Whistleblowing Interviews and Confidential Transcription Services: Getting the Record Right

There is a document sitting in most organisations’ investigation files that nobody has thought about properly.

It is the transcript of the whistleblowing interview. It contains the name of the person who spoke up, the names of the people they accused, what they claimed, and — crucially — exactly how they said it. It was probably produced at speed, possibly by whoever was available, and it may well have travelled by email.

It is also the single document most likely to be disclosed in a tribunal claim, requested by a regulator, or quoted back at the organisation eighteen months later by a solicitor.

The care taken over that transcript rarely matches its importance. This article is about closing that gap.

What changed in April 2026

The Employment Rights Act 2025 brought in changes that took effect on 6 April 2026, and they raise the stakes for anyone handling disclosures.

The headline change is that sexual harassment is now a standalone category of protected disclosure. Previously a worker reporting harassment had to shoehorn it into an existing category — usually breach of a legal obligation — to attract whistleblowing protection. Now it qualifies directly, covering past, ongoing and anticipated conduct.

The practical consequence is a widening of exposure. Mishandle a harassment report and you may face a harassment claim and a whistleblowing detriment claim from the same facts. The two run on different legal tracks and the second is often the more expensive.

The second shift is subtler but matters more for this article: the emphasis has moved from having a policy to demonstrating the process worked. Organisations are increasingly assessed on documentation and audit trail — on whether they can show what was said, when, to whom, and what was done about it. That evidential burden falls, almost entirely, on the interview record.

Which means the transcript is no longer administrative overhead. It is the defence.

Confidentiality is not anonymity

This distinction causes more damage than any other misunderstanding in this area, and transcription sits right on the fault line.

Anonymity means you do not know who made the disclosure. They reported through a channel that did not capture their identity. You cannot protect them from retaliation because you cannot identify them, and you often cannot investigate properly because you cannot ask follow-up questions.

Confidentiality means you know exactly who they are and you undertake to control that knowledge. This is what most whistleblowing schemes actually offer, and it is the more useful of the two — provided the undertaking holds.

A transcript is where confidentiality goes to die. Even with the name removed, the content identifies the person. “I raised this with my line manager in the Bristol office in March” narrows it to one individual. Investigators call this jigsaw identification, and a verbatim interview record is full of the pieces: turns of phrase, job-specific knowledge, references to conversations only a handful of people witnessed.

Research from Protect, the UK whistleblowing charity, puts fear of reprisal as the single largest barrier to speaking up — named by around a third of UK workers. A confidentiality breach does not just harm the individual. It teaches everyone else in the organisation that the scheme does not work, and the next problem goes unreported until it is a crisis.

So the handling question is not “have we redacted the name?” It is “who has read this document, and can we prove it?”

Should the interview be recorded at all?

Reasonable practitioners disagree, and it is worth being clear about the trade-off rather than defaulting.

The case against recording: some disclosers speak more freely without a recorder running. Recording can feel adversarial. And a recording is a disclosable document that will be read literally, including the parts where the investigator phrased something badly.

The case for recording: handwritten notes are contemporaneous only in theory. They are selective, they reflect what the note-taker thought was important, and they are impossible to defend when the discloser says “that is not what I told them.” A recording plus a transcript is the only version of events that survives cross-examination.

In practice, most organisations that have been through a contested whistleblowing claim end up recording. The ones that do not are usually the ones who have not yet had one.

If you do record:

• Say so at the outset, on the recording, and explain why
• Explain who will hear it, how long it will be kept, and who will produce the transcript
• Confirm the discloser understands they can ask you to stop
• Offer them the transcript to review and correct — and record their comments rather than amending the original

That last point matters. The transcript is a record of what was said, not what someone wishes they had said. Corrections go in an addendum.

The data protection position, briefly

A whistleblowing interview recording is personal data about the discloser, about the accused, and usually about third parties who are named in passing and have no idea they are in the file.

Two things follow.

It is frequently special category data. Allegations of sexual harassment engage data concerning sex life or sexual orientation. Allegations touching on someone’s health, race, religion or trade union activity engage those categories too. Special category data requires an Article 9 condition in addition to your lawful basis — most commonly the employment, social security and social protection condition, with an appropriate policy document in place. Allegations of criminal conduct bring Article 10 into play as well.

Your transcription supplier is a processor. Everything in Article 28 applies: a written contract, defined security measures, controlled sub-processing, deletion or return at the end, and the requirement that you only use processors offering sufficient guarantees. The same logic applies whether you are handling a disclosure in a hospital, a bank or a manufacturing plant — the assurance work does not scale down for small cases.

If your organisation runs a DPIA process, a whistleblowing scheme is exactly the sort of high-risk processing it exists for.

What to demand from a transcription supplier

Generic transcription controls are not enough here. These are the specific ones.

A named, identifiable transcriber — not a pool. You should be able to ask who typed the file and receive a name, not a shrug. Many suppliers distribute work across an open network of contractors; for a whistleblowing interview that is unacceptable. Ask whether the transcriber is employed or subcontracted and where they are located.

