Reporting Wrongdoing at Work in Portugal in 2026: A Practical Guide to the Denunciante Regime, the 50-Employee Channel, and the Two Years in Which Retaliation Is Presumed

If you work in Portugal and you become aware that your employer, a client, or a company you supply is breaking the law, there is a specific statute that decides whether saying so protects you or exposes you. It is Lei n.º 93/2021, de 20 de dezembro (Law 93/2021, of 20 December), which established the Regime Geral de Proteção de Denunciantes de Infrações (General Regime for the Protection of Whistleblowers), transposing EU Directive 2019/1937. The Mecanismo Nacional Anticorrupção (National Anti-Corruption Mechanism), known as MENAC, dates its entry into force to 18 June 2022, which was also the deadline by which covered organisations had to have their reporting channels running.

The law has been in force for more than four years and remains unamended. It is also widely misunderstood, in two directions at once: people assume it covers far more than it does, and they assume it protects them far less than it does.

This guide sets out what the regime actually says. It is general information about Portuguese law as it stands in September 2026, not legal advice on your situation, and the stakes here are high enough that if you are close to acting you should take advice on the specifics.

The trap most people fall into: what counts as an "infração"

Start here, because everything else depends on it. This law does not protect you for reporting wrongdoing in general. It protects you for reporting an infração as article 2 defines it, and that definition is drawn from EU law rather than from ordinary ideas of right and wrong.

Article 2(1)(a) covers acts or omissions contrary to EU rules listed in the annex to the Directive, or to national rules implementing them, including where those rules create crimes or administrative offences, in ten fields:

• public procurement;
• financial services, products and markets, and the prevention of money laundering and terrorist financing;
• product safety and compliance;
• transport safety;
• environmental protection;
• radiation protection and nuclear safety;
• food and feed safety, animal health and animal welfare;
• public health;
• consumer protection;
• privacy and personal data protection, and network and information systems security.

Beyond that list, article 2 also covers acts or omissions harming the European Union's financial interests under article 325 of the Treaty on the Functioning of the European Union; acts contrary to internal market rules under article 26(2) of that Treaty, expressly including competition rules, state aid and corporate taxation rules; violent, especially violent and highly organised crime, together with the offences listed in article 1(1) of Lei n.º 5/2002 on organised and economic-financial crime; and acts that defeat the purpose of any of the above.

What that means in practice is that a great deal of workplace misconduct sits outside this regime entirely. Bullying, an unfair performance review, discriminatory treatment, unpaid overtime, a badly handled disciplinary process: none of these is automatically an infração for these purposes. They may well give you rights under the Código do Trabalho (Labour Code) or elsewhere, and those rights are unaffected. But they will not, by themselves, put you inside Lei 93/2021.

Conversely, some things people do not think of as whistleblowing are squarely inside it. A hospitality business falsifying food safety records is public health and food safety. A construction firm dumping waste improperly is environmental protection. A company mishandling customer data is data protection. A rigged tender is public procurement. A firm using a corporate structure to evade tax is a corporate taxation rule under article 2(1)(c).

Article 4 adds a point that matters for timing: the report can be about infringements already committed, ones being committed, and ones whose commission can reasonably be foreseen. It also covers attempts to conceal them. You do not have to wait for harm to land.

Who counts as a whistleblower

Article 5 is deliberately broad, and it is not limited to employees.

A denunciante is any natural person who reports or publicly discloses an infringement on the basis of information obtained in the course of their professional activity, whatever the nature of that activity and whatever the sector. Article 5(2) gives a non-exhaustive list: workers in the private, social and public sectors; service providers, contractors, subcontractors and suppliers, and anyone acting under their supervision and direction; shareholders and members of administrative, management, supervisory or audit bodies, expressly including non-executive directors; and volunteers and trainees, paid or unpaid.

Article 5(3) closes the two gaps that would otherwise swallow the protection. You still qualify where the information came from a professional relationship that has since ended, so leaving the job does not strip you of cover. And you qualify where it came from a recruitment process or other pre-contractual negotiation, whether or not a relationship was ever formed, so a candidate who learns something during interviews is covered too.

Protection also extends outward, under article 6(4), to anyone who confidentially assists you with the report (including union representatives and workers' representatives), to third parties connected to you who could face retaliation at work, such as a colleague or a family member, and to legal entities you own, control, work for or are otherwise professionally connected to.

The conditions you have to meet

Article 6(1) sets a two-part test. You are protected if you act in good faith and have serious grounds to believe that the information is true at the moment you report or disclose it.

