Whistleblowing in Portugal: Lei 93/2021 #

Portugal transposed Directive (EU) 2019/1937 through Lei n.º 93/2021, de 20 de dezembro, the general regime for the protection of whistleblowers. The law has applied since 18 June 2022. It requires legal persons with 50 or more workers to operate a whistleblowing channel (an “internal reporting channel” under Article 8 of the Directive), and it protects people who report breaches from retaliation.

Lei 93/2021 at a glance #

Applicable law #

• Lei n.º 93/2021 — official text in the Diário da República (1st series, no. 244, 20 December 2021)
• Lei n.º 93/2021 — consolidated text (PGDLisboa)

Who must establish a whistleblowing channel #

Article 8 defines the obliged entities:

• Legal persons with 50 or more workers, including the State and other public-law legal persons (para. 1).
• Regardless of headcount, entities covered by the EU acts listed in Parts I.B and II of the Directive’s Annex (para. 1). According to the MENAC FAQ, this means financial services, products and markets and the prevention of money laundering, transport safety and environmental protection. Check the sector legislation that applies to your entity.
• Branches in Portugal of legal persons based abroad, with the necessary adaptations (para. 3).

In the public sector, the State has at least one channel in each body listed in para. 4, such as the Presidency, the Parliament and each ministry. The autonomous regions have a channel in the regional legislative assembly and in each regional department (para. 5). Local authorities with fewer than 10,000 inhabitants do not need a channel, even with 50 or more workers (para. 6). See also whistleblowing in the public sector.

What can be reported #

Article 2 defines a breach:

• acts or omissions against the EU rules listed in the Directive’s Annex, and the national rules that implement or transpose them, in public procurement, financial services and markets and anti-money laundering, product and transport safety, environmental protection, radiation protection and nuclear safety, food safety, animal health and welfare, public health, consumer protection, and privacy and personal data protection and the security of network and information systems;
• acts or omissions that harm the EU’s financial interests (Art. 325 TFEU);
• acts or omissions against internal market rules, including competition, State aid and corporate tax rules;
• violent, especially violent and highly organised crime, and the crimes listed in Art. 1(1) of Lei n.º 5/2002 on organised and economic-financial crime, among them corruption, influence peddling, embezzlement and money laundering;
• acts or omissions that defeat the purpose of the rules in the first three points.

A report may cover breaches that have been committed, are being committed or can reasonably be expected, and attempts to conceal them (Art. 4).

Exclusions. In defence and national security, only breaches of the procurement rules in Part I.A of the Directive’s Annex count (Art. 2(2)). The law does not affect the protection of classified information, religious secrecy, the professional secrecy of doctors, lawyers and journalists, or the secrecy of judicial proceedings (Art. 3(3)).

Who is protected and how #

A whistleblower is a natural person who reports or publicly discloses a breach based on information obtained in their professional activity (Art. 5(1)). This includes workers in the private, social or public sector, service providers, suppliers and subcontractors, shareholders and members of company bodies, volunteers and trainees (para. 2). It also includes people who obtained the information in a professional relationship that has ended or during recruitment (para. 3).

Protection requires good faith and serious grounds to believe that the information was true at the time of the report (Art. 6(1)). An anonymous reporter who is later identified is also protected (para. 2). Protection extends to people who help the reporter, including trade union or worker representatives, to colleagues and relatives, and to legal persons linked to the reporter (para. 4).

Order of channels. In Portugal, the reporter as a rule uses the internal channel first. They may use an external channel only when there is no internal channel, the internal channel accepts reports only from workers and the reporter is not one, they have reasonable grounds to believe that the breach cannot be effectively known or resolved internally or that there is a risk of retaliation, they made an internal report and were not told of the follow-up measures within the Article 11 deadlines, or the breach is a crime or an administrative offence with a fine above €50,000 (Art. 7(2)). A reporter who did not know these rules, through no fault of their own, keeps the protection (Art. 6(3)).

