Integrity and whistleblowing on a public-body website: what to publish
A public body’s website is not just a place to publish information. It is also one of the ways the body shows that it works transparently. Local authorities, schools, libraries, museums, arts centres and other public bodies benefit from a clear Integrity or Speaking up section: it shows residents, staff, partners and supervisory bodies how the organisation acts responsibly, how it manages risks and where to turn if someone notices wrongdoing.
Part of this content follows from whistleblowing law. Across the EU, Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law has been written into national law. In Ireland, the Protected Disclosures (Amendment) Act 2022 gives effect to it. Every public body, whatever its size, must establish and operate internal reporting channels and procedures, and must publish, including on its website, an annual report by 31 March on the previous calendar year. In Malta, the Protection of the Whistleblower Act (Cap. 527) requires employers covered by the Act to have internal procedures with secure reporting channels and a designated whistleblowing reporting officer, and to make clear and easily accessible information about those procedures and about external reporting available.
The rest of the section is good practice. The aim is to make the information easy to find, logically organised and accessible to all users, while respecting GDPR when anything about individuals is published.
What to publish
- How and where to report wrongdoing.
This is the most important part. Explain who can report, what can be reported, which channels exist (online form, email, phone, a meeting in person), who receives the report and how confidentiality is protected. Link to the external routes as well, such as the relevant national authority, and say briefly what information makes a report useful.
- Your whistleblowing or protected disclosures policy.
Publish the current policy, or a clear link to it, with its date. People are more likely to speak up when they can read the rules in advance and see how their identity is protected.
- The annual report.
Where the law requires an annual report on disclosures, as in Ireland, publish each year’s report in the same place so that the history stays visible.
- The person or unit responsible.
Name the role, team or designated officer responsible for receiving and following up reports, with a functional email address and phone number, and say what kind of questions they handle.
- Code of conduct and ethics rules.
Publish the code of conduct that applies to staff and, where relevant, to board or council members, so that the public knows what standard the organisation holds itself to.
- Conflict of interest arrangements.
Explain how conflicts of interest are declared and managed, for example in procurement, recruitment, grant decisions or licensing, which are the areas where the risk is usually highest for local authorities, schools and cultural organisations.
- Risk management and audit.
If the organisation has assessed its integrity or fraud risks, or an audit has made recommendations, a short summary of the main risks and of what is being done about them builds trust. It shows that risks are not only named but managed.
- Gifts and hospitality.
A short policy on gifts and hospitality, and a register if you keep one, answers a common question before it is asked.
How to present the information
Uploading documents is not enough. On a public-sector website the information must be easy to find for a resident, a member of staff and an auditor alike. Use a clear page structure, group documents by topic, and show each document’s date and whether it is current.
Make sure the section is accessible: document titles must be meaningful, link texts clear, and files usable with assistive technologies. PDFs need real headings, tagged structure and a correct reading order so that screen readers can read them. Under the EU Web Accessibility Directive, office documents published since 23 September 2018 are within scope, so this is a legal point as well as good practice. See WCAG compliance for public-sector organisations.
GDPR and responsible publication
Everything published about integrity must respect data protection. The information must serve a legitimate purpose, and personal data must be adequate, relevant and limited to what is necessary. To name the responsible officer, a job title, a functional email address and a phone number are usually enough.
If documents contain data about individuals, review and, where needed, redact them before publication. This balances transparency with privacy and reduces the risk of a GDPR breach. Whistleblowing reports themselves are never published; the law in both Ireland and Malta requires the identity of the reporting person to be kept confidential.
Information that builds trust
On its own initiative, the organisation can add staff training on ethics, frequently asked questions or short explanations for residents. This is especially useful for schools, libraries, museums and other bodies whose audience is not made up of lawyers or public administration specialists.
A well-prepared Integrity section helps meet legal duties and strengthens the organisation’s reputation. Clear, accessible and regularly updated information shows that transparency is treated as a real responsibility, not a formality. This article is part of our series on what public-sector websites must do and publish.