Romanian whistleblower protection law "Legea 361/2022"

Romania brought the EU Whistleblower Directive into national law with Legea 361/2022, in force since 22 December 2022. The law calls a whistleblower an avertizor în interes public. It sends outside reports to the National Integrity Agency. And it caps fines at a modest 40,000 lei, after Parliament needed two tries to pass it.

Why did Romania need a second attempt to pass the law?

Because the first version was sent back. Parliament passed a transposition in the summer of 2022. On 28 July 2022, President Klaus Iohannis returned it for a fresh reading. He warned that a weak transposition could trigger an EU infringement case and put European funds at risk.

The loudest complaint was about anonymous reports. Critics said the first text gave them too little cover. Civil society groups, the opposition party USR, and the European Commission all pushed back. They also flagged unclear rules on reporting classified information.

A revised text answered much of that. Parliament adopted it on 13 December 2022. The President signed it, and it took effect on 22 December 2022. So Romania ended up with a stronger law than the one it started with, though it landed a year after the Directive's deadline.

What does Legea 361/2022 cover?

Breaches of the law in the fields the EU Directive lists. The law sets a general frame for reporting wrongdoing inside both public bodies and private firms. It points to a long annex of covered areas. It then leaves the special reporting rules in other statutes in place where those rules already bite.

"This law constitutes the general framework for the protection of persons who report breaches of the law, which have occurred or are likely to occur, within public authorities and institutions, other public-law legal entities, as well as within private-law legal entities."
Article 1, Legea 361/2022

The covered fields are wide. They run from public procurement and financial services to money laundering, product and transport safety, the environment, nuclear safety, food and animal welfare, public health, consumer protection, and data privacy. Reports that touch the EU's financial interests or the single market are in scope too.

Some matters sit outside the law. It does not override the rules on classified information, a lawyer's professional secret, medical confidentiality, the secrecy of judicial deliberations, or criminal procedure. It also leaves untouched the right of workers to consult their unions.

Who counts as an avertizor în interes public?

Anyone who learns of a breach through their work. The job title does not matter. What matters is the work context that put the information in front of you. The law spells out a broad list of people it protects.

The shield reaches:

• workers in a labour or service relationship;
• the self-employed and independent contractors;
• shareholders and members of management or supervisory bodies, including non-executives;
• volunteers and interns, paid or unpaid;
• anyone working under a firm's contractors and suppliers.

Timing does not break the cover either. A former worker is protected when the news comes from a job that has ended. So is a job applicant who learns of a breach during hiring. The law also protects facilitators who help with a report, plus colleagues and relatives who could face payback.

One point drew real attention during the law's rocky passage. The final text protects people who report anonymously. If such a reporter is later identified and then suffers payback, the law still stands behind them.

"This law also applies to persons who report or publicly disclose information on breaches of the law anonymously."
Article 2, Legea 361/2022

Where do reports go, and what is ANI's role?

Reports can travel two routes. A worker can use the employer's internal channel or go straight to an external authority. The choice is theirs. The law tells them to weigh the risk of payback and the chance the breach gets fixed inside before they pick.

The central outside body is the National Integrity Agency, known as ANI. The agency runs a dedicated unit for these reports. Its staff, called integrity inspectors, register each case, keep it confidential, and pass it to the right competent authority when another body should handle it. Several sector regulators also take reports in their own fields.

ANI has a softer job too. It gives confidential advice to people who are weighing a report. It trains the staff that firms put in charge of handling them. And it publishes yearly figures on how many reports come in and what comes of them.

Deadlines bind the outside track as well. ANI must confirm a report within 7 calendar days. It must tell the reporter what it has done within 3 months, or 6 months in complex cases. Reports stay on file for five years.

When can a whistleblower go public?

Only as a last resort, and only in set cases. Going public means handing the story to the press, an NGO, a union or trade body, or a parliamentary committee. The law protects that step, but it guards it tightly. A reporter who skips the conditions loses the law's cover.

A public disclosure is protected when:

• the reporter used the internal or external route first and got no proper action in time;
• the breach is an imminent or clear danger to the public interest; or
• an outside report would risk reprisals or stand little chance of fixing the breach.

So a reporter cannot run straight to a journalist on day one and expect the shield. They have to try the proper channels, or show a real reason why those channels would fail. That order keeps the law's protection tied to a genuine attempt to get the wrong put right.

How do you set up the internal reporting channel?

If you run a public body, you need one whatever your size. Private firms need one once they reach 50 employees. Some firms must run a channel no matter their headcount, such as those under financial and anti-money-laundering rules. Firms with 50 to 249 staff can share a channel to save cost.

The channel comes with firm duties. It must keep the reporter's identity secret and block anyone who is not cleared to see the file. You must name a person, a team, or an outside party to handle reports. You must confirm each report within 7 days and give feedback within 3 months.

"[The procedure must include] the obligation to send the whistleblower confirmation of receipt of the report within no more than 7 calendar days from receiving it."
Article 10, Legea 361/2022

WeMoral runs that whole internal channel for you, and it carries out what Legea 361/2022 asks of it. You name the person or team who handles reports, and each report stays sealed to them alone. The law lets a private firm hand the work to an outside party, so WeMoral can sit in that seat just as well as your own appointee. It logs every step with a timestamp and holds the file for the five years the law sets, so the record is ready the day an ANI integrity inspector asks how your channel runs. It is tamper-evident whistleblowing software that needs nothing installed, and you can get an internal channel running in a day.

How does Romania protect whistleblowers from retaliation?

With a broad ban and a reversed burden of proof. The law forbids any payback tied to a report. Once a worker shows they reported and then suffered harm, the employer has to prove the harm had another cause. A court can even suspend a contested measure while the case runs.

The law lists the acts it treats as payback, including:

• dismissal, suspension, or demotion;
• cuts to pay or changes to working hours;
• a withheld promotion or a negative review;
• harm to reputation, including on social media;
• blacklisting across an industry.

Three safeguards stand out as Romania's own. The local bar gives a reporter free legal aid during a disciplinary case or a court fight over reprisals. At the reporter's request, the disciplinary panel must invite the press and a union or staff representative into the room. And a court that finds retaliation must order the employer to publish an extract of the ruling, at its own cost, in a newspaper and online.

"[The court] shall order, in all cases, the publication, at the employer's expense, in a local or national newspaper, of an extract of the decision establishing that a measure under Article 22 was unlawfully taken."
Article 23, Legea 361/2022

A reporter who follows the law also carries no liability for the report itself. They have a right to full repair of any harm the report caused them. These rights cannot be signed away, and any contract clause that tries to block a report is void.

What are the penalties for breaking the law?

Fines that top out at 40,000 lei, roughly 8,000 euros. ANI's integrity inspectors find the breaches and set the fines, which go to the state budget. The table below shows the main offences and the range for each.

There is one more financial stick. If a court finds an employer hit the same reporter with payback at least twice, it can add a civil fine of up to 40,000 lei on top. Even so, the ceilings stay low next to peer states. Portugal fines a firm up to 250,000 euros, and Spain up to one million.

Romania's law tells a two-sided story. Its financial teeth are blunt, yet its transparency reflexes are sharp. Few countries make a boss seat the press at a disciplinary hearing or print a losing judgment in the paper. That instinct grew straight out of the fight that nearly sank the bill, the fight over whether someone could come forward without giving a name. For an employer the task is plain. Name a handler, keep every report sealed for five years, and treat any sanction near a report as one you may have to justify in open court. To see how Romania lines up with the rest of Europe, read our guide to whistleblower laws by country.