Read that carefully. The test is about your belief at the time, not about whether you turn out to be right. A report made in good faith on reasonable grounds does not lose its protection because the investigation clears everyone.

Article 6(2) protects anonymous reporters who are subsequently identified, provided they met that same test. Article 6(3) forgives a reporter who went to an external channel without observing the precedence rules, if at the time they were unaware of those rules through no fault of their own.

The order you must use, and the trap in it

This is where people lose their protection, so it deserves care.

Article 7(1) offers three routes: an internal channel, an external channel, or public disclosure. They are not interchangeable. Internal is the default.

You may go straight to an external channel only where, under article 7(2):

• there is no internal channel;
• the internal channel only accepts reports from employees and you are not one;
• you have reasonable grounds to believe the infringement cannot be effectively dealt with internally, or that there is a risk of retaliation;
• you reported internally and were not told, within the article 11 deadlines, what was being done about it; or
• the infringement is a crime, or an administrative offence punishable by a fine of more than 50,000 euros.

You may make a public disclosure only where, under article 7(3), you have reasonable grounds to believe the infringement may constitute an imminent or manifest danger to the public interest, or that it cannot be effectively addressed by the competent authorities in the circumstances, or that there is a risk of retaliation even after an external report; or where you have already gone internal and external, or directly external, and no adequate measures were taken within the deadlines in articles 11 and 15.

And here is the trap. Article 7(4) states that a person who takes an infringement to a media organisation or a journalist outside the cases in article 7(3) does not benefit from the protection of this law. The journalist's own source protection is untouched, and that is expressly preserved. But your protection as a whistleblower is not. Going to the press first, before exhausting the routes the statute lays out, is the single most reliable way to end up outside the regime.

One saving provision: article 7(5) makes clear that none of this displaces the duty to report crimes under article 242 of the Código de Processo Penal (Code of Criminal Procedure), which binds public officials and others.

Which organisations must have an internal channel

Article 8 requires internal reporting channels at legal persons, including the State and other public bodies, that employ 50 or more workers. It applies regardless of headcount to entities within the scope of the EU acts listed in the Directive's annex, which MENAC summarises as covering financial services, products and markets and anti-money-laundering rules, transport safety, and environmental protection.

Some detail that matters:

• Private entities with between 50 and 249 workers may share resources for receiving and following up reports (article 8(2)).
• Branches in Portugal of companies headquartered abroad are covered, with the necessary adaptations (article 8(3)). MENAC's published position is firm on this: a Portuguese subsidiary or branch must comply with Portuguese law in full, and relying on a parent company's overseas channel does not discharge the obligation.
• The State must have at least one channel in each of a specified list of institutions (article 8(4)), including the Presidency, the Assembleia da República (Parliament), each ministry, the Constitutional Court, the two judicial councils, the Tribunal de Contas (Court of Auditors) and the Procuradoria-Geral da República (Prosecutor General's Office).
• The autonomous regions need a channel in the regional legislative assembly and one per regional secretariat (article 8(5)).
• Municipalities with 50 or more workers but fewer than 10,000 inhabitants are exempt (article 8(6)), and municipalities may share channels (article 8(7)).

Article 9 sets the standards a channel has to meet: secure submission and follow-up, completeness, integrity and preservation of the report, confidentiality of the reporter's identity or their anonymity, confidentiality for third parties named in the report, and prevention of access by unauthorised people. Channels must be operated internally by designated people or services. Article 9(3) allows external operation for the purpose of receiving reports, and MENAC reads this narrowly: the technological solution behind the channel, and only that, may be outsourced. Whoever operates it must be independent, impartial, confidential and free of conflicts of interest.

Article 10 requires that internal channels accept reports in writing and/or verbally, anonymously or with identification. Where verbal reports are accepted, they must be possible by telephone or other voice messaging, and, if the reporter asks, at an in-person meeting. Reports may be submitted using electronic authentication with the Cartão de Cidadão or Chave Móvel Digital, or equivalent means from other member states.

The deadlines

Article 11 governs internal reports and gives three numbers worth memorising:

• Seven days to acknowledge receipt of your report, and at the same time to tell you clearly and accessibly what the requirements, competent authorities and procedures are for an external report.
• Three months, at most, from receipt, to tell you what measures are planned or have been adopted, with reasons.
• Fifteen days after the analysis concludes, if you ask, to tell you its result. You can ask at any time.

