Cyprus whistleblowing channels: an employer setup checklist

Check scope before choosing a platform

The government’s employer guide explains the internal-reporting framework and the types of entities covered. Assess the entity, workforce and sector, and distinguish reports within the law’s scope from ordinary HR grievances without assuming that one label decides the matter.

Protection depends on the applicable conditions. Do not advertise every allegation as automatically protected, or discourage a report because the person has not already proved the breach.

Basis and guidance: Cyprus government: employer whistleblowing guide

Design confidential and impartial handling

The Cyprus public audit-oversight authority’s whistleblower information explains the statutory protection framework and reporting routes. Internal procedures should identify who receives reports, how conflicts are managed and when external channels may be relevant.

A policy should not imply that employees must always report internally before using an available external route. Public disclosure has its own conditions and should not be equated with routine internal reporting.

Basis and guidance: CyPAOB: whistleblower protection and reporting

Test the process behind the channel

Use a controlled test report that contains no real allegation or unnecessary personal data.

• Limit access to authorised handlers and define a substitute for absences.
• Provide clear reporting instructions and the available written or oral arrangements.
• Apply the statutory acknowledgement and feedback timetables.
• Assess conflicts and route reports away from anyone implicated.
• Keep proportionate, secure records and a justified retention approach.
• Explain confidentiality limits accurately without promising absolute secrecy.
• Train managers to recognise and prevent retaliation.
• Document follow-up, communication and closure decisions.

Plan for a report about a senior manager

Hypothetical example: the only person reading the reporting mailbox is the manager named in the report. The business needs an alternative impartial route and restricted access; changing the mailbox label does not solve the conflict.

Review the process when the workforce grows, a regulated activity is added or handlers change. A vendor can supply technology, but the organisation still needs competent decisions, timely follow-up and protection in practice.

Primary sources and scope

Sources checked: September 26, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Cyprus government: employer whistleblowing guide
• CyPAOB: whistleblower protection and reporting
• Cyprus Law 6(I)/2022