Whistleblowing Law in Cyprus: An effective tool to enhance transparency and employee's protection in the workplace


On 16 December 2019, the European Union adopted an important Directive on the protection of persons who report breaches of Union Law, Directive (EU) 2019/ 1937, the “Whistleblowing Directive” which was transposed into national law on 4 February 2022, the Protection of Persons Reporting Breaches of Union and national Law of 2022 (“the Whistleblowing Law”) or (“the Law”).

A ‘whistleblower’ is a person who discloses and reports insider information on illegal activities occurring within an organisation and are harmful to the public interest, such as an employee revealing acts of corporate tax infringements. A breach is any violation or infraction of a law affecting the public interest and creating significant risks for the welfare of the society. The breaches mentioned by this Law cover the following areas: public procurement, financial services, products and markets, and prevention of money laundering and terrorist financing, product safety and compliance, transport safety, protection of the environment, radiation protection and nuclear safety, food and feed safety, animal health and welfare, public health, consumer protection, protection of privacy and personal data, and security of network and information systems, breaches affecting the financial interests and internal market of the European Union.

As insiders within a private or public organisation, whistleblowers may unveil any information on unlawful patterns of action or behaviour of which the board of directors or compliance officers or other regulators might not otherwise be aware. Entities that are subject to such activities are held civilly and criminally liable. As a result, they can be inflicted with huge fines that can cause loss or disruption of businesses and harm their reputation.

Individuals aware of any misconduct within the workplace have to be manned with strong, effective tools on how to alert the appropriate or competent people within the organisation or any governmental authorities. They have to know if the alleged action falls within the scope of reportable misconducts, what are the procedures of reporting, how their report will be handled, if they can maintain their anonymity and if they are protected effectively against retaliation. Additionally, legal entities have to establish internal channels of reporting, secure that the investigations are carried out properly and that the whistleblowers will remain protected against any form of harassment.

The purpose of the Whistleblowing Law is to encourage individuals to report these fraudulent, illegal activities and to entice organisations to set up adequate procedures for transparency, fairness and high-level protection of employees in the private and public sector.

First and foremost, it is essential to analyse the scope and conditions of application of the Whistleblowing Law as well as the internal, external procedures of reporting and public disclosure. Secondly, it is worth mentioning that the protective measures enumerated by this Law and their effectiveness.

Applicability of Whistleblowing Law and channels of disclosure

Protection applies to a wide spectrum of individuals aware of any activity violating the EU Law in a work-related context, including employees having the status of worker within the meaning of Article 45 TFEU, individuals who are pursuing activities as self-employed persons according to Article 49 of TFEU, shareholders, executive and non-executive members of a company, volunteers, paid or unpaid trainees, individuals working with contractors, subcontractors and suppliers. The article extends the protection to reporting persons whose employment relationship has ended and to those who became aware of the reportable information during the recruitment process and pre-contractual negotiations. Furthermore, the Law applies to facilitators, to third-parties related to the reporting persons who could be confronted with retaliatory measures - this broad coverage shows that the legislator acknowledges that not only the reporting persons may face negative consequences but also individuals connected to them, raising the standard of protection to a higher level - and as well to organisations connected with reporting persons in a work-related context.

All the abovementioned individuals are able to invoke the protection granted by the Whistleblowing Law if certain requirements are fulfilled. Firstly, the reporting persons must have reasonable grounds to believe that the information reported was true at the time of reporting and secondly, that the information reported falls within the breaches enumerated by Law. If these criteria are met, then the whistleblower enjoys full protection whether the reporting of the information was made internally, externally or publicly. Needless to say, individuals who have reported information on breaches of the EU Law anonymously, but have been exposed and encounter retaliation, are eligible for full protection under this Law.

