a colleague is being bullied or harassed, where can he report that

Bullying and aggression belong with the confidant or the reporting channel

Bullying, intimidation and aggression at work are not a "breach" under whistleblower rules, but fall under unwanted conduct — and there is usually a different route for this than the reporting channel for breaches. A colleague dealing with this can usually turn to the confidant within the organization, if one exists, or to a manager or HR. Many employers also have a separate reporting point or reporting channel that covers both breaches and unwanted conduct. Where can an employee report undesired conduct? describes the possible routes in more detail, including what an employee can expect in terms of confidentiality and follow-up steps.

Important is the distinction between two things that are often confused: the confidant, who listens, provides support and thinks through follow-up steps, and the formal reporting channel, which registers a report and handles it according to a procedure with time limits. In cases of bullying or intimidation, the confidant is often the first and most logical step, because the problem usually calls for guidance and conversation, not immediately a formal investigation. must I go to the confidential advisor or to the reporting channel with my complaint sets out that distinction. Whether a confidant exists within an organization varies by employer; Is a confidential advisor mandatory? addresses the current state of affairs surrounding this obligation.

What the Occupational Health and Safety Act and the bill proposal say about this

Article 3 of the Occupational Health and Safety Act requires employers to have policies against psychosocial strain at work, which includes bullying, harassment and aggression; how that policy is designed in detail and which reporting channel belongs with it is for the employer to establish. Additionally, there is a private member's bill (Parliamentary document 35592) that aims to make a confidential counsellor for employees mandatory; its handling can be followed via the Senate. The Whistleblower Protection Act mainly governs the reporting procedure for breaches of public interest, and is therefore not the appropriate framework for an individual conflict between colleagues — although in practice the same reporting channel can be set up for it.