Cyprus employment series: Employers' obligations and whistleblower protections under Cyprus Law

The protections granted under the Law also extend to facilitators, third parties connected to whistleblower employees, such as colleagues or relatives, and legal entities associated with said employees.

The Law mandates that certain entities are required to establish reporting channels for employees to be able to report any relevant breaches of EU or Cyprus law that they may encounter. This includes public and wider public sector entities (with some exceptions), private companies with 50 or more employees, and private companies employing fewer than 50 employees but which are engaged in certain industries stipulated under the Law (eg, financial services). Entities that fall outside the scope of the Law, are not required to set up reporting channels although it is still recommended to have these in place as a matter of best practice.

1. Internal reporting which involves disclosing information to a designated service, department, or person within the organisation
2. External reporting which involves disclosing information to a competent authority, ie a state entity responsible for receiving and investigating such complaints

Employers have an obligation to put certain procedures/policies in place in relation to both reporting channels and have these be effectively communicated to their employees. It is noted that while employees are encouraged to utilise internal reporting mechanisms first, they can resort to external reporting if they so wish, noting, however, that where both internal and external reporting is utilised, employees must inform the internal channel about the external report as well.

In relation to internal reporting, employers must provide details in relation to the verbal and written reporting options that employees have at their disposal. For instance, for verbal reporting this entails providing phone numbers, access to personal meetings, and the possibility to have discussions recorded on voice recording devices subject to the whistleblower’s consent. Written reporting on the other hand, requires providing email accounts, forms, and fax details for reporting.

In relation to who an internal report may be made to, concerned entities may appoint either their Head of Compliance, Head of Human Resources, Integrity Officer, Legal or Privacy Officer, Chief Financial Officer, Chief Audit Executive, Member of the Board, or a third party such as a trade union representative as their reporting channel. It is crucial that any report made, must be followed up to determine the accuracy of the allegations and, where relevant, the allegations should be addressed through actions such as an internal inquiry, an investigation, prosecution, referral to a competent authority, communication with the whistleblower, or closure of the procedure.

Moreover, the Law sets out strict parameters with respect to the safeguarding and keeping confidential the identification details of the whistleblower, any trade/business secrets that may be included in the reporting and any personal data. In connection to the aforementioned, employers must ensure the due and proper safekeeping of all data, information, and documents, including any voice recordings or minutes that may have been obtained under a recording process. Finally, it is imperative that employers ensure protection for employees against dismissal or any adverse actions as a consequence of their reporting.

Failure by an employer to comply with the provisions of the Law may lead to the imposition of substantial penalties, which range from a fine of up to €30,000 or, in more serious cases, three years of imprisonment, or both.

For more information on this subject, please reach out to the authors or your usual Harneys contact.