Article 15 mirrors this for external reports to competent authorities: seven days to acknowledge (unless you asked them not to, or they reasonably believe acknowledgement could compromise your identity), and three months to report back, extended to six where the complexity justifies it, with the same fifteen-day rule on request.

These deadlines are not decorative. Missing them is one of the article 7(2) triggers that unlocks an external report, and it is separately an administrative offence.

Where external reports go

Article 12 sends external reports to whichever authority has competence over the subject matter, and lists: the Ministério Público (Public Prosecution Service), criminal police bodies, the Banco de Portugal (Bank of Portugal), independent administrative authorities, public institutes, inspectorates-general and equivalent central State services with administrative autonomy, municipalities, and public associations.

If you pick the wrong one, article 12(2) requires it to forward your report to the right one and notify you, and the receipt date becomes the date the competent authority received it. Where no authority has competence, or where the report targets a competent authority itself, it goes to MENAC; where MENAC is the target, it goes to the Ministério Público. If the matter is a crime, you can always use the external channels of the Ministério Público or a criminal police body.

Article 14 lets authorities archive a report without follow-up, by reasoned decision notified to you, where the infringement is of minor gravity, insignificant or manifestly irrelevant; where the report repeats an earlier one without new elements of fact or law; or where it is anonymous and discloses no indications of an infringement.

Article 16 requires every competent authority to publish, in a clearly identifiable separate section of its website, the conditions for protection, contact details for its channels (including whether calls are recorded), the procedures, the confidentiality regime, the types of follow-up measures available, the routes of redress against retaliation, the availability of confidential advice, and the conditions under which a reporter incurs no liability. Article 17 requires them to report annually to Parliament by the end of March on the number of external reports received, proceedings opened and their outcomes, and the nature of the infringements reported.

Confidentiality and records

Article 18 makes your identity, and any information from which it could be directly or indirectly deduced, confidential and restricted to the people responsible for receiving and following up reports. That duty extends to anyone who receives information about a report, even someone with no responsibility or competence for it.

Your identity may only be disclosed as a result of a legal obligation or a judicial decision, and disclosure must be preceded by written notice to you giving the reasons, unless providing that notice would compromise related investigations or proceedings.

Article 20 requires reports to be recorded and kept for at least five years, and for longer while related judicial or administrative proceedings are pending. Verbal reports made on a recorded line may be preserved by recording or by complete and accurate transcription, with your consent; where recording is not possible, a faithful written record must be made; the same applies to in-person meetings. In each of those cases you have the right to see, correct and approve the transcript or minutes and to sign them.

Retaliation: the two-year presumption

This is the core protection, and it is stronger than most people expect.

Article 21(1) prohibits acts of retaliation. Article 21(2) defines retaliation as an act or omission that, directly or indirectly, occurs in a professional context, is motivated by an internal report, external report or public disclosure, and causes or may cause the reporter unjustified material or non-material harm. Threats and attempts count too.

Then comes article 21(6), which is the provision that does the real work. The following acts are presumed to be motivated by the report, unless the employer proves otherwise, where they occur within two years of the report or public disclosure:

• changes to working conditions, including duties, hours, place of work or pay; failure to promote; or breach of employment duties;
• suspension of the employment contract;
• a negative performance appraisal, or a negative employment reference;
• failure to convert a fixed-term contract into a permanent one, where the worker had legitimate expectations of conversion;
• non-renewal of a fixed-term contract;
• dismissal;
• inclusion on a list, based on a sector-level agreement, that could make it impossible for the reporter to find work in that sector or industry in future;
• termination of a supply or services contract;
• revocation of an administrative act or termination of an administrative contract.

Article 21(7) adds that any disciplinary sanction imposed on a reporter within two years of the report is presumed abusive.

The practical effect is a reversal of the burden of proof. In an ordinary dispute over a dismissal or a demotion, the worker generally has to establish the employer's motive. Here, once you show that you reported and that one of the listed acts followed within two years, the employer has to prove the act had nothing to do with it. That is a genuinely difficult thing for an employer to do, and it is the single most valuable feature of the regime.

Anyone who retaliates owes compensation for the damage caused (article 21(4)), and you can separately apply for whatever interim measures are appropriate to prevent harm occurring or spreading (article 21(5)). The same protections extend to the facilitators, connected third parties and entities covered by article 6(4).

What you are not liable for

Article 24 is the provision that answers the question most people actually have, which is whether reporting will get them sued.

