Whistleblower law in Greece #

Greece implemented Directive (EU) 2019/1937 through Law 4990/2022. The Greek framework combines the standard private-sector threshold with a named internal reporting officer and an external channel operated by the National Transparency Authority.

Applicable law #

Who must establish an internal channel #

Private-sector employers with 50 or more workers must establish an internal channel and appoint a reporting officer (ΥΠΠΑ — Υπεύθυνος Παραλαβής και Παρακολούθησης Αναφορών).
Entities in the financial-services, transport, and environmental sectors are in scope regardless of headcount.
Public bodies are also in scope.

Deadlines: 11 May 2023 for employers with 250+ workers, 17 December 2023 for the 50-249 band; the public sector had six months from entry into force. The appointment of the reporting officer must be notified to the Labour Inspectorate within two months.

Penalties and enforcement #

Greece operates two distinct penalty tracks, and they are frequently confused — the distinction matters.

Failing to establish the channel / designate the reporting officer (Art. 9(13)): the statute fixes no specific amount. The fine and its criteria were delegated (Art. 24) to a joint ministerial decision that had not been issued as of early 2025, so this penalty was not yet operational. It is imposed by the Labour Inspectorate, not the National Transparency Authority.
Obstruction, retaliation, malicious proceedings, or breaching a reporter’s confidentiality (Art. 23(5)): an administrative fine of €10,000–500,000 on a legal entity when such conduct is committed for its benefit, graded by severity — alongside possible criminal sanctions.

An honest assessment of enforcement. The often-quoted “€500,000” ceiling attaches to retaliation and obstruction conduct — not to simply lacking a channel, whose penalty amount remained undefined pending secondary legislation. No company has been publicly identified as fined or sanctioned under either track. The National Transparency Authority received 79 external reports in 2023, so the external channel is operating, but no public sanction outcomes have surfaced. The real exposure is therefore reputational and operational — a report reaching the external authority with no internal channel in place — rather than a predictable fine.

External reporting authority #

The official external channel is the National Transparency Authority , which receives reports under Law 4990/2022 and publishes implementation material for obliged entities.

Data protection authority #

For complaints about unlawful handling of personal data or confidentiality issues, the relevant authority is the Hellenic Data Protection Authority .

Key compliance points #

Greek implementation material expects written, oral and meeting-based intake options.
The reporting officer is a named compliance role, not just a generic mailbox.
Official Greek guidance states that private entities in the 50-249 band may use shared reporting officers for intake.

Official sources #

Deploy your reporting channel →

Last updated: June 1, 2026