13/10/2026
Handling a report of a possible breach of the law involves more than recording a complaint and sending a reply. Organisations must ensure the confidentiality of the information, an impartial examination of the facts and respect for the rights of everyone involved. At the same time, any administrative or disciplinary measures adopted subsequently must have an objective justification and must not amount to a reaction to the report that was made.
Law No 361/2022 on the protection of whistleblowers in the public interest lays down a set of obligations for the entities within its scope, in both the private and the public sector. Complying with these obligations requires functioning procedures, clearly designated persons in charge and a careful distinction between the investigation of the report and the exercise of the employer's ordinary prerogatives.
When an organisation receives information about a possible breach of the law, the first step must be to identify the nature of the report and how it should be handled.
Not every professional grievance, disagreement between colleagues or individual complaint automatically constitutes a report within the meaning of Law No 361/2022. Its classification depends on the content of the information, the nature of the facts reported and whether the applicable legal conditions are met. Consequently, the analysis should not be limited to the title of the document or the channel through which it was sent.
If the report falls within the scope of the law, the organisation must follow the corresponding procedure, without delaying the examination solely because of formal issues that can be clarified in accordance with the law.
For entities required to establish an internal reporting channel, the procedure must allow reports to be received and recorded, examined, followed up and information to be communicated to the whistleblower. Handling must be entrusted to a designated person, department or third party, who acts impartially and independently in performing those duties.
It should be stressed that the obligation to set up an internal channel does not apply to all employers on the same terms. The law lays down criteria based on the number of workers and provides for specific obligations for certain entities and sectors of activity. These criteria must be checked specifically for each organisation.
The identity of the whistleblower and any information that could lead to their identification enjoy legal protection. Under the conditions laid down by law, their identity may not be disclosed to unauthorised persons, and any exceptions must be interpreted strictly and applied with due regard for the legal safeguards.
This obligation is not limited to the person designated to handle reports. It must be reflected in the way the organisation receives documents, sets access rights, passes information between departments and keeps the related records.
In practice, a report sent to a general e-mail address, to a line manager or to a department with no responsibilities in this area may reach people who should not have access to its content. Such a situation must be handled with care, preserving confidentiality and following the rules for forwarding the report to the competent person.
Protection is not limited to the whistleblower. The person concerned by the report and the third parties mentioned in it also benefit from the confidentiality safeguards provided by law. These safeguards do not remove the procedural rights of the person concerned, nor the obligation to examine the reported facts objectively.
At the same time, the processing of personal data must comply with the General Data Protection Regulation (GDPR), including the principles of data minimisation, restricted access and security of processing. Data that are neither relevant nor necessary for resolving the report should not be retained without justification.
Meeting deadlines is an essential part of handling reports. An organisation may have a well-drafted formal procedure, but that is not enough if there are no mechanisms for actually tracking deadlines and responsibilities.
For internal reports, Law No 361/2022 essentially sets the following benchmarks:
The three-month period should not be confused with a general obligation to complete every investigation within that time. The law requires information on the status of the follow-up action and separately regulates the obligations to communicate the outcome.
Where a report does not contain sufficient information for analysis, the statutory rules on requesting additional information and on closing the case may apply. Anonymous reports cannot be rejected automatically merely because identification details are missing: they are examined and dealt with insofar as they contain indications of breaches of the law.
From an organisational perspective, it is advisable to keep a separate record for each report, showing the date of receipt, the person responsible, the applicable deadlines, the action taken and the communications made.
Receiving a report does not mean that the facts reported have been proven. The information must be verified, and the conclusions must be based on relevant evidence obtained and assessed in accordance with the law.
The designated person must avoid both unjustifiably downplaying the report and automatically accepting the allegations made. Where the report concerns the organisation's management, the designated person or other persons who could influence the examination, any conflicts of interest must be identified and properly managed.
Depending on the nature of the facts, follow-up action may involve analysing documents, requesting clarifications, checking the relevant operations or referring the matter to the competent authorities, where the law or the circumstances so require.
At the same time, the rights of the person concerned by the report must be protected, including the right to be heard and the right of access to their own file, under the conditions and within the limits laid down by law. These safeguards must be applied without compromising the whistleblower's confidentiality or the effectiveness of the checks.
Thorough documentation of each stage is important both to justify the solution adopted and to demonstrate compliance with legal obligations in the event of an inspection or a dispute.
One of the most delicate situations arises when the person who made the report is, at the same time, subject to a performance appraisal, disciplinary proceedings or other measures ordered by the employer.
