Whistleblowing & Protected Disclosures
BuruOps Intelligence Lab is committed to operating with complete transparency and ethical rigor. This policy provides a secure, confidential mechanism for workers, contractors, and clients to disclose genuine concerns regarding unlawful conduct, security concealment, or systemic malpractice without fear of detriment or retaliation.
1. What is a "Qualifying Disclosure"?
Under the Public Interest Disclosure Act 1998 (PIDA) and Section 43B of the Employment Rights Act 1996, a qualifying disclosure is any disclosure of information which, in the reasonable belief of the worker, is made in the public interest and tends to show one or more of the following:
- Criminal Offences: Acts of fraud, theft, bribery, or corporate tax evasion;
- Breach of Legal Obligations: Non-compliance with UK GDPR, PECR, or commercial contract requirements;
- Miscarriages of Justice: Wrongful accusations or concealment of evidence in technical forensics;
- Danger to Health & Safety: Hazards endangering team members, client personnel, or data center technicians;
- Environmental Harm: Unlawful disposal of electronic hardware, lithium batteries, or hazardous tech waste;
- Concealment of Security Vulnerabilities: Deliberate cover-up or failure to notify clients of critical vulnerabilities, data leaks, or unpatched exploits discovered during audits;
- Deliberate Concealment: Any active attempt to hide information relating to any of the above.
2. Absolute Statutory Protection Against Detriment
BuruOps guarantees that any worker (including permanent staff, contractors, researchers, or third-party advisors) who raises a qualifying disclosure in good faith will suffer no detriment, victimization, dismissal, or career disadvantage as a result.
Under UK law, any detriment or dismissal caused by having made a protected disclosure is automatically unfair and subject to uncapped compensatory awards at an Employment Tribunal.
3. Confidential Reporting Procedure
To submit a protected disclosure:
Step 1: Written Disclosure
Submit full factual details in writing to the Designated Compliance Officer at principal@buruops.com with the subject header [CONFIDENTIAL PROTECTED DISCLOSURE - PIDA 1998]. You may encrypt your message using our published PGP key.
Step 2: Formal Investigation
The Designated Officer will acknowledge receipt within 48 hours and launch an objective, independent internal investigation. Your identity will be held in absolute confidence unless disclosure is strictly mandated by an order of the High Court.
Step 3: Outcome & Remediation
Within 14 business days, the reporting person will be provided with an update on the progress or outcome of the investigation and the remedial actions taken.
4. External Reporting to Prescribed Persons
While we strongly encourage utilizing internal reporting channels first, UK law permits whistleblowers to make protected disclosures to recognized "prescribed persons" where appropriate:
- Data Protection & Privacy: Information Commissioner's Office (ICO) — ico.org.uk
- Fraud, Bribery & Financial Crime: Serious Fraud Office (SFO) or National Crime Agency (NCA)
- Health & Safety: Health and Safety Executive (HSE) — hse.gov.uk
- Tax Evasion Facilitation: HM Revenue & Customs (HMRC)
5. Independent Confidential Advice
If you are unsure whether your concern qualifies for protection, you may obtain free, confidential legal advice from Protect (formerly Public Concern at Work), the UK's leading whistleblowing charity: