Corporate Whistleblower Protections in Australia: Corporations Act and Tax Regime

Private sector whistleblowers in Australia are protected under Part 9.4AAA of the Corporations Act 2001 (Cth), while a separate and much less severe regime under Part IVD of the Taxation Administration Act 1953 (Cth) covers tax-specific disclosures.

This page covers whistleblower protection for the private sector under Part 9.4AAA of the Corporations Act 2001 (Cth) and the parallel regime under Part IVD of the Taxation Administration Act 1953 (Cth), current as at 18 August 2026. It does not cover Commonwealth public sector disclosures or state and territory public sector disclosures; see the whistleblower protection overview for which regime applies to you.

Who Is Protected: Broader Than "Employees"

Part 9.4AAA applies to a "regulated entity," a term defined in s1317AAB to mean a company, a corporation the Constitution's trade-and-commerce power reaches, an authorised deposit-taking institution or its subsidiary, a general insurer or life company or their subsidiaries, a superannuation entity or its trustee, or a prescribed entity. An individual is an "eligible whistleblower" in relation to a regulated entity under s1317AAA if they are, or were, an officer, an employee, an individual who supplies goods or services to the entity whether paid or unpaid, an employee of such a supplier, an associate of the entity, a trustee, custodian or investment manager of a superannuation-entity regulated entity along with their own officers and employees, or a relative or dependant of anyone in those categories. This list is deliberately wider than "employee," which is one reason the Corporations Act regime differs from an employment-law protection in the ordinary sense.

What Counts as a Disclosure

A disclosure qualifies for protection under s1317AA when the discloser has reasonable grounds to suspect misconduct or an improper state of affairs involving the regulated entity, made to ASIC, APRA, a prescribed Commonwealth authority, or an eligible recipient within the entity, such as an officer, senior manager, auditor, or actuary. A more specific, non-exhaustive category also qualifies protection where the discloser has reasonable grounds to suspect conduct that contravenes the Corporations Act or one of several other listed financial-services statutes, is an offence punishable by 12 months or more imprisonment, represents a danger to the public or the financial system, or is prescribed by regulation. A disclosure made to a legal practitioner for the purpose of obtaining advice about this Part is separately protected regardless of subject matter. There is no requirement for a discloser to identify themselves for the disclosure to qualify.

The Personal Grievance Carve-Out

Not every complaint about mistreatment at work is a protected whistleblower disclosure. Section 1317AADA excludes a disclosure to the extent it concerns a personal work-related grievance of the discloser, meaning a grievance about their own employment with implications mainly for them personally, such as interpersonal conflict with a colleague, or a decision about engagement, transfer, promotion, discipline, suspension or termination. That exclusion does not apply, and the disclosure remains protected, if it also alleges a contravention of the separate victimisation offence in s1317AC, or if the grievance is disclosed to a legal practitioner for advice. This carve-out is a genuine and useful distinction: a person unhappy with how their own performance review or promotion decision went has not, on that basis alone, made a whistleblower disclosure.

Going Public: The 90-Day Rule Applies to One Route, Not Both

Section 1317AAD allows a discloser to escalate to a member of parliament or a journalist, but only through one of two distinct routes, with different conditions. A public interest disclosure requires that the discloser previously made a qualifying disclosure to ASIC, APRA or a prescribed body; that at least 90 days have passed since that disclosure; that the discloser has no reasonable grounds to believe action is being, or has been, taken to address the matter; that the discloser reasonably believes a further disclosure would be in the public interest; and that the discloser first gives the original recipient written notice of the intent to make a public interest disclosure. An emergency disclosure has no 90-day waiting period at all, but instead requires a reasonable belief that the information concerns a substantial and imminent danger to the health or safety of one or more persons, or to the natural environment, plus the same written-notice step. A description of "the 90-day rule" that does not distinguish these two routes overstates how long a discloser facing an imminent danger has to wait.

Protections: Immunity, No Detriment, and Identity Confidentiality

A person who makes a disclosure that qualifies for protection is not subject to civil, criminal or administrative liability, including disciplinary action, for making it, under s1317AB. No contractual or other remedy can be enforced against them on the basis of the disclosure, qualified privilege attaches, and a contract cannot be terminated on the basis that making the disclosure breached it. Section 1317AC separately prohibits victimisation: causing detriment to a person, or threatening to cause detriment, because of a belief or suspicion that they made or may make a protected disclosure, is both an offence and a civil penalty contravention, and an officer or employee personally involved in a company's contravention is separately liable. Section 1317AAE makes it a separate offence and civil penalty contravention to disclose a whistleblower's identity, or information likely to reveal it, without authorisation, subject to carve-outs for disclosure to ASIC, APRA, the AFP, a legal practitioner, a person the discloser consents to, or a person or body prescribed by regulation.

Compensation and Remedies

Section 1317AD sets out when a court may order a remedy: where a person engaged in, or threatened, detrimental conduct because they believed or suspected someone made or may make a protected disclosure, and that belief was the reason or a reason for the conduct. Where a court finds that contravention, s1317AE allows orders including compensation for loss, damage or injury, an injunction, an apology, reinstatement where the detriment was termination of employment, and exemplary damages. Where the detriment involved a person's employment, compensation may be ordered jointly or severally against the individual responsible and the employer. The Corporations Act's own text does not set a dollar cap on this compensation. A claimant is generally not liable for the other side's legal costs unless the proceedings were vexatious or without reasonable cause.

Civil Penalties and the Smaller Criminal Fallback

Confidentiality breaches under s1317AAE and victimisation contraventions under s1317AC are both civil penalty provisions under the same general formula the Corporations Act uses elsewhere, set out in s1317G. For an individual, the penalty is the greater of 5,000 penalty units or three times the benefit derived or detriment avoided because of the contravention. For a body corporate, it is the greatest of 50,000 penalty units, three times the benefit or detriment, or 10 percent of the body corporate's annual turnover, with that turnover-based figure capped at 2.5 million penalty units. At the current Commonwealth penalty unit value of $364, set by the Crimes (Amount of a Penalty Unit) Instrument 2026 for offences and contraventions on or after 1 July 2026, this works out to $1,820,000 for an individual, and for a body corporate, $18,200,000, or a turnover-based figure capped at $910,000,000.

These same provisions are also criminal offences. Because neither section has a specific entry in the Corporations Act's Schedule 3 penalties table, the default strict-liability fine applies instead: 20 penalty units ($7,280) for an individual and 200 penalty units ($72,800) for a body corporate. This criminal fallback is a substantially smaller exposure than the civil penalty route above, and ASIC's enforcement of these provisions is generally understood to proceed through the civil penalty mechanism rather than this criminal fallback, though that pattern reflects how ASIC's enforcement approach is generally described rather than a count of individual prosecutions.

The Parallel Tax Regime: Taxation Administration Act Part IVD

A separate regime under Part IVD of the Taxation Administration Act 1953 (Cth) protects disclosures specifically about an entity's tax affairs. Under s14ZZT, a qualifying disclosure can be made to the Commissioner of Taxation, the Tax Practitioners Board, an eligible recipient, or a legal practitioner. It also uniquely protects a disclosure made to a prescribed member-based entity, or to a treating medical practitioner or psychologist for the discloser's own care, neither of which has an equivalent under the Corporations Act. The eligible-whistleblower list under s14ZZU mirrors the Corporations Act's list closely, but is narrower on family, protecting only a spouse or child rather than any relative.

Part IVD has no public interest or emergency disclosure route at all, so a tax whistleblower has no textual basis for escalating to a member of parliament or a journalist under this Part. The penalty structure is also materially different: confidentiality breaches under s14ZZW and victimisation under s14ZZY are straight criminal offences with the fine stated directly in the section, not civil penalty provisions. Confidentiality breach carries up to 6 months imprisonment or 60 penalty units for an individual, which is $21,840 at the current unit; applying the Crimes Act's standard five-times default for a body corporate, since Part IVD does not state a separate corporate figure, that becomes roughly $109,200. Victimisation carries up to 2 years imprisonment or 240 penalty units for an individual, $87,360 at the current unit, and roughly $436,800 for a body corporate on the same five-times basis. Even though the two regimes share a similar structure, protected categories, and even the same compensation mechanism, they are not parallel in severity: the tax regime's maximum body-corporate exposure is dramatically smaller than the Corporations Act's civil-penalty exposure for equivalent conduct.

