Reporting Wrongdoing at Work in Portugal

Last verified: October 2026.

Who this is for

• You work in Portugal, as an employee, contractor, trainee, volunteer, or director, and have seen a breach of the law.
• You are thinking of reporting it and want to know if the law protects you.
• You run an organisation with 50 or more workers and need a reporting channel.

Not for you if: you are the victim of a crime and want to report it to the police. Read Reporting a Crime in Portugal instead.

Portugal's whistleblower protection law has applied since 18 June 2022. It protects you if you report certain breaches of the law that you learn about through your work. The protection covers specific areas, mostly drawn from EU law, such as public procurement, financial services, the environment, public health, consumer protection, and data protection.

You must act in good faith and usually report inside your organisation first. If you are dismissed, demoted, or punished within two years of your report, the law presumes it was retaliation. Your employer must then prove it was not.

What you can report

The law does not cover every kind of wrongdoing. It protects you when you report an "infringement" (infração) as the law defines it. This means a breach of EU rules, or the Portuguese rules that apply them, in these areas:

• public procurement;
• financial services, products, and markets, and the prevention of money laundering and terrorist financing;
• product safety and compliance;
• transport safety;
• environmental protection;
• radiation protection and nuclear safety;
• food and animal feed safety, animal health, and animal welfare;
• public health;
• consumer protection;
• privacy, personal data, and the security of networks and information systems.

The law also covers:

• acts that harm the EU's financial interests;
• breaches of internal market rules, including competition, state aid, and corporate tax rules;
• violent, especially violent, and highly organised crime, and listed organised and economic and financial crimes;
• acts that defeat the purpose of the rules above.

You can report breaches that have happened, are happening, or can reasonably be expected. You can also report attempts to hide them.

What is usually outside the law

Much ordinary workplace misconduct falls outside this law. Bullying, unfair appraisals, discrimination, unpaid overtime, or a badly run disciplinary process are not automatically covered. You may still have rights under the Labour Code (Código do Trabalho) or other laws. For those, the labour inspectorate (ACT) and the courts are the usual routes. See Employment Contracts, Pay, and Worker Rights in Portugal.

Some things you might not think of as whistleblowing are covered. Examples include falsified food safety records, illegal waste dumping, misuse of customer data, a rigged public tender, or corporate tax evasion.

Who is protected

You are a whistleblower (denunciante) if you report a breach based on information you got through your work. Your sector and type of work do not matter. The law names, among others:

• workers in the private, social, and public sectors;
• service providers, contractors, subcontractors, and suppliers, and anyone working under their direction;
• shareholders and members of management, supervisory, or audit boards, including non-executive directors;
• volunteers and trainees, paid or unpaid.

You are still protected if your job has ended. You are also protected if you learned the information during recruitment or other talks before a contract, even if you were never hired.

Protection also extends to:

• anyone who confidentially helps you report, including union or worker representatives;
• people linked to you who could face retaliation at work, such as a colleague or relative;
• companies you own, control, or work for.

The conditions for protection

You are protected if you act in good faith and have serious grounds to believe the information is true when you report it. The test is your belief at the time. You keep protection even if an investigation later finds no breach.

If you report anonymously and are later identified, you are protected on the same terms. If you went to an outside authority without following the order of channels, you are still protected if you did not know the rules, through no fault of your own.

The order of channels

The law gives three routes: an internal channel, an external channel, and public disclosure. They are not equal. The internal channel comes first.

When you can go straight to an outside authority

You can use an external channel only if one of these applies:

1. Your organisation has no internal channel.
2. The internal channel only accepts reports from employees, and you are not one.
3. You have reasonable grounds to believe the breach cannot be dealt with internally, or that you risk retaliation.
4. You reported internally and were not told what was being done within the legal deadlines.
5. The breach is a crime, or an administrative offence with a fine above €50,000.

When you can go public

You can disclose a breach publicly only in one of these cases:

• you have reasonable grounds to believe it may be an imminent or obvious danger to the public interest;
• you have reasonable grounds to believe the authorities cannot deal with it effectively in the circumstances;
• you have reasonable grounds to believe you risk retaliation, even after an external report; or
• you already reported internally and externally, or directly externally, and no adequate action was taken within the deadlines.

