Portugal

Portugal

ProfileUpdatesLawResourcesAnalysis

The below is a guide to the whistleblowing law and measures to protect whistleblowers as well as information on were to seek information, support and advice. It is also available to download here

UNDERSTANING PORTUGAL’S WHISTLEBLOWER PROTECTION LAW: A SIMPLIFIED GUIDE

Last Updated: 23/10/2025

What is whistleblowing?

‘Whistleblowing’ describes the practice of drawing attention to wrongdoing. The term relates to the report of fraud, abuse, corruption, dangers to public health and safety, etc., to someone believed to be able to effect action. In Portugal, The General Regime for the Protection of Whistleblowers (RGPDI), approved by Law no. 93/2021, of December 20th, transposed Directive (EU) 2019/1937 of the European Parliament and of the Council, of October 23rd, 2019, on the protection of persons who report breaches of Union law, in conjunction with the Annex to Decree Law no. 109-E/2021, of December 9th, which provides for the General Regime for the Prevention of Corruption (RGPC). The General Regime for the Protection of Whistleblowers transposing the EU Directive, and the complementary norms inscribed in the General Regime for the Prevention of Corruption, as well as the overall enforcement and oversight framework led by the National Anti-Corruption Mechanism, entered into force in June 2022, six months after the approval of the Portuguese Whistleblowing Law in December 2021.

 

Key features of the whistleblower protection law

Under the terms of Law no. 93/2021, of December 20th, which establishes the RGPDI, ‘whistleblowers’ are persons who publicly disclose or report breaches based on information obtained in the course of their professional activity, such as workers, volunteers, trainees, members of administrative or management bodies, fiscal or supervisory bodies, service providers, contractors, subcontractors and suppliers of organizations in the public, private or social sectors, and persons acting under their supervision and direction. Persons who, in good faith, report or disclose infringements on the basis of information they believe to be true at the time of the report or public disclosure obtained during a recruitment process or in precontractual negotiations, as well as obtained in a professional relationship that has since ended, are also protected by law.

The infringements that can be reported are acts or omissions that violate rules in the areas of: public procurement; financial services, products and markets, and the prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed  safety, animal health and animal welfare; public health; consumer protection; protection of privacy and personal data, and network and information systems security. These are also reportable offenses under the terms of the law: acts or omissions contrary to and detrimental to the financial interests of the European Union; acts or omissions contrary to the rules of the internal market, including competition and state aid rules, as well as corporate tax rules; violent crime, especially violent and highly organized crime, and organized and economic-financial crime. However, some companies opt for a broader concept of infraction, extending the scope of their internal whistleblowing channel to violations of internal policies and procedures, namely the code of conduct, anti-corruption policy, anti-harassment and anti-discrimination policy, as well as conduct contrary to the company’s ethical values and principles.

Whistleblowing channels must allow for secure anonymous reporting, including requests for questions or clarifications about the rules and procedures applicable to the organization. Nowadays, there are computerized systems for receiving reports that make it possible to communicate with whistleblowers while maintaining their anonymity. However, if the whistleblower chooses to disclose their identity, it (or the information that would allow their identity to be deduced) must be kept confidential. Only those responsible for receiving and following up on reports will be able to know this, unless there is a legal obligation or court decision to the contrary. Personal data that is not relevant to the processing of the complaint will not be kept and must be deleted immediately, under the terms of the General Data Protection Regulation and implementing legislation.

Who Else is Protected?

The protection afforded by the law extends, with the necessary adaptations, to: a natural person who assists the whistleblower in the whistleblowing procedure and whose assistance must be confidential, including trade union representatives or workers’ representatives; a third party who is linked to the whistleblower, such as a work colleague or family member, and may be the target of retaliation in a professional context; any legal persons or similar entities owned or controlled by the whistleblower, for whom the whistleblower works or with whom he or she is otherwise connected in a professional context; a whistleblower who submits an infringement report to the competent institutions, bodies, offices or agencies of the European Union shall benefit from the protection established in this law under the same conditions as a whistleblower who submits an external report.

