compliance diaries and link training and reporting schedules to that date (s 2).

2. Identify affected personnel

• Identify persons for whom the agency is responsible for training under Act s 48(2) (s 4(2)). The Regulation does not list those positions; use the Act to determine who must be trained. Maintain an auditable list of names, roles, start dates and training status.

3. Onboarding: deliver the public interest disclosure policy promptly

• For every public official who “becomes associated with the agency”, take one of the three steps in s 4(1) “as soon as reasonably practicable”:
  • physically give a copy of the agency’s public interest disclosure policy (s 4(1)(a)); or
  • direct the person to the relevant public website or intranet page where the policy appears (s 4(1)(b)); or
  • provide directions for accessing a copy (s 4(1)(c)).
• Best practice: choose a primary method (for example, electronic distribution via LMS plus intranet link) and a backup (printed copy) where necessary. Keep delivery evidence: email logs, LMS completion records, intranet view logs, or signed acknowledgement of receipt.

4. Training scheduling and delivery

• Map training deadlines against the Regulation’s composite timing rules (s 4(2)):
  • Ensure initial training is given “within a reasonable time” of association and no later than the later of (i) six months after commencement of Act s 48 and (ii) three months after the person commences in the role identified in Act s 48(2)(a)-(c) (s 4(2)(a)-(b)).
• Implement a training calendar that:
  • assigns an initial training date for each covered person, ensures courses are available within applicable ceilings, and documents reasons if training is delayed.
  • enforces refresher training at intervals not greater than three years (s 4(3)).
• Keep audit trails: attendance records, training modules delivered, materials used, dates of completion, assessment results if any, and any exemptions or deferrals with justification.

5. Records and evidence to support annual returns

• The Regulation requires specific information for each voluntary public interest disclosure (s 5(1)(a)-(h)). For every disclosure, record:
  • how it was received and the received date (s 5(1)(a));
  • whether it was a purported PID (s 5(1)(b)); if not in fact a PID, record the reason(s) why (s 5(2)(c));
  • a description of the nature of the alleged serious wrongdoing (s 5(1)(c));
  • relationship between maker and alleged wrongdoer where applicable (s 5(1)(d));
  • how many public officials were implicated (one or more) (s 5(1)(e));
  • action taken, and the date the agency ceased to deal with the disclosure (s 5(1)(f));
  • investigation outcomes if investigated (s 5(1)(g));
  • corrective actions taken, proposed or recommended (s 5(1)(h)).
• For purported disclosures not deemed PIDs, maintain an aggregate count of such disclosures and the subset made by public officials (s 5(2)(a)-(b)), and contemporaneous written decisions detailing reasons for not treating them as PIDs (s 5(2)(c)).

6. Annual return structure and submission protocol

• Ensure annual returns separately report category 1 (relating to the agency) and category 2 (other voluntary disclosures) and keep those categories consistent year to year (s 6(1)).
• If your agency uses a shared service or another agency to prepare the return, ensure separate annual returns are produced for each agency served (s 6(2)), and document the arrangement (Act s 81(2) authorises such arrangements; s 6 note).
• Implement a template or database that captures every s 5 item at the time a disclosure is received so aggregation into category 1/2 reports is straightforward.

7. Privacy, confidentiality and record retention

• Reconcile the Regulation’s reporting obligations with privacy and confidentiality duties. Anonymise or de‑identify personal data where the Act and other law permit. While the Regulation mandates content, it does not specify public disclosure; seek legal advice if publication of return content is contemplated.

8. Governance, audit and oversight

• Nominate a compliance owner for public interest disclosure training and reporting (for example, head of HR, head of integrity, or a central compliance unit).
• Establish an internal audit schedule to verify: (a) that new public officials were given the policy in an auditable manner (s 4(1)); (b) initial and refresher training was delivered within the Regulation’s timing constraints (s 4(2)-(3)); and (c) annual returns include every required data field (s 5; s 6).
• Keep minutes or evidence of governance decisions about classification rules for category 1 vs category 2 and about reasons recorded under s 5(2)(c).

9. Document templates and SOPs

• Draft standard operating procedures that instruct staff how to: receive and log disclosures, determine whether a disclosure is a PID or a purported PID, record investigation outcomes, record dates for cessation of dealing, and collect relationship information about makers and subjects (s 5).
• Create a standard annual return template that mirrors the s 5 list and the s 6 categorisation. The template should generate both per‑disclosure entries and aggregate summaries for purported PIDs as required by s 5(2).

10. Training content and quality

• While the Regulation does not prescribe training content, ensure training covers at least: how to access the agency’s public interest disclosure policy (s 4(1)); what constitutes a voluntary public interest disclosure and a purported PID; the agency’s internal handling procedures; recordkeeping requirements necessary to support annual returns (s 5); and reporting timelines including refresher obligations (s 4(3)).
• Maintain training materials and assessments as evidence of compliance with s 4(2) and s 4(3).

Following this checklist will align agency practice with the Regulation’s specific obligations as set out in sections 2-6. Because the Regulation cross‑refers to the Act for definitions and other legal modalities (s 3 note), agencies should run the compliance programme alongside a review of the relevant Act provisions.