One of the important features of the present legal framework is the reporting procedures based on the three-tiered whistleblowing model which is composed of internal, external and public reporting channels. Companies with more than 50 employees are obliged to implement internal reporting channels through which employees can communicate infringements of the EU law. Internal reporting process may be entrusted to a person or department designated for reporting or may be provided externally by a third party. Legal entities have to choose either an impartial person or department to follow-up on the reports or they can have the same person or authority as the one, previously mentioned, receives the reports and ensures communication with the reporting person. The competent authority or person must acknowledge to the whistleblower that the report was received within seven days from the reporting it by the whistleblower and feedback must be provided within a period of three months from the acknowledgement of the receipt or, in case that no acknowledgement was given to the reporting person, three months from the expiry of the seven-day period that the report was made. Whistleblowers can report in writing and/or verbally, via voice messaging systems and, at their request, by means of a physical meeting.

External reporting is when the information on violation of EU law is reported outside of one’s workplace to a competent authority. The employee has the option to either report to a designated person within the company or to external competent authorities. Whereas the follow-up procedures in internal reporting are required, the Law outlines that in case of external reporting, authorities have the option to disregard the obligation to acknowledge receipt of the report if this would endanger the protection of the reporting person’s identity. In any case, the external authority has to provide feedback within a period of three months and this timeframe might be extended to six months in duly justified cases.

Finally, whistleblowers can disseminate information through one or more public channels, such as the media, internet platforms or civil society organisations. For the protection to apply, public disclosures must fulfil any of the following conditions. Firstly, reporting persons have to make the information public as a last resort, in case that all other reporting channels fail to bring any outcome. Secondly, public divulgence is permissible only if the person has reasonable grounds to believe that the violation of the EU law will put at great risk the public interest or cause irreversible damage. Additionally, persons can report publicly if they are strongly convinced that countermeasures will be taken against them or that the breach reported will be concealed or destroyed due to the particular circumstances of the case.

Even though the whistleblowing system serves the public interest, individuals who disclose information, are usually delegitimised and suffer from harassment and retaliatory measures. For this reason, the Law prohibits any countermeasures and implements mechanisms to support and secure full safeguard and protection of their rights.

Prohibition of retaliatory measures and supporting initiatives

Any effective policy encouraging whistleblowing must include measures for protecting the reporting persons against adverse actions. In this perspective, the Law lists a number of prohibited retaliatory measures. Such prohibitive actions are suspension, lay-off, dismissal or equivalent measures, demotion or withholding of promotion, change of the working conditions without the consent of the employee, discrimination or disadvantageous or unfair treatment, mobbing, blocking advancement opportunities and a series of actions that would have a negative or even harmful impact on the employee’s reputation or career progress.

Another main component of the whistleblowing protection is the supportive measures provided to the reporting person who is entitled to free of charge advice and information of their rights, to effective assistance before any authority responsible for securing their protection against any act of retaliation as well as legal aid in criminal and in cross-border civil proceedings. Moreover, it is to be noted that the burden of proof, in case of legal proceedings, is fully reversed which is essential to ensure a fair trial. The employees who enforce their whistleblowing right have to bring to court evidentiary facts to support that the retaliatory measures inflicted on them are the result of their reporting action and employers have to show convincing evidence that their decisions are based on legitimate reasons without any link to protected reporting or disclosure.

Reporting persons shall not be held liable regarding the information divulgated internally, externally or publicly, provided that they had reasonable grounds to believe that the reporting of such information was necessary for revealing a breach recited by the Law and/or they shall not incur any liability concerning the acquisition of or the access to the information reported unless such information was received in the event of a criminal offence. In this case, criminal liability will continue to persist by virtue of national law.

It is necessary to state that, during investigation and public disclosure, the identity of reporting persons remains secretive and is only revealed with the explicit consent of these persons to members of authorities competent to receive or follow-up reports. Any processing of personal data must be effected in accordance with the data regulations in force and any collection of personal information unrelated to the specific report must be avoided or deleted in case that it was accidentally saved.

To sum up, the Whistleblowing law furnishes the working environment with efficient mechanisms to secure financial market functioning and maintain business integrity. Providing training at all levels of a company on the effective implementation of this whistleblowing tool will help to foster transparency in workplaces and cultivate a highly ethical work culture.

The content of this article is valid as at the date of its first publication. It is intended to provide a general guide to the subject matter and does not constitute legal advice. We recommend that you seek professional advice on your specific matter before acting on any information provided. For further information or advice, please contact us at info@kyprianou.com