 

Where and How to Report

Reporting Internally:

As of June 18th, 2022, all private and public entities with 50 or more employees, and municipalities with 10,000 or more inhabitants, must establish internal whistleblowing channels. A whistleblowing complaint must be submitted in writing and/or verbally through the internal whistleblowing channel or the existing external channels, as applicable, and may, in certain cases, be made public. Therefore, if the whistleblower decides to file a complaint, they should prioritize the organization’s internal channels, find out how they work, assess whether they should do so in writing (using the electronic channel available on the website and/or intranet, by email or by post) or verbally (by telephone, voice message or, if desired, in a face-to-face meeting), and whether they wish to remain anonymous.

Reporting Externally:

Whistleblowers can also use external whistleblowing channels (i.e. the authorities competent to deal with the matter in question, e.g. the Public Prosecution Service, law enforcement agencies like Polícia Judiciária – the Portuguese Criminal Investigation Police -, the Bank of Portugal, independent administrative authorities, public institutes, ministries’ general inspectorates – like the General Inspectorate of Finance -, local authorities, and public associations), but the law requires this only in the following cases: when internal channels do not exist or when they only accept reports from employees, and the whistleblower is not one of them; when there is reason to believe that the infringement will not be effectively dealt with by the organization; when there is reason to believe that there is a risk of retaliation; when, having made an internal report, the measures adopted and/or to be adopted have not been communicated to the whistleblower within three months; when the infringement in question is a crime or administrative offense punishable by a penalty of more than €50,000.

In case a report is presented to an incompetent authority, it will be sent to the respective competent authority, notifying the whistleblower.

When there is no competent authority to handle the report, or when the report is about a competent authority, it should be sent to the National Anti-Corruption Mechanism. If the latter is the authority reported on, it should be sent to the Public Prosecution Service.

What Will Happen with the Report?

Within a maximum of seven days of receiving the complaint, the whistleblower must be notified of its receipt, and must also be informed of the situations in which they can use external channels. In addition, within a maximum of three months of receiving the complaint, the whistleblower has the right to know the measures planned or adopted to follow up on their complaint, and may request that the organization informs them of the result of the analysis carried out on the complaint within 15 days of its conclusion.

Making a Public Disclosure:

The Portuguese law also stipulates that the whistleblower may only publicly disclose an infringement (e.g. through the media) in the following cases: when the infringement constitutes an imminent or manifest danger to the public interest; when, having made an external complaint, there is reason to believe that the infringement will not be effectively resolved by the competent authorities; when there is a risk of retaliation; or when, having made an internal and/or external complaint, the measures adopted and/or to be adopted have not been communicated to the whistleblower within three months or six months, in the case of an external complaint and the complexity of the case so justifies.

 

Measures to Protect Whistleblowers

Protection of the Whistleblower’s Identity

Whistleblowing channels must allow for secure anonymous reporting, including requests for questions or clarifications about the rules and procedures applicable to the organization. Nowadays, there are computerized systems for receiving reports that make it possible to communicate with whistleblowers while maintaining their anonymity. However, if the whistleblower chooses to disclose their identity, it (or the information that would allow their identity to be deduced) must be kept confidential. Only those responsible for receiving and following up on reports will be able to know this, unless there is a legal obligation or court decision to the contrary. Personal data that is not relevant to the processing of the complaint will not be kept and must be deleted immediately, under the terms of the General Data Protection Regulation and implementing legislation.

Prohibition of Retaliation

The law considers an act of retaliation to be an act or omission, directly or indirectly, carried out up to two years after the complaint or public disclosure, taking place in a professional context, motivated by an internal or external complaint or public disclosure, which causes or may cause the complainant, in an unjustified manner, pecuniary or non pecuniary damage. The legislation in force provides for an exemplary list (non-exhaustive, therefore) of acts of retaliation, including: disciplinary sanctions; changes to working conditions (such as duties, working hours, place of work or pay, failure to promote the employee or failure to comply with work duties); suspension of an employment contract; negative performance appraisal or negative reference for employment purposes; failure to convert a fixed-term employment contract into an open-ended contract, whenever the employee had legitimate expectations of such a conversion; non-renewal of a fixed-term employment contract; dismissal; inclusion on a list, based on a sector-wide agreement, which could lead to the whistleblower being unable to find employment in the sector or industry concerned in the future; termination of a supply or service contract; revocation of an act or termination of an administrative contract.

