The Portuguese Whistleblower Protection Law

Portuguese Whistleblower Protection Law overview

The Portuguese Whistleblower Protection Law (Law no. 93/2021) was published in Portugal on 20 December 2021. It entered into force in June 2022 and is applicable to all entities with 50 employees or more.

Like all other members of the European Union, Portugal was required to transpose the EU Whistleblower Protection Directive into national law. 

From being one of the countries providing the weakest legal protections for whistleblowers in Europe, Portugal has become not only one of the first countries to transpose the EU directive but also the law incorporates some of the strictest requirements seen so far.

What are the details of the Portuguese Whistleblower Protection Law?

The Portuguese Whistleblower Protection Law (Law no. 93/2021) adopts and extends the requirements of the EU Whistleblower Protection Directive including: 

• A secure channel for receiving whistleblower reports must be put in place 
• Acknowledgment of receipt of the report must be provided to the whistleblower within seven days 
• An impartial person or department must be appointed to follow-up on the reports, without entering into a conflict of interest 
• Records must be kept of every report received, in compliance with confidentiality requirements 
• There must be diligent follow-up of the report by the designated person or department 
• Feedback from the review and any investigation must be provided within three months of the report being received. In addition, the results of the investigation, and any measures adopted, must be communicated within 15 days of the investigation’s conclusion when requested by the whistleblower 
• All processing of personal data must be done in accordance with the GDPR regulation

Considerations for compliance with the Portuguese Whistleblower Protection Law

Organisations with operations in Portugal must comply with the Portuguese Whistleblower Protection Law.

Since the Portuguese legal framework requires entities to establish a confidential whistleblowing channel, all organisations subject to law no. 93/2021 will be faced with resolving multiple challenges in a short space of time. 

Organisations should consider what new processes should be set up to ensure that no form of retaliation takes place, which otherwise could lead to serious administrative sanctions. How should existing work processes be adjusted to comply with the new legal requirements? Additionally, how will they protect internal sensitive and personal data in compliance with Law 93/2021?

Whistleblower protection provided by this law covers a broader range of parties and a wider scope of areas of misconduct than the minimum standards stated by the EU directive

Material scope

Violent crimes and organised crime are specifically mentioned as types of wrongdoing covered by the Portuguese national whistleblower protection law. This goes beyond the scope of the EU directive, which only includes breaches of EU law.

Anonymous reporting

Portuguese law has now made a 180-degree shift in its views on anonymous reporting. Previously, organisations were not required to accept anonymous reports, nor were they covered by any legal protection due to the challenges around verifying the source of the whistleblower. However, the Portuguese legislator has now acknowledged the importance of anonymous reporting by making it a legal obligation for organisations to accept anonymous reports and protecting the whistleblower against retaliation, including when anonymity is waived. 

Another local addition to the EU directive is that the whistleblower may request the results of the investigation to be provided within 15 days of its conclusion. This is in addition to the directive’s minimum standards to provide feedback on the status of the investigation within three months of its receipt.