The protection afforded to whistleblowers does not mean that they are exempt from their professional obligations, nor that any misconduct committed after or before the report has no consequences. The employer retains its statutory prerogatives to organise work, assess performance and impose sanctions, subject to the applicable conditions.
However, those prerogatives cannot be used to disadvantage a person in reaction to a report protected by law.
Consequently, the mere chronological sequence between a report and a professional measure is not in itself sufficient to establish, in every case, that retaliation has taken place. The specific circumstances, the real reasons for the measure and its connection with the report must be examined.
If there are grounds unrelated to the report for initiating disciplinary proceedings, those grounds must be genuine, verifiable and properly documented. Opening a disciplinary investigation must not be a reaction to the report, nor a means of discouraging others who might report wrongdoing.
The same standard applies to performance appraisals, changes in duties, access to promotion opportunities and any other decisions that may affect the whistleblower's professional position.
Article 22 of Law No 361/2022 prohibits retaliation against public interest whistleblowers. The prohibition covers a wide range of conduct, from dismissal, suspension of the employment relationship and pay cuts to disciplinary sanctions, intimidation, harassment, discrimination, unjustified negative performance appraisals and any other unfavourable treatment caused by the report.
Under certain conditions, the whistleblower may challenge the measures in court and seek the remedies provided by law. These may include annulment of the measure, restoration of the previous situation, payment of salary entitlements and compensation for the damage suffered, depending on the nature of the measure and the applicable legal framework.
A particularly important element is the burden of proof. In the proceedings provided for in Article 23 of Law No 361/2022, it is for the employer to prove that the contested measure is justified by reasons other than those connected with the report. It is therefore not enough to refer generally to performance issues: the justification must be capable of being supported by evidence.
The law also provides for the possibility of provisionally suspending certain contested measures, subject to the applicable procedural conditions, and for additional consequences where the same person has repeatedly been subjected to retaliation for the same report or public disclosure. In the latter case, the court may, as provided by law, impose a civil fine of up to RON 40,000.
Risks must be assessed case by case, since the remedies and the conditions for their application depend on the nature of the measure, the existing legal relationship and the specific circumstances.
Preventing problems is not achieved solely by adopting a written procedure. The organisation must ensure that the reporting mechanism actually works and that those involved know their responsibilities.
To that end, it is useful to check regularly that the internal procedure complies with Law No 361/2022, including as regards the designated persons, communication channels, response deadlines, confidentiality rules and the record of reports.
Management and the human resources, legal, compliance and data protection departments must also know the limits of their own competences. Access to reports must be granted only to authorised persons, and checks must be organised in such a way as to prevent conflicts of interest.
Before adopting a measure that may affect a whistleblower's professional position, it is prudent to review the documents on which it is based, the time at which the facts were established and whether there are objective justifications. This review does not mean automatically suspending the employer's prerogatives, but ensuring that they are exercised lawfully and independently of the report.
In addition, staff training and regular review of procedures can help identify shortcomings early and avoid costly litigation.
Handling integrity reports is a legal and organisational responsibility that cannot be reduced to meeting statutory deadlines or to the formal existence of a communication channel. The effectiveness of the reporting mechanism depends on how it is organised, on the ability of the designated persons to act independently and impartially, and on management's willingness to genuinely examine the wrongdoing reported and, where necessary, to order the measures needed to remedy it.
A compliant approach involves ensuring confidentiality, respecting the rights of all persons involved, verifying the information received objectively and properly documenting each stage of the procedure. At the same time, the organisation must pay attention not only to resolving the report, but also to how its professional consequences are managed, so that no subsequent decision constitutes a direct or indirect form of retaliation.
At the same time, whistleblower protection does not remove liability for any misconduct unrelated to the report, nor does it prevent the employer from exercising its statutory prerogatives. The line between a legitimate measure and a retaliatory one must be drawn by reference to the specific circumstances, the reasons that led to the measure and the evidence supporting them. In this context, objective grounds and documented decisions become essential for reducing the risk of litigation and defending the organisation's legal position.
For employers, therefore, preventing risks requires more than drafting an internal procedure. The procedure must be integrated into the organisation's day-to-day activity by setting clear responsibilities, training those involved, regularly checking compliance and establishing mechanisms through which any conflicts of interest can be identified and properly managed.
Ultimately, a functioning reporting system should be seen not only as a legal obligation, but also as a tool for detecting wrongdoing early and strengthening organisational accountability. The way an entity handles such a report can affect both respect for the rights of those involved and employees' trust in internal control and compliance mechanisms. Preventive conduct, transparent within the limits of the law and supported by well-founded decisions, is the safest approach to striking a balance between whistleblower protection and the legitimate exercise of the employer's rights.
Author: P.A.
