Romania Recording Laws: All-Party Consent Rules and Penalties (2026)

Romania leans all-party consent: recording a private conversation, including one you are part of, is prohibited by default under Article 226 of the Romanian Penal Code unless you can justify a legitimate interest. Recording a conversation you are not part of at all is a separate criminal offense, typically prosecuted under Article 302 of the Penal Code.

Romania Recording Laws: All-Party Consent With a Legitimate-Interest Exception

Romania leans all-party consent. Article 226 of the Romanian Penal Code makes it an offense, without right, to record a person in a home, room, or dependency, or to record a private conversation anywhere, and the only exception for a participant applies when that participant can justify a legitimate interest under Article 226(4)(a). Law 506/2004, a sector-specific confidentiality law transposing EU Directive 2002/58/EC, is sometimes cited for a broader participant exception, but by its own Article 1(2) it applies to providers of electronic communications networks and services, not to private individuals' recordings, and it does not override Article 226. This means that being a party to a phone call, an in-person conversation, or a video conference held in Romania does not by itself make recording it lawful; you also need a legitimate interest you could articulate if challenged.

This article covers Romanian recording law under the Penal Code (Law 286/2009), the Civil Code (Law 287/2009), the Romanian Constitution (Articles 26 and 28), Law 506/2004, Law 190/2018, the GDPR, and the EU AI Act. It does not address covert recording by Romanian law enforcement, which requires judicial authorization under separate provisions of the Code of Criminal Procedure (Law 135/2010).

Recording a conversation to which you are not a party at all is a separate matter: third-party interception is a criminal offense under Articles 226 and 302 of the Penal Code, with penalties of up to three years imprisonment. But being a party does not, by itself, make a recording lawful either; Article 226(4)(a) still requires a legitimate interest, covered in detail below.

Article 226: Violarea Vietii Private (Violation of Private Life)

Article 226 of the Romanian Penal Code (Violarea vietii private, Law 286/2009) is the primary offense covering recordings made in private spaces and intimate settings. It operates alongside Article 302, which covers correspondence and electronic communication interception. Understanding the distinction between the two articles is essential for a complete picture of Romanian recording law.

Paragraph 1 criminalizes unauthorized harm to private life through photography, image capture, or audio/video recording of a person in a home, room, or dependent space, or of a private conversation, committed without right. The penalty is 1 month to 6 months imprisonment or a fine. The two branches are independent: the offense reaches recordings made in spaces where the subject has a reasonable expectation of privacy (residences, hotel rooms, private offices, or any attached space), and separately reaches audio recording of "a private conversation," which the statutory text does not tie to any particular location. In practice this means a private conversation held in a car, restaurant, or other setting outside the home can still fall under Paragraph 1 if its content is private in character.

Paragraph 2 criminalizes unauthorized disclosure or transmission of the sounds, conversations, or images captured under Paragraph 1 to another person or to the public. The penalty increases to 3 months to 2 years imprisonment or a fine. A person who lawfully witnesses a private conversation but then shares it without authorization can be prosecuted under this paragraph.

Paragraph 3 provides that criminal action for the offenses in Paragraphs 1 and 2 is initiated only upon a prior formal complaint (plangere prealabila) from the injured person. Without the victim's complaint, prosecution cannot proceed.

Paragraph 4 establishes four complete defenses that eliminate criminal liability:

• (a) The recording was made by a person who participated in the interaction and can justify a legitimate interest;
• (b) The person recorded explicitly intended to be seen or heard by others at that time;
• (c) The recording documents the commission of a criminal offense or contributes to proving that an offense occurred;
• (d) The recording concerns matters of public interest where the public benefit outweighs the harm caused.

