> Cyprus's Law 6(I)/2022: the 50-worker rule, Cyprus's competent-authority structure, and the official implementation sources.

Source: https://ethicsportal.eu/whistleblower-laws/cyprus/
Updated: 2026-06-01

---

# Whistleblower law in Cyprus

Cyprus implemented Directive (EU) 2019/1937 through **Law 6(I)/2022**, published on **4 February 2022**. The basic private-sector trigger is **50 employees**, but Cyprus organises external reporting through a **competent-authority structure** rather than one universal state inbox.

## Applicable law

- [Law 6(I)/2022 — official text PDF](https://www.cylaw.org/nomoi/arith/2022_1_006.pdf)
- [Ministry of Health whistleblower explainer](https://www.gov.cy/moh/en/whistleblowers/)

## Who must establish an internal channel

- **All public-sector entities** (with limited statutory exceptions).
- **Private employers with 50 or more employees.**
- **Entities in certain regulated industries** (notably financial services) regardless of headcount.

Private firms with 50-249 employees had until **17 December 2023** to establish their internal channels.

## Penalties and enforcement

Cyprus enforces through a **single criminal-penalty tier** rather than a graded administrative-fine schedule. The enumerated offences — obstructing or hindering a report, retaliating against a reporter, bringing malicious or vexatious proceedings, breaching the confidentiality of a reporter's identity, and knowingly making false reports — are punishable by **up to 3 years' imprisonment and/or a fine of up to €30,000**.

| Conduct | Penalty |
| --- | --- |
| Obstruction, retaliation, malicious proceedings, breach of confidentiality, or knowingly false reports | Up to 3 years' imprisonment and/or a fine up to **€30,000** |
| Legal entity — offences committed on its behalf, or lack of supervision/control enabling them | Fine up to **€30,000** (imprisonment applies only to natural persons) |

**An honest assessment of enforcement.** Note what the penalty schedule targets: it attaches to *misconduct toward a reporter* (obstruction, retaliation, breaking confidentiality), not to the bare administrative fact of not having set up a channel. The obligation to establish a channel is mandatory, but the research found **no distinct fine for simply lacking one**, and **no public record of any company being prosecuted, fined, or sanctioned** under Law 6(I)/2022 to date. Enforcement is decentralised across sector-specific authorities, and no proactive inspection regime has surfaced. The real exposure is criminal liability the moment a reporter is silenced or retaliated against — which a functioning internal channel is designed to prevent.

## External reporting authority

Cyprus uses a list of **competent authorities** for external reporting, depending on the subject matter and sector. The official central guidance is the [government whistleblower explainer](https://www.gov.cy/moh/en/whistleblowers/), which points to guides for competent authorities rather than one single cross-sector authority.

## Data protection authority

For data-protection complaints relating to report handling, the relevant authority is the [Office of the Commissioner for Personal Data Protection](https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/home_en/home_en%3Fopendocument). The office has also issued a [whistleblower-specific announcement](https://www.dataprotection.gov.cy/DATAPROTECTION/DATAPROTECTION.NSF/All/D174BEEE706A7B67C2258BB1003C4C8B).

## Key compliance points

- Cyprus expects obliged entities to publish both worker-facing guidance and internal handling rules.
- The law also covers anonymous reports where the whistleblower is later identified and suffers retaliation.
- In practice, Cypriot organisations should tell reporters which external authority fits the topic instead of treating "external reporting" as one generic route.

## Official sources

- [Law 6(I)/2022 — official text PDF](https://www.cylaw.org/nomoi/arith/2022_1_006.pdf)
- [Law 6(I)/2022 — consolidated text](https://www.cylaw.org/nomoi/enop/non-ind/2022_1_6/full.html)
- [Government whistleblower explainer](https://www.gov.cy/moh/en/whistleblowers/)
- [Whistleblowers Guide for employees (gov.cy, April 2024)](https://www.gov.cy/media/sites/18/2024/06/Whistleblowers-Guide-for-employees-April-2024.pdf)
- [Audit Office — competent authorities for receiving and investigating complaints](https://www.research.org.cy/en/investigation-of-complaints-competent-authorities-for-receiving-and-investigating-complaints/)
- [CyPAOB — whistleblower reporting channels](https://cypaob.gov.cy/en/whistleblowers/)
- [Office of the Commissioner for Personal Data Protection — home page](https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/home_en/home_en%3Fopendocument)
- [Office of the Commissioner for Personal Data Protection — whistleblower announcement](https://www.dataprotection.gov.cy/DATAPROTECTION/DATAPROTECTION.NSF/All/D174BEEE706A7B67C2258BB1003C4C8B)

---

[Deploy your reporting channel →](/pricing/)