Do not go to the press first. If you give information to a journalist or media outlet outside these cases, you lose the protection of this law. The journalist's protection of sources still applies, but your protection as a whistleblower does not.

None of this removes the legal duty of public officials and others to report crimes.

Which organisations must have an internal channel

These organisations must have an internal reporting channel:

• companies and other legal persons, including the State and public bodies, with 50 or more workers;
• any organisation in certain EU-regulated sectors, whatever its size, such as financial services, anti-money laundering, transport safety, and the environment.

A few details matter:

• Private organisations with 50 to 249 workers can share resources for receiving and handling reports.
• Portuguese branches of foreign companies are covered. The National Anti-Corruption Mechanism (Mecanismo Nacional Anticorrupção, MENAC) says a Portuguese company or branch must comply fully. Using a foreign parent company's channel is not enough.
• Municipalities with 50 or more workers but fewer than 10,000 inhabitants do not need one.

How a channel must work

An internal channel must:

• keep reports complete, intact, and stored safely;
• keep your identity confidential, or let you stay anonymous;
• protect the identity of other people named in the report;
• block access by unauthorised people.

People or services inside the organisation must run the channel. MENAC says only the technology behind it can be outsourced. Whoever runs it must be independent and impartial, with no conflict of interest.

The channel must accept written or spoken reports, or both, with your name or anonymously. If it accepts spoken reports, you can report by phone or voice message. If you ask, you can also have a face-to-face meeting. You can identify yourself with your citizen card or Chave Móvel Digital, or another EU electronic ID.

The deadlines

Internal reports

Your organisation must:

• within 7 days, confirm it received your report and explain clearly how you can report to an outside authority;
• within 3 months of receiving it, tell you what action is planned or has been taken, and why;
• within 15 days of finishing its analysis, tell you the result, if you ask. You can ask at any time.

External reports

An outside authority must:

• within 7 days, confirm receipt, unless you asked it not to, or this could reveal your identity;
• within 3 months, or 6 months for complex cases, tell you what action is planned or has been taken, and why;
• within 15 days of finishing, tell you the result, if you ask.

If your organisation misses its deadlines, you can go to an outside authority. Missing them is also an offence.

Where external reports go

You report to the authority responsible for the subject. The law lists:

• the Public Prosecutor's Office (Ministério Público);
• the criminal police;
• the Bank of Portugal;
• independent regulators;
• public institutes;
• inspectorates-general and similar central State services;
• municipalities;
• public professional associations.

If you send your report to the wrong authority, it must pass it to the right one and tell you. If no authority is responsible, or the report is about a responsible authority, it goes to MENAC. If it is about MENAC, it goes to the Public Prosecutor's Office. For a crime, you can always report to the Public Prosecutor's Office or the criminal police.

An authority can close a report without action, by a reasoned decision sent to you. It can do so if the breach is minor or irrelevant, or the report repeats an earlier one with nothing new. It can also close an anonymous report that shows no sign of a breach.

Each authority must publish, in a separate section of its website, how to report, its contact details, and how it protects you.

Confidentiality and records

Your identity, and anything that could reveal it, is confidential. Only the people who receive and handle reports can see it. The same duty applies to anyone else who learns about the report.

Your identity can be disclosed only because of a legal duty or a court decision. You must first be told in writing why, unless this would harm an investigation or court case.

Organisations and authorities must keep a record of reports for at least five years, and longer while related proceedings continue. If your spoken report is recorded or written down, you have the right to see, correct, and approve the transcript or minutes, and to sign them. Recording needs your consent.

Protection against retaliation

Retaliation is banned. It means any act or omission at work, caused by your report, that causes or may cause you unjustified harm. Threats and attempts count too.

The two-year presumption

If any of these happens within two years of your report, the law presumes it was retaliation, unless your employer proves otherwise:

• changes to your duties, hours, place of work, or pay, being passed over for promotion, or your employer breaking its duties to you;
• suspension of your contract;
• a negative performance appraisal or a negative job reference;
• not turning a fixed-term contract into a permanent one, where you had a legitimate expectation;
• not renewing a fixed-term contract;
• dismissal;
• being put on a sector blacklist that could stop you finding work;
• termination of a supply or services contract;
• revocation of an administrative decision or contract.

Any disciplinary sanction within two years of your report is presumed to be abusive.

