From today all companies with 50 staff or more must have internal reporting channels set up for workers who wish to make protected disclosures.
Failure to establish channels is a criminal offence.
Previously the requirement only applied to large organisations with 250 or more employees.
It also applied to all firms involved in certain financial services like prevention of money laundering and terrorist financing, transport safety and safety of offshore gas and oil operations.
All public sector organisations, regardless of size, are already required under the Protected Disclosures Act 2014 to have formal protected disclosures procedures in place.
The extension to those businesses with 50 or more staff was contained in the Protected Disclosures (Amendment) Act, which was signed into law last year.
However, a derogation from obligations was given to organisations of between 50 and 249 workers until today.
Under the act, the minister can extend it to other firms with less than 50 staff, using an order.
The act gives protection to anyone in the public, private and not-for-profit sectors who report concerns about wrongdoing they have encountered in the course of their work.
Last year's amended legislation also widened the scope of the protected disclosures regime to cover volunteers, unpaid trainees, board members, shareholders, members of administrative, management or supervisory bodies and job applicants.
Wrongdoing that can be reported includes criminal offences, miscarriage of justice, endangerment of health and safety, environmental damage, failure to comply with a legal obligation, unlawful or improper use of public funds and other issues.
Personal grievances between a reporting person and their employer or a co-worker that solely affect the reporting person are not protected.
The act requires organisations to have an internal channel designed and operated in a secure, GDPR compliant, manner that ensures the confidentiality of the reporting person and others named in the report.
An independent person with authority must be designated to operate the channel and maintain communication with the reporting person, follow-up on the report and provide feedback to the reporting person.
Internal reporting procedures require that all reports received are acknowledged within seven days and that there is diligent follow-up on all reports received.
The reporting person must also be given feedback on actions taken or envisaged to be taken in follow-up within three months and further feedback at subsequent three month intervals, on request.