Whistleblower Policies Companies Must Have

Section 1317AI requires a public company to have a whistleblower policy and make it available to officers and employees. The same obligation applies to a proprietary company once it has qualified as a "large proprietary company" for a financial year, with the obligation beginning on each day at least 6 months after the end of that first qualifying year, and to a proprietary-company trustee of a registrable superannuation entity. Under s45A, a proprietary company is "large" if it meets at least two of: consolidated revenue of $25 million or more, consolidated gross assets of $12.5 million or more, or 50 or more employees. The required policy must cover the protections available, who a disclosure may be made to and how, how the company will investigate a disclosure and support the discloser, and how it will treat a person named in a disclosure fairly.

ASIC administers this regime and publishes RG 270, "Whistleblower policies," as its current guidance on what a compliant policy must contain, issued 13 November 2019 with no reissue found as at the research date for this page. ASIC also publishes shorter information sheets aimed at whistleblowers themselves (INFO 238), how it handles reports (INFO 239), and obligations for auditors (INFO 246) and officers (INFO 247) who receive a report.

If You Work for the Commonwealth Instead

This page covers the private sector only. A Commonwealth public official, including some Commonwealth contractors, is protected under a different Act with its own disclosure process, oversight body and reprisal offence. See the Commonwealth Public Interest Disclosure Act page for that regime, and the whistleblower protection overview for a comparison of all three regimes, including the eight state and territory Acts.

Frequently Asked Questions

Who counts as an eligible whistleblower under the Corporations Act?

More than just employees. Section 1317AAA covers officers, employees, suppliers of goods or services to the company whether paid or unpaid, employees of those suppliers, associates of the company, superannuation-fund trustees, custodians and investment managers and their staff, and relatives and dependants of anyone in those categories.

Do I have to identify myself to be protected?

No. The Corporations Act's disclosable-matter provisions do not require a discloser to identify themselves for the disclosure to qualify for protection, though remaining anonymous can affect how a company or regulator investigates the report.

Is every complaint about being treated unfairly at work a whistleblower disclosure?

No. Section 1317AADA excludes a disclosure that is purely a personal work-related grievance, such as an interpersonal conflict or a dispute about a promotion, transfer, or disciplinary decision affecting only the discloser, unless it also alleges the separate offence of victimisation under section 1317AC.

Can I go to the media or a member of parliament straight away?

Not usually. A public interest disclosure to a member of parliament or a journalist requires a prior protected disclosure to have already been made, at least 90 days to have passed with no reasonable belief that action is being taken, and written notice of intent given first. An emergency disclosure has no 90-day wait, but requires a reasonable belief of substantial and imminent danger to health, safety or the environment, plus written notice.

What is the maximum penalty for retaliating against a corporate whistleblower?

For an individual, the civil penalty is the greater of 5,000 penalty units ($1,820,000 at the current $364 unit) or three times the benefit gained. For a body corporate, it is the greatest of 50,000 penalty units ($18,200,000), three times the benefit, or 10 percent of annual turnover, capped at $910,000,000. A smaller strict-liability criminal fallback of 20 or 200 penalty units also exists but is generally understood to be the less-used enforcement route.

Is the tax whistleblower regime the same as the Corporations Act regime?

Structurally similar but not equivalent in severity. Part IVD of the Taxation Administration Act 1953 protects a similar range of disclosers and disclosures relating specifically to an entity's tax affairs, but it has no public interest or emergency disclosure route, and its confidentiality and victimisation offences are straight criminal penalties with a maximum body-corporate exposure of roughly $436,800, far smaller than the Corporations Act's civil penalty exposure.

Does my company have to have a whistleblower policy?

If it is a public company, a large proprietary company (meeting at least two of $25 million consolidated revenue, $12.5 million consolidated gross assets, or 50 or more employees), or a proprietary trustee of a registrable superannuation entity, yes. ASIC's RG 270 sets out what the policy must cover, including how the company will investigate disclosures and protect whistleblowers from detriment.

What if I work for the Commonwealth government instead of a private company?

A different Act applies. Commonwealth public officials are protected under the Public Interest Disclosure Act 2013 (Cth) rather than the Corporations Act. See the Commonwealth Public Interest Disclosure Act page for how that regime works.