Skip to content.

Secondary navigation

Get Your Demo
Smiling person with short hair and glasses sits on a chair, holding a phone and laptop. Another person is seen from the back, engaged in conversation. The setting appears to be an indoor workspace with various items in the background.

The Cyprus Whistleblower Protection Act

Explore the Cyprus Whistleblower Protection Law, including compliance requirements, scope, and how to support and protect reporting in your organization.

Get your guide to incident management
View from below of modern glass buildings forming a square opening to the sky. The reflections on the glass create a geometric pattern, with a clear blue sky visible through the opening.

Cyprus Whistleblower Protection Law overview

Cyprus amended its whistleblower protection laws in 2022 to transpose the EU Whistleblower Protection Directive’s requirements into national law. The law defines whistleblower protections for anyone reporting violations of either EU law or Cypriot national law, and imposes several obligations on organizations to protect internal whistleblowers. 

The new legislation covers all public and private organizations with at least 50 employees, requiring them to establish mechanisms to allow for whistleblower reports and to protect whistleblowers. Employers must also appoint someone to investigate whistleblower claims, and this can be an internal manager or an external third party. 

The law protects whistleblowers and those assisting them from retaliation for submitting a report. It also allows them to report their concerns externally to Cypriot law enforcement and several regulatory agencies (the Labor Department and the Public Service Commission, for example), depending on the exact concern being raised. If a whistleblower reports their concerns publicly (for example, to the press), protections only apply if the whistleblower has already tried to report internally or to regulators with no success, and the whistleblower believes the public interest is in imminent danger.

A man sits at a desk in an office with large windows, working on a laptop and two monitors displaying business charts and graphs. A city skyline is visible in the background.

What does the Cyprus whistleblower protection law cover?

The law adopts the minimum standards for whistleblower protection outlined in the EU Whistleblower Protection Directive. These requirements include: 

  • A secure and confidential channel for receiving whistleblower reports must be in place. 
  • Acknowledgment of the receipt of every whistleblowing report must be provided to the whistleblower within seven days. 
  • An impartial person or department must be appointed to follow up on the reports. 
  • Records must be kept of every report received in compliance with confidentiality requirements.
  • There must be diligent follow-up of the report by the designated person or department. 
  • Feedback on the follow-up or investigation must be given to the whistleblower within three months of receiving the report. 
  • All processing of personal data must be done in accordance with GDPR.

What are the rules outlined in the Cyprus whistleblower protection law?

Formally known as the “Protection of Persons Reporting Violations of the EU and National Law,” Cyprus’ updated whistleblower law went into effect in February 2022. It covers all public or private organizations with at least 50 employees. Organizations with 250 or more employees should have already implemented their whistleblower protections by 2023; companies with 50 to 249 employees had to do so by the end of 2023. Those with fewer than 250 employees are also allowed to establish a joint whistleblower program in coordination with other small businesses. Financial service firms need to establish an internal reporting system even if they have only one employee.

Two women smiling and talking while looking at a tablet in a modern office setting, with a man sitting in the background holding a coffee cup.

All covered business must meet the following basic requirements

The law requires all covered organizations to: 

  • Set up a whistleblowing system with comprehensive whistleblower protections.
  • Adopt a policy on reporting legal violations and other misconduct. Businesses must also train employees on how to use the hotline and on the importance of non-retaliation. 
  • Companies are allowed to outsource the management of their hotline to a third-party service provider.
A person wearing a blue sweater sits on a table in a modern office space. The room is dimly lit with hanging lights, surrounded by shelves and bulletin boards with various images and papers.

Confidentiality, retaliation and disclosures

Whistleblowers are allowed to submit reports in writing, verbally or in person; and the company must preserve a record of every report submitted. Any personal data in the report must be erased within three months of any subsequent investigation being concluded.

A man in a navy suit with a light blue tie sits on a gray sofa, gazing thoughtfully out of a window. The background features sheer curtains and a textured glass wall.

Anonymous report intake and management

The Cyprus law does not expressly state that companies must allow anonymous reporting. If, however, a company does receive an anonymous report and that person’s identity later becomes known, they are still eligible for the law’s anti-retaliation protections just like any other whistleblower.

A man wearing headphones sits at a table with a laptop in front of him. He appears thoughtful, looking into the distance. Behind him is a shelf with plants, framed photos, and a record player. A glass of water is on the table.

What are the risks of non-compliance?

Companies that violate Cyprus’ whistleblower law by failing to implement a whistleblower program or by retaliating against a whistleblower can face regulatory fines of up to €30,000. Individuals who retaliate against whistleblowers can face fines of up to €30,000 or up to three years’ imprisonment.

Explore more resources on whistleblowing and regulatory compliance in the EU

Your Definitive Guide to Whistleblowing & Incident Management

A strong incident management system is critical to meeting Cyprus whistleblowing laws, building trust, and protecting your organization.

Get your guide