Portuguese whistleblower protection law "Lei n.º 93/2021"

Portugal brought the EU Whistleblower Directive into national law with Lei n.º 93/2021, in force since 18 June 2022. The law goes further than Brussels asked. It reaches past breaches of EU law into violent and organised crime. It fines a company up to 250,000 euros. And it treats payback within two years of a report as illegal until the boss proves otherwise.

What does Lei n.º 93/2021 cover?

More wrongdoing than the EU directive demands. The EU directive covers reports about breaches of EU law in set fields. Those run from public procurement to product safety and data protection. Portugal kept every one of them. Then it added national crime on top, so the law reaches well past the EU floor.

The standard EU fields are all there. They include public money and procurement, financial services and money laundering, product and transport safety, the environment, food and animal welfare, public health, consumer protection, and data privacy. Portugal then folds in something the directive leaves out. That extra layer is serious national crime.

The law lets you report violent, especially violent, and highly organised crime. It also covers the offences listed in Lei n.º 5/2002 on organised and economic-financial crime. So a report about corruption, fraud, or money laundering inside a Portuguese firm sits squarely in the channel. It belongs there even when no EU rule is in play.

"An infringement includes [...] violent, especially violent and highly organised crime, as well as the crimes provided for in Lei n.º 5/2002, which sets out measures to combat organised and economic-financial crime."
Article 2, Lei n.º 93/2021

Who counts as a whistleblower?

Anyone who learns of wrongdoing through work. The law calls them a denunciante. It does not matter what the job is or which sector it sits in. What matters is how you came by the news, not your job title or your contract.

The law names the people it protects. They include:

• workers in the private, public, or social sector;
• service providers, contractors, subcontractors, and suppliers;
• shareholders and members of management or supervisory bodies, including non-executives;
• volunteers and trainees, paid or unpaid.

Timing does not break the shield. A former worker is covered when the news comes from a job that has ended. So is a job applicant who learns of a breach during hiring, before any contract is signed.

The cover also stretches around the reporter. A colleague or relative who could face payback is protected. So is a person who helps with the report in confidence, and a company the reporter owns or works for. A whistleblower who files with no name, then is identified later, keeps the same cover.

Which reporting channel comes first?

Internal first, in most cases. Portugal sets a strict order. A worker should use the employer's internal channel before going to an outside authority. Going public is only a last resort. The law spells out the narrow cases where you can skip the inside route.

You can go straight to an outside authority when:

• there is no internal channel;
• the internal channel is open only to staff, and you are not staff;
• you reasonably fear the breach won't be fixed inside, or fear retaliation;
• you reported inside and heard nothing back in time; or
• the breach is a crime or an offence fined over 50,000 euros.

"The whistleblower may only resort to external reporting channels where [...] the infringement constitutes a crime or an administrative offence punishable by a fine exceeding EUR 50,000."
Article 7, Lei n.º 93/2021

The outside authorities are named in the law. They include the public prosecutor, the criminal police, the Banco de Portugal, and the independent regulators. Where no other body fits, the report goes to MENAC, the national anti-corruption mechanism.

Going public is the final rung. It is protected only in tight cases. There must be an urgent or clear danger to the public, or the inside and outside routes must both have failed to fix things in time. Hand a story to a journalist outside those cases, and you lose the law's cover.

How do you set up the internal reporting channel?

If you employ 50 or more people, you must run one. The duty also binds every public body. It binds finance and anti-money-laundering firms too, whatever their size. Firms with 50 to 249 staff can share one channel to cut the cost. Small councils with fewer than 10,000 residents are let off.

The channel has firm rules. It must take reports in writing or by voice. It must accept them both with a name and with no name. It must keep the reporter's identity private and bar anyone who is not allowed near the file. A private firm can hand the work to an outside operator instead of building it in house.

The deadlines are fixed. You must confirm a report within 7 days. You must tell the reporter what you plan to do, or have done, within 3 months. Miss either, and the worker earns the right to go straight to an outside authority.

WeMoral runs the whole internal channel in one place, built to satisfy Lei n.º 93/2021. An outside operator can take it on, the way Article 9 permits, or your own named person signs in. Reports come in written or spoken, with a name or without, and each one is sealed to that handler alone. It holds a time-stamped record for the five years Article 20 sets. So when MENAC asks how your channel runs, the file is ready. It ships as browser-based whistleblowing software with nothing to install.

How does Portugal protect whistleblowers from retaliation?

With a broad ban and a reversed burden of proof. The law forbids any payback against a reporter at work. It then presumes that harm done within two years of a report was retaliation. So the employer has to prove it was not. A disciplinary sanction in that window is presumed abusive.

The law lists the acts it treats as payback, including:

• changes to your duties, hours, place of work, or pay;
• withholding a promotion or breaking a training duty;
• suspension of the contract, or a negative review or reference;
• refusing to make a fixed-term contract permanent, or not renewing it;
• dismissal;
• blacklisting across an industry; or
• ending a supply or service contract.

"The following acts are presumed, until proven otherwise, to be motivated by the internal report, external report or public disclosure, where carried out up to two years after it [...]."
Article 21, Lei n.º 93/2021

Two further safeguards carry real weight. A reporter who follows the law carries no liability for the report itself. That cover is wide. It rules out disciplinary, civil, administrative, and criminal claims alike. These rights cannot be signed away either. Any contract clause that tries to block a report is void, and the reporter's name comes out only on a legal duty or a court order.

The state stands behind the reporter too. A whistleblower can claim legal aid. In a criminal case, they can also get the same shield the law gives to witnesses. The goal is to make it safe to come forward.

What are the penalties for breaking the law?

Fines that climb to 250,000 euros. Portugal sorts breaches into very serious and serious. The ceiling depends on whether the offender is a person or a company. The anti-corruption body MENAC runs the cases and sets the fine.

The worst breaches are very serious. They cover blocking a report, hitting back at a reporter, breaking the privacy duty, and knowingly spreading false information. The lighter, serious tier covers the structural failures. Those are no internal channel, a channel without the safeguards the law wants, missed deadlines, or no training for the people who handle reports.

The reach goes wider still. An attempt is punishable, and so is negligence. For both, the ceiling is cut in half. MENAC handles most cases. A sector regulator keeps the power where it already watches the firm, such as the Banco de Portugal over a bank.

Portugal made an unusual choice. It did not just copy the EU list of reportable breaches. It pulled serious national crime into the same channel. So a tip about organised crime or money laundering rides the same protected route as a procurement breach. That widens what a Portuguese channel has to carry. The catch sits in timing. The duty on employers went live in June 2022. MENAC, the body meant to police it, took longer to stand up and start enforcing. For a company the task is plain. Run a channel, name a handler, keep every report sealed for five years, and treat any sanction within two years of a report as one you will have to justify. To see how Portugal lines up with the rest of Europe, read our guide to whistleblower laws by country.