Whistleblower law in Greece #

Greece implemented Directive (EU) 2019/1937 through Law 4990/2022. The Greek framework combines the standard private-sector threshold with a named internal reporting officer and an external channel operated by the National Transparency Authority.

Applicable law #

Who must establish an internal channel #

Private-sector employers with 50 or more workers must establish an internal channel and appoint a reporting officer (ΥΠΠΑ — Υπεύθυνος Παραλαβής και Παρακολούθησης Αναφορών).
Entities in the financial-services, transport, and environmental sectors are in scope regardless of headcount.
Public bodies are also in scope.

Deadlines: 11 May 2023 for employers with 250+ workers, 17 December 2023 for the 50-249 band; the public sector had six months from entry into force. The appointment of the reporting officer must be notified to the Labour Inspectorate within two months.

Penalties and enforcement #

Greece operates two distinct penalty tracks, and they are frequently confused — the distinction matters.

Failing to establish the channel / designate the reporting officer (Art. 9(13) ): the statute fixes no specific amount. It states only “Η παραβίαση της υποχρέωσης ορισμού Υ.Π.Π.Α. συνεπάγεται επιβολή προστίμου” (“breach of the obligation to designate a Υ.Π.Π.Α. results in the imposition of a fine”), with the amount and criteria delegated by Art. 24 to a joint ministerial decision (Justice, Finance, Development & Investment) that had not been issued as of early 2025 — so this penalty was not yet operational. It is imposed by the Labour Inspectorate, not the National Transparency Authority.
Obstruction, retaliation, malicious proceedings, or breaching a reporter’s confidentiality (Art. 23 ): natural persons face imprisonment plus a fine (Art. 23(1); knowingly false reports carry a minimum 2-year term under Art. 23(3)). Where the violation is committed “προς όφελος ή για λογαριασμό νομικού προσώπου” (for the benefit of or on account of a legal entity), Art. 23(5) imposes an administrative fine on the entity of €10,000–500,000.

An honest assessment of enforcement. Read the trigger carefully: the often-quoted “€500,000” ceiling attaches to a violation committed for the benefit of the legal entity — obstruction, retaliation, breaking confidentiality — not to simply lacking a channel, whose penalty amount remained undefined pending secondary legislation. No company has been publicly identified as fined or sanctioned under either track. The National Transparency Authority received 79 external reports in 2023, so the external channel is operating, but no public sanction outcomes have surfaced. The real exposure is therefore reputational and operational — a report reaching the external authority with no internal channel in place — rather than a predictable fine.

External reporting authority #

The official external channel is the National Transparency Authority , which receives reports under Law 4990/2022 and publishes implementation material for obliged entities.

Data protection authority #

For complaints about unlawful handling of personal data or confidentiality issues, the relevant authority is the Hellenic Data Protection Authority .

Key compliance points #

Greek implementation material expects written, oral and meeting-based intake options.
The reporting officer is a named compliance role, not just a generic mailbox.
Official Greek guidance states that private entities in the 50-249 band may use shared reporting officers for intake.

Official sources #

Deploy your reporting channel →

Last updated: June 10, 2026