Dealing with anonymous and de-identified voluntary PIDs (Revised March 2026)

Even though there is a duty on agencies to keep the identity of public interest disclosure (PID) makers confidential, some public officials may still not wish to identify themselves when making PIDs for fear of detrimental action or other negative consequences, or because they do not wish their colleagues or employer to know they have made a disclosure. 

Under the Public Interest Disclosures Act 2022 (PID Act), a PID maker is not required to identify themselves. A PID maker can submit an anonymous PID or may choose to submit their disclosure in a way that does not reveal their identifying information. Given this, it is important for agencies to have an appropriate policy and procedure in place for dealing with anonymous and de-identified PIDs as well as for protecting the identity of PID makers. With such policies and procedures in place, agencies can encourage staff to disclose serious wrongdoing when they otherwise would not be confident to do so. 

This guideline explains the difference between anonymous and de-identified voluntary PIDs and provides an overview of the features of each. The guideline also provides an overview of an agency’s responsibilities relating to anonymous voluntary PIDs and de-identified voluntary PIDs including how to assess the disclosure, dealing with anonymous and de-identified voluntary PIDs, risk management considerations, updating the PID-maker, and taking corrective action if necessary. 

A voluntary PID can be made orally or in writing and can be made anonymously.¹ 

‘Anonymous’ in the PID Act does not just mean that the name or identity of the person is not known. Rather, a PID is an anonymous PID only if, after considering the circumstances of the PID and any material which relates to it, it is determined that there is no reasonable or practical way of communicating with the maker of the disclosure.² 

This means that the test to determine whether a PID is anonymous is not whether the agency or person receiving the disclosure knows the name of the maker of the report, but rather whether there are reasonable or practical means of communicating with the maker. 

In practice, it can be difficult for an agency to progress an investigation into a voluntary PID, if the agency cannot contact the PID maker for further information or for clarification of the content of the report. Even if the PID maker chooses not to disclose their name and identity, they may be able to provide a reasonable and practical way for the investigator to communicate with them. 

Agencies have an obligation to include in their PID policy their procedures for how they will deal with voluntary PIDs.³ This should include how they intend to deal with anonymous PIDs, and the limitations anonymous PIDs may have on the ability to investigate. It would also be beneficial to advise that if a public official intends to remain anonymous (in the sense used in the PID Act — that is, unable to be communicated with), that their report should contain comprehensive details of all information they have about the serious wrongdoing, including potential witnesses and any documentary evidence. It should also highlight that anonymous makers of PIDs may not be able to be kept informed about the progress of the matter or the outcome of the matter. The PID policy should also note that it may not be possible for an anonymous PID maker to be effectively protected from detrimental action (if others suspect that the anonymous PID maker did in fact make the report). 

Including this information in the agency’s PID policy allows public officials who intend to make an anonymous complaint to consider the following before making an anonymous PID: 

• whether they want to receive updates on how the PID is being dealt with and whether an agency can provide updates, for example by using pseudonyms, code words or encrypted technology if allowed within the agency 

• their ability to access support mechanisms after they make the PID 

• the likelihood that their identity will still become known, either through the investigation into the wrongdoing, speculation or some other circumstance 

• the possibility that one of their colleagues might be mistakenly identified as the maker of the PID. 

__________

^1. Public Interest Disclosures Act 2022, s 24(2).
^2. Public Interest Disclosures Act 2022, Sch 2 Dictionary.
^3. Public Interest Disclosures Act 2022, s 43(1)(a).

An anonymous PID is a voluntary PID, so long as it has the features of a voluntary PID. 

The content of an anonymous voluntary PID can usually only be assessed on the information disclosed. If it is likely that the disclosure was made by a public official (for example, because the PID asserts that it is, or because it is likely only a public official would be in a position to have provided the relevant content) and the content provides reasonable grounds for believing that it shows or tends to show serious wrongdoing, the agency must proceed and treat the disclosure as a voluntary PID. 

An agency will often have little or no information about the reporter’s sources of information (because they are seeking to hide their identity). In this case, agencies should assess any other inferences that can be drawn from the information provided. For example: 

• Has the maker provided detailed information about the alleged wrongdoing from which further sources of evidence can be identified, even if there is no/limited information about how they became aware of the information in the disclosure? 

• Is it likely that they are a public official based on what they have disclosed? 

Once an anonymous report has been assessed as a voluntary PID, an agency must then decide how it will deal with the disclosure, in line with the procedures followed for all voluntary PIDs. 