A report or public disclosure made in accordance with the law's requirements is not, in itself, a basis for disciplinary, civil, administrative-offence or criminal liability. You do not answer for breaching restrictions on communicating or disclosing the information contained in the report. And you are not liable for obtaining or accessing the information that prompted the report, except where obtaining or accessing it was itself a crime.

That last exception is the boundary. Reporting what you saw in the course of your work is protected. Breaking into a colleague's account to go and find it is not.

Article 24(4) preserves liability for acts unrelated to the report, or not necessary to it. Article 3(3) preserves rules on classified information and on religious, medical, legal and journalistic professional secrecy, along with the secrecy of criminal investigations.

Support, and the rights you cannot sign away

Article 22 gives reporters access to legal protection under the general rules, which in practice means the apoio judiciário scheme, and allows them to benefit from witness protection measures in criminal proceedings. Competent authorities must assist each other in protecting reporters, including by certifying, on request, that a person is recognised as a whistleblower under the law. The Direção-Geral da Política de Justiça (Directorate-General for Justice Policy) publishes information on the Portal da Justiça.

Article 26 is short and important: the rights and guarantees in the law cannot be waived or limited by agreement, and contractual provisions that limit or obstruct the making or follow-up of reports, or public disclosure, are void. A confidentiality clause in your contract or in a settlement agreement cannot lawfully stop you using this regime.

Article 25 protects the person accused. Their procedural rights, including the presumption of innocence and criminal defence guarantees, are untouched, and the confidentiality rules protecting your identity also protect theirs. Note article 25(3): a facilitator is jointly liable with the reporter for damage caused by a report made in breach of the law's requirements.

What it costs an organisation to get this wrong

Article 27 creates two tiers of administrative offence.

Very serious offences, punishable by fines of 1,000 to 25,000 euros for individuals and 10,000 to 250,000 euros for legal persons, are: obstructing the making or follow-up of a report contrary to article 7; retaliating against a reporter or a protected connected person; breaching the confidentiality duty in article 18; and communicating or publicly disclosing false information.

Serious offences, punishable by 500 to 12,500 euros for individuals and 1,000 to 125,000 euros for legal persons, run to nineteen separate items. They include having no internal channel at all; having one that fails the article 9 guarantees on completeness, integrity, preservation, confidentiality, anonymity or access control; receiving or following up reports without independence, impartiality or freedom from conflicts of interest; running a channel that does not allow all workers to report, or does not allow both identified and anonymous reports, or does not allow both written and verbal reports; refusing an in-person meeting where verbal reports are accepted; missing the seven-day acknowledgement or the information duties attached to it; failing to tell the reporter the result of the analysis when asked; and failing to register or keep reports for five years.

Attempts are punishable, and so is negligence, with the maximum fines halved in each case. Enforcement sits with MENAC under article 29, except where the entity falls under a sector-specific regime, in which case the sectoral regulator with sanctioning powers handles it.

A practical checklist

1. Check the subject matter first. If what you have seen does not fall within article 2, this regime is not your route, and a different one probably is.
2. Find out whether your employer has an internal channel. Organisations with 50 or more workers are required to have one and to publicise it. If there is none, that alone entitles you to go external.
3. Use the internal channel unless one of the five article 7(2) exceptions applies. If you are relying on an exception, be clear in your own mind which one, and keep the material that supports it.
4. Report in writing where you can, and keep a copy. If you report verbally, exercise your article 20(6) right to see, correct, approve and sign the transcript.
5. Diarise the deadlines. Seven days for acknowledgement, three months for a substantive response. Their expiry is what unlocks the next stage.
6. Record what happens to you afterwards. Every change to duties, hours, place of work, pay, appraisal or contract status in the two years following the report sits inside the article 21(6) presumption, and dated contemporaneous notes are what make that presumption usable.
7. Do not go to the press first. Article 7(4) is unforgiving, and public disclosure is the last step in the sequence, not the first.
8. Take advice before you act if the stakes are significant. The interaction between this regime, your employment contract and any sector-specific rules is where the real difficulty lies, and article 3 makes clear that a more favourable regime elsewhere prevails.

Portuguese employment law more broadly, including the contract types, notice periods and pay rules that sit behind any retaliation claim, is covered in our guides to your employment contract and payslip and to non-compete and stay clauses. Employers setting up a channel for the first time will find the surrounding obligations in our guide to hiring your first employee.

Sources: Lei n.º 93/2021, de 20 de dezembro, consolidated text, articles 1 to 31; the Mecanismo Nacional Anticorrupção's published frequently asked questions on the Regime Geral de Proteção de Denunciantes de Infrações. Accurate as at 9 September 2026.