A closed chain of custody. Upload through an encrypted portal, not email. Per-user credentials. An access log you can inspect. A documented path from upload to delivery with no step where the file sits unencrypted on someone’s desktop.

No AI, or explicit disclosure of where it is used. This is not a stylistic preference in this context. Automated systems transmit audio to third-party infrastructure, frequently outside the UK, and terms of service vary on whether your data is retained or used for model improvement. Beyond the data question, automated transcription invents plausible words where audio is unclear — and in a document that could become evidence of what a person alleged, a confidently wrong sentence is worse than a marked gap. A fully human process is the only one where an unclear passage reliably comes back as [inaudible 00:14:22] rather than a guess.

Confidentiality agreements covering the individual, not just the company. Ask to see the clause the transcriber personally signed.

Certified deletion on a defined schedule. You want the audio and any working files gone on a stated date, with a certificate. Suppliers who keep copies “in case you need them again” are creating a second disclosure risk you do not control.

Full verbatim as standard. Investigation interviews should not be tidied. A hesitation, a self-correction, a question the investigator asked in a leading way — all of it is material. If you are unsure what this means in practice, we have set out the difference between full verbatim, intelligent verbatim and edited transcripts with worked examples. For whistleblowing, it is full verbatim, every time.

Sensible turnaround without corner-cutting. Investigations run to deadlines, and a transcript that arrives three weeks later has stalled the process. But fast turnaround should come from capacity, not from widening the pool of people who see the file. Ask how they achieve speed.

Our own approach to secure handling and data protection sets out what these controls look like in practice if you want something concrete to compare a supplier against.

A workable protocol

For organisations building this into their whistleblowing procedure:

1. Decide the recording policy in advance, in the policy document, rather than case by case under pressure.
2. Use a pseudonym from the point of upload. The discloser becomes “Reporting Party” in the filename and in the transcript. Keep the key in a separate, access-controlled document.
3. Send only the audio the supplier needs — not the whole case file, not the policy, not the accused’s HR record.
4. Keep a distribution list. Every person who receives the transcript, with a date. This is your answer when someone asks how a name got out.
5. Watermark or otherwise mark copies where the risk justifies it.
6. Set the retention period at the start and diary the deletion, for your files and the supplier’s.
7. Review the redaction before it circulates, specifically for jigsaw identifiers rather than just names.

None of this is expensive. All of it is much cheaper than a confidentiality breach.

Sector notes

Financial services. Firms within scope of SYSC 18 have specific obligations around whistleblowing arrangements, the whistleblowers’ champion role, and the handling of reportable concerns. Documentation quality is examined, and finance sector transcription carries the same confidentiality profile as any regulated record.

Healthcare. Freedom to Speak Up arrangements and the Guardian role add a further layer, and any transcript touching on patient safety brings clinical governance into the picture alongside the employment issues. Healthcare organisations should also check that their transcription supplier meets the data security assurance they claim elsewhere in their supply chain.

Legal and professional services. Where a firm is conducting an investigation for a client, privilege may attach to the transcript — which makes the supplier’s confidentiality undertaking part of maintaining that privilege. Law firms commissioning investigation transcription should treat the supplier as they would any other part of the privileged circle.

Public sector. Disclosure obligations under FOI, and the possibility of a transcript ending up before a committee or inquiry, mean the record needs to be defensible on its own terms.

Frequently asked questions

Can we record a whistleblowing interview without consent? You should not proceed covertly. Tell the interviewee at the outset, explain the purpose, retention and who will access it, and record their agreement on the recording itself. Covert recording of your own investigation interviews is difficult to justify and corrosive to a scheme that depends on trust.

Is a transcript disclosable in an employment tribunal? It may well be. Documents relevant to the issues in the claim are generally disclosable, and an investigation transcript usually is. Write and handle it on the assumption that it will be read by the other side.

How do we protect the whistleblower’s identity in the transcript itself? Pseudonymise from the point of upload, redact identifying detail rather than just names, and control distribution with a written list. Accept that in a small team, content alone may identify the person — in which case the protection has to come from access control, not redaction.

Should whistleblowing transcripts be full verbatim? Yes. Anything that removes hesitation, self-correction or the exact phrasing of an allegation is removing evidence. Tidying an investigation transcript can change what it appears to say.

How long should we keep the recording? Set a defined period tied to the limitation periods relevant to any likely claim, document the reasoning, and delete on schedule — including at your supplier. Indefinite retention is the most common failing and the hardest to defend.

Can we use an AI transcription tool for this? We would advise against it. The data leaves your control, terms on retention and model training vary, and automated systems produce fluent errors in exactly the passages where the audio is hardest — which in a contested interview is often the most important part.

Handling an investigation now?

We transcribe investigation and disclosure interviews under named-transcriber confidentiality, entirely by trained human transcriptionists in the UK, with encrypted transfer and certified deletion.

If you are mid-investigation and need to know our controls before you send anything, contact us and we will send our data processing agreement and supplier assurance pack first — no file required, no sales process. You can also review our confidential and corporate transcription work, our data security position, or pricing.