Defense (a) is a narrow, fact-specific exception, not a general license to record: a participant is protected only when they can justify a legitimate purpose for the recording (personal protection, evidence preservation, journalistic documentation), assessed case by case. Absent that showing, a participant who records a private conversation without the other person's knowledge is exposed to liability under Paragraph 1 the same way a stranger would be. This is why Romania is better described as all-party-leaning than one-party consent: the default is prohibition, and the participant exception has to be earned, not assumed.

Paragraph 5 separately criminalizes the unauthorized installation of audio or video recording equipment for the purposes described in Paragraph 1. This aggravated installation offense carries 1 to 5 years imprisonment. The Romanian High Court of Cassation and Justice (Inalta Curte de Casatie si Justitie, ICCJ) clarified the scope of this provision in Decision No. 92/A on March 1, 2023: the offense is complete when recording equipment is placed without authorization for the purpose of capturing a private conversation, even if the device never actually stores any audio. Merely positioning recording equipment with criminal intent meets the objective elements of Paragraph 5.

Article 302: Violarea Secretului Corespondentei (Violation of Correspondence Secrecy)

Article 302 of the Romanian Penal Code covers a distinct but related category: the secrecy of correspondence and electronic communications. While Article 226 focuses on private spaces and intimate recordings, Article 302 addresses the content of letters, emails, telephone calls, and other communications as a data stream.

Paragraph 1 targets the opening, removal, destruction, or retention of correspondence addressed to another person without legal authorization, and the disclosure of such correspondence. Penalty: 3 months to 1 year imprisonment or a fine. This provision applies even when the letter was opened by mistake; the critical element is the absence of authorization to access or disclose the contents.

Paragraph 2 covers the unlawful interception of telephone or electronic communications. Penalty: 6 months to 3 years imprisonment or a fine. This paragraph directly targets third-party wiretapping: recording a phone call, tapping an email exchange, or intercepting a digital message to which you are not a party.

Paragraph 3 applies an aggravated form when the offense is committed by a public official with a legal obligation of professional secrecy. Penalty: 1 to 5 years imprisonment plus a ban on exercising certain rights.

Paragraph 4 covers the unauthorized disclosure or transmission of intercepted communications, including those obtained accidentally. Penalty: 3 months to 2 years imprisonment or a fine. Inadvertent interception does not excuse deliberate onward sharing.

Paragraph 5 covers the possession or manufacture of equipment designed for unauthorized interception without proper authorization. Penalty: 3 months to 2 years imprisonment or a fine.

Exceptions under Article 302 mirror Article 226: the act is not an offense when it reveals the commission of a crime or when it exposes matters of genuine public interest where the public benefit outweighs the harm to the affected person.

The Art. 226 vs. Art. 302 distinction in practice: Article 226 covers surreptitious recordings in private physical spaces (homes, private offices) and intimate personal conversations; criminal action requires the victim's prior complaint. Article 302 covers third-party interception of communications (phone tapping, email access) and correspondence violations; prosecution can proceed without a victim complaint. Both articles can apply where an offender places a recording device in a private space to intercept a telephone conversation.

Criminal Fine Calculation

Romania uses a day-fine system (zile-amenda) under Article 61 of the Penal Code. Fines are calculated by multiplying the number of day-fines (30 to 400 days) by the per-day value (RON 10 to RON 500). For offenses where a fine is an alternative to imprisonment of up to 2 years, the range is 120 to 240 day-fines. For more serious offenses, 180 to 300 day-fines. The exact amounts depend on offense severity and the convicted person's financial situation.

Constitutional Foundation: Articles 26 and 28

Romania's recording and surveillance framework rests on two constitutional provisions. Article 28 of the Constitution states: "The secrecy of letters, telegrams and other postal communications, of telephone conversations and of any other legal means of communication is inviolable." Article 26 protects the right to private and family life.

Both rights are qualified rather than absolute. Article 28 expressly permits limitations on communication secrecy, but only through judicial order. This constitutional requirement explains why law enforcement wiretapping in Romania requires a motivated authorization from a judge, and why the Penal Code's exceptions for public interest and crime documentation exist: the Constitution itself permits privacy to yield to competing interests when proportionate and lawful.

