Cypriot whistleblower protection law "Νόμος 6(Ι)/2022"

Cyprus passed Law 6(I)/2022 on 4 February 2022. It does what the EU directive asked, then goes further. The law shields people who report breaches of EU law and of Cypriot national law, corruption above all. It can halve a corrupt official's sentence when an insider helps the case, and jail anyone who hits back for up to three years.

What does Law 6(I)/2022 actually cover?

The law covers two layers. Part II takes the breaches of EU law that Directive 2019/1937 lists, from public procurement and financial services to product safety, the environment, public health, and data protection. Part III then adds Cypriot national law. That second layer is what sets Cyprus apart from many of its neighbours.

National law brings in four broad areas. The statute names criminal offences first, and points straight at corruption. It then covers any failure to meet a legal duty, anything that puts a person's health or safety at risk, and anything that harms the environment. A worker who sees any of these can report and stay protected.

"This Part lays down the protection enjoyed by persons who report the following: (a) acts or omissions connected with the commission or possible commission of a criminal offence, and in particular corruption offences; (b) acts or omissions connected with a failure to comply with any legal obligation; (c) breaches that endanger or may endanger the safety or health of any person; (d) breaches that cause or may cause damage to the environment."
Article 31, Law 6(I)/2022

Most EU states stopped at EU law, which is all the directive required. Cyprus chose the wider path. So a report about a local bribe or an unsafe building site counts the same as a report about an EU rule. The two parts run side by side through the rest of the law.

Who is protected?

Protection follows the work, not the contract. It covers employees and civil servants, the self-employed, shareholders, and board members, including non-executive ones. Volunteers and trainees are in, paid or not. So are people who work under the watch of contractors, subcontractors, and suppliers.

The shield reaches past the reporter. Facilitators are in, the people who help someone come forward. So are colleagues and relatives up to the fourth degree who could face payback over the link, along with firms the reporter owns or works for.

Timing is broad too. The law stands behind a job that has ended, and one that has not yet begun, such as during hiring talks. Someone who reports with no name attached stays protected if they are later identified and targeted. The one test is good faith. You must have had fair reason to believe the facts were true when you spoke up.

Corruption sits at the centre of the law

Corruption runs through the whole statute. The opening definitions spell out corruption offences in detail, pulling in bribery, graft, and the abuse of office and trust from several Cypriot laws. Part III then lists national-law breaches and names corruption first. The drafters built this law with graft cases in mind.

The boldest part is a deal for insiders. A person who admits to a corruption offence can have their maximum sentence cut in half. The catch is real help. Their cooperation must trigger the prosecution of a public official. A public official who informs on more senior figures gets the same cut, as long as they hand back any gain they took.

"The maximum penalty that the court may impose on a person convicted, on their own admission, of committing or taking part in a corruption offence involving the bribery of a public official or officer, is half of the maximum penalty provided in the relevant law, if as a result of their substantial cooperation with the prosecuting authorities the prosecution of the public official or officer was started."
Article 38, Law 6(I)/2022

This is a carrot the directive never asked for. It aims to crack open cases that stay hidden because everyone on the inside has something to lose. By rewarding the first person to talk, Cyprus tries to break that silence.

How do you set up the internal reporting channel?

Any private firm with 50 or more staff must run an internal channel. So must every public body, except small local authorities with fewer than 5,000 residents or fewer than 25 staff. Firms with 50 to 249 workers may share one setup. For them, the duty has applied since 17 December 2023.

The channel has set rules. It must be secure and keep the reporter's name from anyone not handling the case. The body confirms a report within seven days. It names an impartial person or team to follow up, and gives feedback within three months. A report can be written, spoken, or made face to face. A firm can run the channel in house or pass it to an outside provider.

WeMoral is evidence-grade whistleblowing software that you launch with no code to write. It seals each report and opens it only to the impartial handler you name, with every step logged under a time stamp. The same channel takes a report about an EU-law breach and one about a national-law matter, corruption included, because Cyprus protects both. A trained officer can run it in house, or you can hand the channel to WeMoral as your outside provider. It runs both reporting routes the law sets out, and it satisfies Νόμος 6(Ι)/2022.

What about external reporting and going public?

A worker does not have to start inside. They can report straight to a competent authority instead. Cyprus did not build one new whistleblowing office. It leans on existing bodies, and the Council of Ministers can name more by decree, on the justice minister's proposal.

The outside channel works much like the inside one. The authority confirms a report within seven days, and gives feedback within three months, or six in complex cases. It must keep the file safe and the reporter's name secret. If a report lands with the wrong body, that body has to pass it on to the right one.

Going public is a protected last resort. A worker keeps the law's shield if they first reported inside or outside and nothing was done in time. The same holds when there is an urgent public danger, or a real risk that evidence would vanish or that the authority is in league with the wrongdoer. Taking facts straight to the press falls under separate press-freedom rules.

What protection do whistleblowers get against retaliation?

The law bans payback and backs the ban with hard remedies. A dismissal, or any harmful change tied to a report, is absolutely void, unless the employer proves a reason that has nothing to do with the report. The burden of proof sits with the employer, not the worker.

"The dismissal of a reporting person, as well as any detrimental change in their conditions of employment or any retaliatory measure, is absolutely void, unless the employer proves that the dismissal or the detrimental change is due to a reason unrelated to the making of the report."
Article 26, Law 6(I)/2022

If the case reaches the Labour Disputes Court, the award is generous. It covers the full loss, including back pay, plus money for any moral or physical harm, with interest on top. Where someone was dismissed, the court can order their job back on request, without weighing whether the employer acted in good faith.

The reporter also gets a wide immunity. They bear no blame for sharing the information, or for getting it, unless getting it was a crime on its own. A report cannot be used to win a defamation, trade-secret, or data claim against them. And a reporter who becomes a witness in a criminal trial counts as a witness in need of help, and can be placed in the state's witness protection scheme.

What are the penalties for breaking the law?

Breaking this law is a crime, not just a fine on paper. Anyone who blocks a report, takes revenge, brings a spiteful case, or leaks the reporter's name faces up to three years in prison, a fine up to 30,000 euros, or both. A knowingly false report carries the same penalty.

A company can be charged too, and faces a fine up to 30,000 euros. The law cuts both ways. Someone harmed by a false or misleading report can sue the person who made it. The strong shield only holds for those who speak up in good faith.

Cyprus made two bets with this law. One is that protecting reports about national law, not only EU law, will bring more wrongdoing into the open. The other is that halving a sentence for the insider who talks will finally crack the corruption cases that have long stayed sealed. Whether the bets pay off rests on the bodies meant to act on what they hear, since Cyprus spread that job across many authorities rather than one dedicated office. To see how the island compares with the rest of Europe, read our guide to whistleblower laws by country.