> Portugal's Lei 93/2021: the 50-worker trigger, authority-specific external reporting, and the official Portuguese sources that matter.

Source: https://ethicsportal.eu/whistleblower-laws/portugal/
Updated: 2026-06-10

---

# Whistleblower law in Portugal

Portugal implemented Directive (EU) 2019/1937 through **Lei n.º 93/2021, de 20 de dezembro**. The core private-sector trigger follows the familiar **50-worker** line, but external reporting remains authority-specific rather than centralized around one universal whistleblowing office.

## Applicable law

- [Lei n.º 93/2021 — official text](https://files.diariodarepublica.pt/gratuitos/1s/2021/12/24400.pdf)
- [Ministry of Justice explainer](https://justica.gov.pt/Regime-Geral-de-Protecao-de-Denunciantes-de-Infracoes)

## Who must establish an internal channel

- **Legal entities with 50 or more workers** (including the State and public-law entities).
- **Financial / AML, transport-safety, and environmental entities** — regardless of headcount.
- Medium entities (50-249 workers) may share resources for receiving and following up reports; municipalities under 10,000 inhabitants are excluded.

## Penalties and enforcement

Portugal fixes an **explicit fine for not having a channel**. Failing to maintain a compliant internal channel is a *contraordenação grave* under **Art. 27(3)(a)** — verbatim, *"Não dispor de canal de denúncia interno, nos termos previstos no artigo 8.º…"* The most severe tier is reserved for conduct against reporters.

| Offence tier (Art. 27) | Legal persons | Natural persons |
| --- | --- | --- |
| **Grave** — **no internal channel** (Art. 27(3)(a)), inadequate safeguards, no designated officer | **€1,000–125,000** | €500–12,500 |
| **Muito grave** — obstruction (art. 7), retaliation (art. 21), breach of confidentiality (art. 18), knowingly false disclosure (Art. 27(1)) | **€10,000–250,000** | €1,000–25,000 |

**An honest assessment of enforcement.** The no-channel fine is real and reaches **€125,000** for a company. In practice, though, enforcement against whistleblowing-channel breaches has not yet materialised: as of November 2025 **MENAC** had opened 11 *contraordenação* proceedings — but those concern the separate corruption-prevention regime (RGPC), **not** the Lei 93/2021 channel obligations, and **no fine has been imposed** for whistleblowing-channel non-compliance to date. The obligation and the fine are firmly on paper; the enforcing authority (MENAC, under Art. 29) is operational but has not yet sanctioned a channel breach.

## External reporting authority

Portugal does not use one single catch-all external whistleblowing authority. The [Ministry of Justice guidance](https://justica.gov.pt/Regime-Geral-de-Protecao-de-Denunciantes-de-Infracoes) directs reporters to the competent authority for the subject matter.

## Data protection authority

For GDPR and confidentiality complaints, the relevant authority is the [Comissão Nacional de Proteção de Dados (CNPD)](https://www.cnpd.pt/cidadaos/participacoes/).

## Key compliance points

- Portuguese official guidance treats external reporting as authority-specific, so the correct regulator depends on the subject matter.
- The law is framed around secure, confidential intake and protection against retaliation.
- For most private employers, the practical deployment question is still whether the organization has reached the 50-worker threshold.

## Official sources

- [Lei 93/2021 — official text](https://files.diariodarepublica.pt/gratuitos/1s/2021/12/24400.pdf)
- [Ministry of Justice — general regime for whistleblower protection](https://justica.gov.pt/Regime-Geral-de-Protecao-de-Denunciantes-de-Infracoes)
- [MENAC — whistleblower regime FAQ (enforcing authority)](https://mec-anticorrupcao.pt/faq/regime-geral-de-protecao-de-denunciantes-de-infracoes/)
- [Lei 93/2021 — consolidated text (PGDLisboa)](https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=3544&tabela=leis)
- [CNPD — complaints and participations](https://www.cnpd.pt/cidadaos/participacoes/)

---

[Deploy your reporting channel →](/pricing/)