Protection Against Lawsuits

Whistleblowers do not incur liability if the complaint is made in accordance with the law (Law no. 93/2021), in particular: the legal complaint, in itself, cannot constitute grounds for disciplinary, civil, misdemeanor or criminal liability; the whistleblower is not liable for the violation of any restrictions on the communication or disclosure of information contained in the complaint or public disclosure, without prejudice to the legal and professional secrecy regimes of doctors, lawyers and journalists, and religious; the whistleblower is not responsible for obtaining or accessing the information that motivates the complaint or public disclosure, except in cases where obtaining or accessing the information constitutes a crime. However, if the complaint proves to be manifestly unfounded or false: the whistleblower will benefit from the protection provided by law and will not be punished if he/she is in good faith and has serious grounds for believing that the information denounced is true at the time of the complaint or public disclosure; if he/she is not in good faith and does not have serious grounds for believing that the information denounced is true, the whistleblower will be subject to a very serious administrative offense.

If a Whistleblower Suffers Retaliation or Identity Disclosure

Whistleblowers have the right to assistance and collaboration from the competent authorities to other entities to guarantee their protection against acts of retaliation, including by certifying that they are formally recognized as such (i.e. as a whistleblower), whenever they request such formal recognition. Threats and attempted acts and omissions are also considered acts of retaliation. Whistleblowers who are victims of retaliation have the right to compensation for the damage caused and may also request, in particular from the National Anti-Corruption Mechanism, appropriate measures to prevent the damage or its expansion. Whistleblowers who are the target of an act of retaliation may also resort to an external reporting channel or public disclosure.

Key considerations:

Analysts already identified several shortcomings in the Portuguese law, such as the fact that the new law limits the possibility for whistleblowers to report directly to the authorities, which goes against the Directive’s requirement in that regard and is far from best practice. But lack of enforcement and oversight currently seems to be the most critical feature of whistleblowing protection in the country.

Not only recent media reports have emphasized the delay in the implementation of internal reporting channels in most public institutions, as the setting up of the National Anti-Corruption Mechanism, the regulatory body responsible for overseeing, data collection and reporting on the effectiveness of the national law transposing the EU Directive was only concluded in November 2022, and is still missing IT infrastructures and recruiting its staff members, and was only able to declare sanctions (on individual and/or collective persons) from June 2023. All these delays pose significant risks to the protection of the EU values and rights and the investigation and prosecution of breaches of Union law inscribed in the EU Whistleblowing Directive.

Other key legislation:

Is there any other important relevant legislation whistleblowers should be aware of (for example, other reporting mechanisms and protections, anti-SLAPP measures, or laws that may impede whistleblower protection)?

Cautions for whistleblowers

Whistleblowers do not incur liability if the complaint is made in accordance with the law (Law 93/2021), in particular: the legal complaint, in itself, cannot constitute grounds for disciplinary, civil, misdemeanor or criminal liability; the whistleblower is not liable for the violation of any restrictions on the communication or disclosure of information contained in the complaint or public disclosure, without prejudice to the legal and professional secrecy regimes of doctors, lawyers and journalists, and religious; the whistleblower is not responsible for obtaining or accessing the information that motivates the complaint or public disclosure, except in cases where obtaining or accessing the information constitutes a crime. However, if the complaint proves to be manifestly unfounded or false: the whistleblower will benefit from the protection provided by law and will not be punished if he/she is in good faith and has serious grounds for believing that the information denounced is true at the time of the complaint or public disclosure; if he/she is not in good faith and does not have serious grounds for believing that the information denounced is true, the whistleblower will be subject to a very serious administrative
offense.

 

Where to Seek Information, Support & Advice:

Further Reading & Helpful resources