If there is doubt whether an anonymous report is a voluntary PID, it will be prudent to assess the report as a PID. If it subsequently becomes clear that the disclosure is not a PID (for example, the identity of the maker becomes known, and they are not a public official), then the agency can change its assessment. If, however, it is a PID but the agency failed to recognise it as such, then the agency will risk not complying with its obligations under the PID Act. 

For information on what is to be included in an agency’s annual return see table Information to be included in an agency’s annual return. This table can be found in our guideline Reporting to the Ombudsman. 

Agencies must decide how to deal with an anonymous voluntary PID in the same way as other voluntary PIDs where the maker is known. This could be by investigating the disclosure, referring it to a relevant integrity agency or arranging for another agency to investigate it. 

While investigating anonymous PIDs may be more difficult, agencies should pursue all available avenues while investigating the disclosure. 

An agency should consider the available evidence and decide on the most appropriate action to take in response to the PID, in accordance with the PID Act and the agency’s PID policy. 

If the report contains sufficient information to warrant further inquiries or an investigation, they should be conducted. Of course, the fact that the PID has been made anonymously may affect the ability to effectively investigate the matter — especially if insufficient detail has been given in the report. Agencies also need to consider whether the anonymous nature of the PID will affect whether and how it could put the allegations to the person(s) alleged to have engaged in serious wrongdoing for response, and therefore afford them procedural fairness. 

Regardless of this, an agency cannot refuse or fail to investigate a PID merely on the basis that it was made anonymously, nor should an adverse inference be made about whether the PID maker was telling the truth because they have chosen to remain anonymous. 

If the identity of the maker of the PID is known at the outset, relevant risk assessments can be conducted to determine the required levels of support and protection. 

In the case of anonymous PIDs, where the maker’s identity is unknown and where they cannot otherwise be communicated with, it is difficult for agencies to ensure the safety of the PID maker and for the agency to comply with its obligations to minimise the risk of detrimental action occurring. 

Where an agency receives an anonymous PID, it should not seek to investigate who made the PID or otherwise seek to ‘out’ the person who the agency thinks did so. However, it is important for the agency to recognise that there may still be a risk of detrimental action and that the agency has an obligation to protect its staff against this risk. This includes not only the person who made the PID, but also any person who might be suspected by others of having done so. 

Accordingly, even where the PID is anonymous, the agency should conduct a risk assessment to determine whether: 

• anyone has indicated an intention to report or has complained about the wrongdoing before 

• the information or issues raised can readily be attributed to a known public official 

• the identity of the maker may be inadvertently discovered when dealing with the PID 

• other public officials may speculate, correctly or otherwise, about who made the PID 

• the subjects of the PID or other public officials may inadvertently, or perhaps deliberately, discover the identity of the PID maker 

• a person who did not make the report, but is believed to have done so, is at risk of detrimental action. 

If the identity of the maker of the PID does become known at any stage, the risks associated with the PID may escalate and require the implementation of prevention or mitigation strategies. 

The term ‘de-identified voluntary PID’ does not appear in the PID Act. We use this term to refer to a voluntary disclosure made by a public official where the PID-maker’s true identity is not disclosed in their report, but they provide a means by which an agency can communicate with them. For example, a de-identified PID could be submitted through a secure portal set up to receive disclosures that include an encrypted messaging function, or using an email address that does not reveal the reporter’s identifying information but enables ongoing communication.  

De-identified disclosures are distinct from anonymous disclosures. A disclosure will be anonymous if there is no reasonably practicable way of communicating with the maker, even if their name is known. An example of an anonymous disclosure might be where a public official submits a signed letter that contains allegations of serious wrongdoing but provides no return mailing address, phone number, or other way to contact them. 

For the purposes of the PID Act, a de-identified voluntary PID is the same as a voluntary PID where the PID-maker’s identity is known. Further guidance can be found in our guideline Dealing with voluntary PIDs. 

Importantly, agencies still need to conduct a risk assessment and develop a risk management plan when they receive a de-identified voluntary PID. The risk assessment should consider whether the identity of the maker can be readily ascertained or would likely be ascertained during an investigation, and any associated risks of detrimental action to any person. As with anonymous PIDs, when dealing with a de-identified voluntary PID an agency should consider the risk that others may be assumed to be the PID maker given the content of the disclosure, and whether they are at risk of detrimental action.  

As the maker of a de-identified voluntary PID is contactable, they should receive all the same information that would be provided to a PID maker whose identity is known. This means that an agency has an obligation to inform the PID maker about the progress or outcome of any investigation under section 59 of the PID Act. Further guidance regarding what an agency must update the PID-maker about can be found in our guideline Updating the makers of voluntary PIDs and providing supports.

The table below provides an overview of an agency’s obligations for anonymous and de-identified voluntary PIDs.