The Constitutional Court (Curtea Constitutionala a Romaniei, CCR) interprets these provisions. In a May 2025 ruling, the CCR held that mandatory public disclosure of politicians' asset declarations violated Article 26 because the disclosure went beyond what was necessary for the integrity objective. The ruling illustrates the court's proportionality analysis: privacy limitations must be no more intrusive than the legitimate public interest demands.

Recording Your Own Conversations: The Legitimate-Interest Test

Romanian law does not give a participant an automatic right to record a conversation simply because they are part of it. The controlling test is Article 226(4)(a) of the Penal Code: a participant's recording is not an offense only where the participant can justify a legitimate interest for making it (for example, protecting themselves from a threat, preserving evidence of wrongdoing, or documenting a transaction). Without that showing, Article 226(1) applies to a participant the same way it applies to a stranger.

Two other statutes are sometimes cited alongside Article 226(4)(a), but neither independently authorizes recording:

• Law 506/2004 Art. 4(2)(a) prohibits interception and surveillance of communications except when carried out by a participating user, but by the law's own Art. 1(2) this confidentiality guarantee is scoped to providers of electronic communications networks and services implementing EU Directive 2002/58/EC. It governs when a telecom operator's handling of traffic is lawful; it does not answer the Penal Code question of whether a private individual may record a conversation.
• Article 302 of the Penal Code criminalizes a different harm: interception of correspondence and telephone or electronic communications, aimed at someone who is not a party to the communication. It does not answer whether a participant may record their own conversation; that question is governed by Article 226(4)(a) alone.

These provisions cover different pieces of the picture across phone calls, in-person meetings, video conferences, voice messages, and digital communications, but none of them substitutes for Article 226(4)(a)'s legitimate-interest requirement.

Even where a legitimate interest exists, important boundaries still apply:

• Distribution restrictions: Sharing or publishing a recording may violate GDPR data protection rules if the recording contains personal data (including voices and identifying information), as well as Article 226(2) if the recording captured a private-space interaction.
• Purpose limitation: Under the GDPR, recordings should only be used for the specific purpose that justified making them.
• Proportionality: Courts evaluate whether recording was proportionate to the legitimate aim claimed. ICCJ Decision 39/2024 confirmed this case-by-case proportionality test applies even to admissible labor-dispute recordings.
• Workplace limits: Employees recording workplace conversations should still confirm they have a legitimate interest under Article 226(4)(a) (protecting a legal right in an employment dispute is the kind of interest ICCJ Decision 39/2024 addressed at the evidentiary stage); distribution to third parties without authorization can separately expose the employee to disciplinary or legal consequences.

Phone Calls

A participant may record their own phone call only where a legitimate interest under Article 226(4)(a) supports it; Law 506/2004 does not independently authorize the recording (see above). For outbound international calls, the law of the country where recording occurs generally governs, but businesses should apply the stricter rule, which in Romania's case is already the demanding one, when the other party is in a jurisdiction with a lower bar.

In-Person Conversations

Article 226(4)(a) applies directly: a participant who records a private conversation, whether in a room, home, private space, or elsewhere, needs a legitimate interest to avoid the offense. The private-conversation branch of Article 226(1) is not limited to physical private spaces, so a conversation that is private in content can be covered even outside the home. For conversations that are genuinely public in both setting and content, with no reasonable expectation of privacy, neither Article 226 nor Article 302 covers the recording, though GDPR data protection obligations may still apply.

Court Admissibility of Recordings

The admissibility of participant recordings in Romanian courts received binding clarification from the ICCJ in Decision No. 39/2024, issued September 16, 2024, and published with full reasoning on October 18, 2024.

