The one difference between the public and private sector is that in the public sector you want to have, for every agency or institution, a dedicated person regardless of how big it is. In the private sector many laws say, okay, if a company is over 50 employees, or 100, or has x amount of dollars of annual revenue, you have to have an appointed person. If it's a mom-and-pop shop with three employees, it doesn't make sense to have a whistle-blower intake person. You need to figure out the threshold for requiring a company to have a point person.
To answer your first question, you want to have as many disclosure channels as possible. I find your law, as currently written, very confusing. You can report this here, report that there. You don't even want to put a lawyer through having to read this law. It's very complicated. The Australian law also is very complicated.
The notion of the three-tier system—internal, regulatory, then external—could be modified to your liking. If it's reasonable and possible to report internally, that should be certainly encouraged. But as Tom said earlier, you don't want to take away the right to free speech of the employee and the worker. If they're not comfortable reporting internally, and they have a reason for that discomfort, they should be able to go to the regulator directly. In cases of extreme or dire emergencies—threat to life, threat to the environment—or if evidence might be destroyed, as John mentioned earlier, people should have the right to go to the public without reporting internally or to the regulators.