In a normal dispute, you usually have to prove your employer's motive. Here, once you show you reported and one of these acts followed within two years, your employer must prove the act had nothing to do with your report.

Anyone who retaliates must pay compensation for the harm. You can also ask a court for urgent measures to stop harm happening or spreading. The same protection covers the people linked to you.

What you are not liable for

A report made under the law's conditions cannot, in itself, lead to disciplinary, civil, administrative, or criminal liability. You are not liable for breaking limits on sharing the information in your report. You are not liable for how you got or accessed the information, unless that was itself a crime.

That is the line. Reporting what you saw in your work is protected. Breaking into a colleague's account to find evidence is not.

The law does not override rules on classified information, or on the professional secrecy of doctors, lawyers, journalists, and religious ministers. Nor does it override the secrecy of criminal investigations.

Rights you cannot sign away

Your rights under this law cannot be waived or limited by agreement. Any contract term that limits or blocks reporting is void. A confidentiality clause in your contract or a settlement cannot stop you using this law.

The person accused also keeps their rights, including the presumption of innocence. Their identity is protected in the same way as yours. Someone who helps you make a report that breaks the law's conditions shares liability for any harm caused.

Support

• Legal aid. You have the right to legal protection under the general rules. See Applying for Legal Aid in Portugal.
• Witness protection. You may qualify for witness protection measures in criminal cases.
• Certificate. Authorities must, if you ask, certify that you are recognised as a whistleblower.
• Information. The Directorate-General for Justice Policy (DGPJ) publishes information on reporting corruption on the Justice Portal.

Fines for organisations

Breaking the law is an administrative offence. MENAC enforces it, unless a sector regulator has that power.

Attempts and negligence are also punished, with the maximum fines halved.

A checklist before you report

1. Check the subject. Is it one of the areas the law covers? If not, another route may fit better.
2. Find the internal channel. Organisations with 50 or more workers must have one and make it known. If there is none, you can go to an outside authority.
3. Use the internal channel first, unless one of the five exceptions applies. Note which one, and keep what supports it.
4. Report in writing if you can, and keep a copy. If you report verbally, ask to see and sign the transcript.
5. Note the deadlines. Seven days for confirmation and three months for a reply.
6. Keep a dated record of any change to your duties, hours, pay, appraisal, or contract in the next two years.
7. Do not go to the press first. Public disclosure is the last step, not the first.
8. Get advice from a lawyer or trade union if the stakes are high. Sector rules may give you more protection, and the more favourable rule applies.

If you run a business and are setting up a channel for the first time, see Hiring Your First Employee in Portugal for your other employer duties.

This guide is general information, not legal advice. Rules change often; check the official source before you act.

Sources

This guide is written from official sources and, where relevant, organisations' own websites.

• PGD Lisboa, whistleblower protection law (Lei n.º 93/2021, of 20 December), consolidated, not amended: https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=3544&tabela=leis (article 2 scope; 3 other regimes and secrecy; 4 past and future breaches; 5 who is a whistleblower; 6 conditions and linked persons; 7 order of channels, €50,000, press; 8 who needs a channel, 50 workers, sharing, branches, municipalities; 9 and 10 channel standards and forms; 11 internal deadlines; 12 competent authorities and MENAC; 14 closing reports; 15 external deadlines; 16 website information; 18 confidentiality; 20 records for five years; 21 retaliation and two-year presumption; 22 support; 24 no liability; 25 accused person; 26 no waiver; 27 fines; 29 MENAC enforcement; 31 in force 180 days after publication), checked 2 October 2026
• National Anti-Corruption Mechanism (MENAC), whistleblower regime FAQ: https://menac.pt/faq/regime-geral-de-protecao-de-denunciantes-de-infracoes/ (in force 18 June 2022, branches of foreign groups must comply in Portugal, only the technology may be outsourced), checked 2 October 2026
• Directorate-General for Justice Policy, reporting corruption: https://dgpj.justica.gov.pt/Documentos/Prevenir-e-combater-a-corrupcao/Denunciar-situacoes-de-corrupcao (reporting to the Public Prosecutor's Office or police, witness protection), checked 2 October 2026
• EUR-Lex, Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law: https://eur-lex.europa.eu/eli/dir/2019/1937/oj (the EU directive the Portuguese law transposes), checked 2 October 2026

Last verified October 2026. Rules and fees change; check the official source before acting.