Requirements for the internal channel #

• Who runs it: people or departments of the entity designated for this purpose, for receiving and following up reports (Art. 9(2)). The channel may be operated externally for receiving reports (para. 3). MENAC’s reading is that only the technical solution of the channel may be operated externally (MENAC FAQ, question 18).
• Independence: the people who receive and handle reports act with independence, impartiality, confidentiality, data protection, secrecy and no conflicts of interest (Art. 9(4)).
• Security: the channel ensures the completeness, integrity and retention of the report, the confidentiality of the reporter’s identity or their anonymity, and the confidentiality of third parties named in it, and it prevents access by unauthorised people (Art. 9(1)).
• Who can report: at least all workers (Art. 10(1); Art. 27(3)(d)). The entity may open the channel to other people, such as suppliers (Art. 7(2)(b)).
• Written or oral: the channel allows reports in writing and/or orally (Art. 10(1)). One of the two is enough. If oral reports are accepted, they must be possible by telephone or another voice messaging system and, at the reporter’s request, in an in-person meeting (para. 2).
• Anonymous reports: the channel allows anonymous or identified reports (Art. 10(1)). A channel that does not accept anonymous reports is a serious offence (Art. 27(3)(d)). See anonymous and confidential reporting.
• Information on external reporting: with the acknowledgement, the entity tells the reporter, clearly and accessibly, about the competent authorities and the rules for external reporting (Art. 11(1)).

Deadlines and follow-up #

The reporter may make the Art. 11(4) request at any time. In the follow-up, the entity takes the internal steps needed to check the allegations and, where appropriate, to stop the breach. For example, it opens an internal inquiry or informs the competent authority (Art. 11(2)).

Failing to acknowledge within 7 days and failing to answer an Art. 11(4) request are serious offences (Art. 27(3)(f) to (h)). Missing the 3-month deadline is not in the list in Article 27, but it lets the reporter use an external channel (Art. 7(2)(d)).

Confidentiality and record retention #

Confidentiality (Art. 18). The reporter’s identity, and information from which it can be deduced, is confidential. Only the people responsible for receiving or following up reports have access to it. The duty extends to anyone who receives information about a report without being responsible for handling it. The identity is disclosed only under a legal obligation or a court decision, and the reporter is told first, in writing and with the reasons, unless this would harm the investigation. The same rules protect the identity of the people concerned (Art. 25(2)).

Records (Art. 20).

• Entities keep a register of the reports they receive and keep the reports for at least five years and, regardless of that period, while court or administrative proceedings about the report are pending (para. 1).
• Reports by recorded telephone line or voice message: with the reporter’s consent, a recording in a durable form or a complete and accurate transcript (para. 3). If the oral channel cannot record, the entity draws up accurate minutes (para. 4).
• In-person meetings: with consent, a recording or accurate minutes (para. 5).
• The reporter may check, correct and approve the transcript or minutes by signing them (para. 6).
• Personal data that is clearly not relevant to the report is not kept and is deleted immediately (Art. 19(2)).

Shared channels and groups of companies #

Shared resources. Obliged entities that are not public-law bodies and employ 50 to 249 workers may share resources for receiving and following up reports (Art. 8(2)). Local authorities may share channels (para. 7).

Groups of companies. The law has no specific rules for groups. According to MENAC (question 15), the company based in Portugal, or the Portuguese branch of a foreign company, must ensure full compliance with the law, whatever channels the parent company has.

Worker representatives and data protection #

Lei 93/2021 does not require consulting worker representatives before setting up the channel. It keeps workers’ right to consult their representatives or trade unions (Art. 3(5)(a)). Check whether other rules apply to your entity.

The processing of personal data follows the GDPR and Lei n.º 58/2019 (Art. 19(1)). See GDPR and whistleblower reporting.

Penalties and enforcement #

Breaches of the law are administrative offences (contraordenações) punished with fines under Article 27. Not having a whistleblowing channel is a serious offence (Art. 27(3)(a)).

Attempts and negligence are punishable, with the maximum fines halved (Art. 27(5) and (6)). If the same act is also a crime, it is punished as a crime (Art. 28).

Enforcement authority. MENAC handles the proceedings and imposes the fines (Art. 29(1)). For entities subject to EU sector regimes (Art. 3(1)), the sector authorities are competent (Art. 29(2)). The statutory fine ranges do not show how many fines have been imposed. Compare other countries: penalties by country.

External reporting and MENAC #

Portugal has no single external reporting authority. External reports go to the authority competent for the subject, for example the Public Prosecutor’s Office, the criminal police, the Banco de Portugal, the independent administrative authorities, public institutes, the general inspectorates, local authorities and public associations (Art. 12(1)).

