Whistleblowing is the employee's right to report violations of which they are aware, and at the same time an organizational obligation for the employer. The Labor Code recognizes this right in Article 26, paragraph 5, and protects the whistleblower in Article 32, paragraph 6. The special law on whistleblowing, No. 96/2025, requires private entities with more than 50 employees to establish a responsible unit and prohibits any retaliatory action.
This page explains what whistleblowing covers, who is required to raise the alarm, how the whistleblower is protected, and what an internal procedure must include.
Read also: Workplace Conflicts and Defense: The Complete Guide
The Code addresses this topic in two different articles, and both are straightforward.
| Rule | Content | Article |
|---|---|---|
| The right to denounce | The employee may report to the competent authorities any criminal offenses and violations of labor or contractual legislation of which they are aware. | 26, point 5 |
| Duty to report | Anyone who identifies or obtains information about a violation of rights under Article 32 must immediately notify the employer or the relevant authorities. | 32, point 4 |
| The prohibition of revenge | The whistleblower or complainant is not penalized, not dismissed from their job, and not discriminated against for this reason. | 32, point 6 |
Article 26, paragraph 5, is an employee's right and lies at the very core of his obligations. This means that reporting a violation cannot be treated as a breach of loyalty to the employer.
In addition to the Code, there is a special law: Law No. 96/2025 of December 18, 2025, which repealed Law No. 60/2016 on whistleblowing and the protection of whistleblowers.
Two obligations flow from it that directly affect medium and large businesses.
Note: The specific procedures, deadlines for processing whistleblower reports, and sanctions under Law No. 96/2025 should be verified in its published text, as it is new and the implementing regulations may still be under update. This page provides the framework, not the detailed deadlines.
The threshold is the number of employees, not the revenue or the sector.
| Subject | Obligation |
|---|---|
| Private entity with over 50 employees | Raise the unit responsible for signaling. |
| Private entity with 50 employees or fewer | There is no obligation of the unit, but Articles 26 and 32 of the Code remain applicable. |
Even without a formal unit, every employer remains required to accept reports of violations of Section 32 and to refrain from retaliating against the person who makes them.
Read also: Discrimination and harassment at work
The defense comes from two sides at once and is reinforced by the burden of proof.
Their combination makes dismissing a whistleblower one of the riskiest decisions an employer can make, because the employer has to prove for himself that the reason was something else.
Read also: The removal procedure and the burden of proof
This is the functional minimum we build for our clients, based on the logic of sections 26 and 32 and the law's requirement for a responsible unit.
1. Incoming channel. A dedicated address, a physical mailbox, or a form known to all employees.
2. The person or unit responsible, including name and alternate, separate from the direct line of reporting.
3. Confirmation of receipt of the notification, with date and protocol number.
4. Protection of the whistleblower's identity and access restricted to only those who need it.
5. The internal review deadline and notification of the whistleblower on the progress.
6. Record of notifications, with dates, actions taken, and the outcome.
7. The express prohibition of retaliatory actions, displayed alongside the provisions of Article 32.
The processing of data in this procedure falls under personal data protection law, so only the necessary data are collected and retained for as long as needed.
Read also: Internal Regulations and Mandatory Procedures
This distinction keeps the procedure usable and protects it from abuse.
| Element | Signaling | Individual complaint |
|---|---|---|
| Objective | Legal violation or risk to the public interest | The personal right of the employee himself. |
| Who does it? | Anyone who knows | The affected person |
| Road | Responsible unit or competent authorities | The employer, the inspectorate, or the court |
| Result | Stopping the violation and corrective measures | Restoration of the violated right |
Both are driven by revenge, but they follow different logic and shouldn't be mixed up in the same channel.
Reporting a violation of which the person is aware. The Labor Code recognizes this as an employee's right in Article 26, paragraph 5.
Private entities with more than 50 employees, according to Law No. 96/2025 on whistleblowing.
Yes. Article 32, paragraph 6, prohibits his penalization, dismissal from employment, and discrimination against him, while the special law prohibits retaliatory actions.
Employer. This is the same logic as in Article 9, paragraph 10, and Article 105(a), paragraph 2, of the Code.
Yes. Data processing is limited to the necessary personnel and complies with personal data protection laws.
The unit's obligation does not apply, but Articles 26 and 32 of the Code apply to every employer, regardless of the number of employees.
Yes. Article 26, paragraph 5, grants the employee the right to report directly to the competent authorities.
In the published text of Law No. 96/2025 and in the implementing regulations, because it is new and its implementation is being consolidated.
