Law 4990/2022: Internal Whistleblowing System — Who Must Have One
Law 4990/2022 transposed EU Directive 2019/1937 into Greek law, requiring many employers to run an internal channel where staff can report wrongdoing safely — with real legal protection against retaliation. Here is who is covered and what an internal system actually has to guarantee.
Who is covered
- —Private-sector employers with 50 or more employees at the same time (Article 9, Law 4990/2022) must appoint an Officer for the Receipt and Monitoring of Reports (Υ.Π.Π.Α.).
- —Employers in sectors specifically named by the law and its EU source directive (financial services, transport safety, environmental protection, and others) must do so regardless of headcount.
- —The obligation continues for 2 full calendar years after the year in which headcount first reached 50 — even if you later drop below the threshold.
- —Public-sector bodies, with their own parallel obligations.
Under 50 employees? You may still appoint an Υ.Π.Π.Α. voluntarily — and if you don't, employees can report directly to the National Transparency Authority (Ε.Α.Δ.) instead. Sector-specific extensions are worth confirming case by case.
What the internal system must guarantee
- —A confidential internal reporting channel, accessible to employees and, depending on scope, third parties working with the organisation.
- —Acknowledgement of receipt within a set deadline, and feedback to the reporter within a set period.
- —A designated, impartial person or unit responsible for handling reports.
- —Protection of the reporter's identity, and an explicit prohibition on retaliation (dismissal, demotion, harassment) — with reversal of the burden of proof in the employer's disfavour if retaliation is alleged.
- —Record-keeping of reports in line with data-protection requirements.
Not sure if you are covered, or want a system built correctly the first time? Tell us your size and sector in the free assessment — we will confirm your obligation and outline the internal channel and procedures you need.
Free AssessmentUseful next reads: ISO 37002 · ISO 37001 · GDPR, NIS2 & DORA
Frequently asked questions
Does my business need to comply with Law 4990/2022?
If you employ 50 or more people at the same time, yes — mandatory under Article 9. Below 50, it is voluntary unless you are in a sector named by the law regardless of size. We assess your specific case for free.
Is a piece of software enough, or do I need a documented system?
A reporting tool is only part of it. The law requires defined procedures, response deadlines, a designated handler, and retaliation safeguards — the tool has to sit inside an actual, documented process, not replace it.
How does ISO 37002 fit in?
ISO 37002 is a management-system standard for whistleblowing that maps closely onto what the law requires — designated roles, defined procedures, confidentiality, follow-up. Building your internal system against ISO 37002 gives you both legal compliance and a structure a certification body can later assess if you choose to formalise it.
What happens if I don't comply?
Non-compliance carries administrative sanctions under the law, on top of the reputational and legal exposure of not catching internal misconduct early. We can tell you the specific exposure for your size and sector.