MENAC receives reports when there is no competent authority or when the report concerns a competent authority. If the report concerns MENAC, it goes to the Public Prosecutor’s Office (Art. 12(3)). A report sent to the wrong authority is forwarded to the competent one (para. 2).

External channels accept written and oral reports, anonymous or identified (Art. 14(1)). The authority acknowledges receipt within 7 days and communicates follow-up within 3 months, or 6 months in complex cases (Art. 15). The Ministry of Justice explains where to file an external report.

Data protection authority #

For GDPR complaints, the competent authority is the Comissão Nacional de Proteção de Dados (CNPD).

Setting up in six steps #

1. Check the duty: 50 or more workers, or an entity in a regulated sector covered at any size.
2. Designate the people in charge: internal people or departments, independent and free of conflicts of interest. Entities with 50 to 249 workers that are not public-law bodies may share resources.
3. Set up the channel: written, oral or both; anonymous and identified reports; an in-person meeting on request if oral reports are accepted; access only for the people in charge.
4. Open the channel to all workers, and decide whether to open it to suppliers and other people.
5. Set the procedure: acknowledgement within 7 days with information on external reporting, follow-up measures within 3 months, the result within 15 days on request.
6. Organise the records: keep reports for at least 5 years, record or transcribe only with consent, delete irrelevant data immediately.

Official sources #

• Lei n.º 93/2021 — Diário da República, 1st series, no. 244 (PDF)
• Lei n.º 93/2021 — consolidated text (PGDLisboa)
• MENAC — FAQ on the general whistleblower protection regime
• Ministry of Justice — general regime for whistleblower protection
• CNPD — complaints

Frequently asked questions #

What is Lei 93/2021? #

It is the law that sets Portugal’s general regime for the protection of whistleblowers. It transposes Directive (EU) 2019/1937. It requires entities with 50 or more workers to operate a whistleblowing channel and protects whistleblowers from retaliation.

When did Lei 93/2021 start to apply? #

On 18 June 2022. The law entered into force 180 days after its publication on 20 December 2021 (Art. 31).

Who must have a whistleblowing channel in Portugal? #

Legal persons with 50 or more workers, including the State and public-law bodies, and, on the same terms, Portuguese branches of foreign companies. Entities covered by the EU acts in Parts I.B and II of the Directive’s Annex must have one at any size (Art. 8).

Must companies accept anonymous reports? #

Yes. The internal channel must allow anonymous reports and reports with the reporter’s identity (Art. 10(1)). Not allowing them is a serious offence (Art. 27(3)(d)).

Must the channel accept both written and oral reports? #

No, one is enough: the law says “in writing and/or orally” (Art. 10(1)). If the channel accepts oral reports, it must allow telephone or another voice messaging system and, on request, an in-person meeting (Art. 10(2)).

What deadlines apply after a report? #

The entity acknowledges receipt within 7 days and communicates the planned or adopted follow-up measures within 3 months of receipt. If the reporter asks, it communicates the result of the analysis within 15 days of its completion (Art. 11).

How long must reports be kept? #

For at least five years and, in any case, while court or administrative proceedings about the report are pending (Art. 20(1)). Personal data that is clearly irrelevant is deleted immediately (Art. 19(2)).

What is the fine for having no whistleblowing channel? #

It is a serious offence: €1,000 to €125,000 for legal persons and €500 to €12,500 for natural persons (Art. 27(3) and (4)). Retaliation, obstructing reports and breaching confidentiality are very serious offences: up to €250,000 for legal persons.

May an external provider run the whistleblowing channel? #

Only in part. The channel may be operated externally for receiving reports, but follow-up stays with designated people or departments of the entity (Art. 9(2) and (3)). MENAC’s reading is that only the technical solution may be external.

Can a whistleblower go directly to MENAC or another authority? #

Only in certain cases. As a rule, they use the internal channel first. They may use an external channel, for example, if there is no internal channel, if there is a risk of retaliation, if they were not told of the follow-up measures within the Article 11 deadlines, or if the breach is a crime or an administrative offence with a fine above €50,000 (Art. 7(2)).

Deploy your whistleblowing channel →