Skip to content.

Secondary navigation

Get Your Demo
A smiling man wearing glasses and a headset sits at a desk in an office, looking at the camera. Two other people with headsets work at computers in the background.

The Portuguese Whistleblower Protection Law

Explore the Portuguese Whistleblower Protection Law, including compliance requirements, scope, and how to support and protect reporting in your organization.

Get your guide to incident management
Abstract image showing a geometric pattern of teal horizontal slats on the left and hexagonal shapes on the right, with a gradient lighting effect creating depth and dimension.

Portuguese Whistleblower Protection Law overview

The Portuguese Whistleblower Protection Law (Law no. 93/2021) was published in Portugal on 20 December 2021. It entered into force in June 2022 and is applicable to all entities with 50 employees or more.

Like all other members of the European Union, Portugal was required to transpose the EU Whistleblower Protection Directive into national law. 

From being one of the countries providing the weakest legal protections for whistleblowers in Europe, Portugal has become not only one of the first countries to transpose the EU directive but also the law incorporates some of the strictest requirements seen so far.

A man in a pink shirt smiles while sitting at a desk in a modern office. He is looking at a computer monitor, with large windows and ceiling lights visible in the background.

What are the details of the Portuguese Whistleblower Protection Law?

The Portuguese Whistleblower Protection Law (Law no. 93/2021) adopts and extends the requirements of the EU Whistleblower Protection Directive including: 

  • A secure channel for receiving whistleblower reports must be put in place 
  • Acknowledgment of receipt of the report must be provided to the whistleblower within seven days 
  • An impartial person or department must be appointed to follow-up on the reports, without entering into a conflict of interest 
  • Records must be kept of every report received, in compliance with confidentiality requirements 
  • There must be diligent follow-up of the report by the designated person or department 
  • Feedback from the review and any investigation must be provided within three months of the report being received. In addition, the results of the investigation, and any measures adopted, must be communicated within 15 days of the investigation’s conclusion when requested by the whistleblower 
  • All processing of personal data must be done in accordance with the GDPR regulation
A woman in a blue blazer and yellow top smiles while working at a laptop in an office setting. She is sitting at a desk with two other colleagues, one on either side, and there are plants and computer monitors in the background.

Considerations for compliance with the Portuguese Whistleblower Protection Law

Organisations with operations in Portugal must comply with the Portuguese Whistleblower Protection Law.

Since the Portuguese legal framework requires entities to establish a confidential whistleblowing channel, all organisations subject to law no. 93/2021 will be faced with resolving multiple challenges in a short space of time. 

Organisations should consider what new processes should be set up to ensure that no form of retaliation takes place, which otherwise could lead to serious administrative sanctions. How should existing work processes be adjusted to comply with the new legal requirements? Additionally, how will they protect internal sensitive and personal data in compliance with Law 93/2021?

Futuristic architectural interior featuring sweeping, curved metal beams and glass panes. The design creates a dynamic pattern with light streaming through the structure, casting soft shadows and highlighting the airy, expansive space.

Whistleblower protection provided by this law covers a broader range of parties and a wider scope of areas of misconduct than the minimum standards stated by the EU directive

Material scope

Violent crimes and organised crime are specifically mentioned as types of wrongdoing covered by the Portuguese national whistleblower protection law. This goes beyond the scope of the EU directive, which only includes breaches of EU law.

A woman with long brown hair is sitting on a desk in a modern office, smiling while holding a tablet. She is wearing a white blazer and orange pants. The desk has potted plants, papers, and computer monitors. The background is a brick wall.

Anonymous reporting

Portuguese law has now made a 180-degree shift in its views on anonymous reporting. Previously, organisations were not required to accept anonymous reports, nor were they covered by any legal protection due to the challenges around verifying the source of the whistleblower. However, the Portuguese legislator has now acknowledged the importance of anonymous reporting by making it a legal obligation for organisations to accept anonymous reports and protecting the whistleblower against retaliation, including when anonymity is waived. 

Another local addition to the EU directive is that the whistleblower may request the results of the investigation to be provided within 15 days of its conclusion. This is in addition to the directive’s minimum standards to provide feedback on the status of the investigation within three months of its receipt.

Explore more resources on whistleblowing and regulatory compliance in the EU

Stay ahead of Portuguese’s evolving compliance landscape

Portuguese’s regulatory environment is complex and constantly evolving. Get the insights you need to strengthen your compliance program, reduce risk, and build a culture of transparency.

See our Portuguese Compliance Guide