The ruling arose from a Bucharest Court of Appeal referral asking whether phone recordings between employees, or between employees and employer representatives, could serve as evidence in labor disputes. The High Court held that such recordings are admissible, even when made without the other party's knowledge or consent, subject to four conditions:

1. A just equilibrium between the right to evidence and the right to privacy is ensured;
2. The recording is indispensable for proving critical facts and no alternative evidence is available;
3. Admissibility is assessed on the specific circumstances of each case;
4. Use of the recording is strictly proportional to the purpose of protecting the party's legal rights.

The court stated expressly that "the right to privacy is not absolute" and that privacy interference is lawful when three criteria are met: legal permission, legitimate purpose, and proportionate necessity. The ruling also noted that phone recordings "represent an infringement of the rules of social conduct" in the labor context, signaling that courts will not treat covert recordings as routine evidence but will reserve admissibility for situations where the evidentiary need is genuine. This admissibility test operates alongside, not instead of, the criminal-law question: a recording can be admitted as evidence under Decision 39/2024's proportionality framework while the person who made it is still exposed to liability under Article 226 if no legitimate interest can be shown.

In criminal cases, participant recordings are generally admissible as documentary evidence. Law enforcement wiretapping operates under a separate regime: Articles 138 to 145 of the Code of Criminal Procedure require a motivated judicial authorization issued at a prosecutor's request, based on reasonable suspicion of an offense prosecuted ex officio, granted by the president of the court with first-instance jurisdiction.

Civil Code Articles 73 to 75: Personality Rights

Parallel to the criminal provisions, Articles 73 to 75 of the Romanian Civil Code (Law 287/2009) establish a civil-law framework for personality rights that provides a separate basis for legal action against unauthorized recording and publication.

Article 73 recognizes each person's right to their own image. Every individual may prohibit the reproduction of their physical appearance or voice in any form and may oppose the use of such reproductions.

Article 74 enumerates specific infringements on private life that give rise to civil liability:

• Unlawful interception of a private conversation through technical means, or the knowing use of such an interception;
• Capture or use of a person's image or voice in a private space without their consent;
• Dissemination of images showing the interior of a private space without the lawful occupant's consent;
• Monitoring private life through any means, outside cases expressly permitted by law;
• Dissemination of news, debates, investigations, or audiovisual reports concerning intimate, personal, or family life without the person's consent.

Article 75 establishes the limits: these provisions do not constitute an infringement when the relevant action is permitted by law or by international human rights conventions to which Romania is party. The public-interest exception, journalistic privilege, and court-ordered disclosure all fall within Article 75's limiting clause.

The civil remedy is distinct from criminal prosecution. A person whose privacy is violated through unauthorized recording can simultaneously file a criminal complaint under Articles 226 or 302 and bring a civil action for damages under Articles 73 to 75 of the Civil Code. The civil remedy allows recovery of material damages (actual loss) and moral damages (non-economic harm to reputation, dignity, and emotional wellbeing). Civil actions do not require proof beyond a reasonable doubt and can proceed even if the criminal complaint is withdrawn.

GDPR and Law 190/2018

As an EU member state, Romania is directly subject to the General Data Protection Regulation (GDPR, EU 2016/679), in force since May 25, 2018. Any recording that captures voices, images, or other identifying information constitutes the processing of personal data and triggers GDPR obligations.

Law 190/2018 implements GDPR-enabling provisions at the national level, focusing on employment data processing under GDPR Article 88. For recording purposes, it governs workplace electronic monitoring (see the dedicated section below).

ANSPDCP: Romania's Data Protection Regulator

The National Supervisory Authority for Personal Data Processing (ANSPDCP) enforces both GDPR and national data protection law. It has authority to investigate complaints, issue warnings, impose fines, and conduct audits. ANSPDCP has maintained an active enforcement posture through 2025 and 2026, publishing multiple sanctions per month for GDPR violations and violations of Law 506/2004. In December 2025 alone, ANSPDCP published at least six sanction decisions. Roumasport received a EUR 10,000 fine for a GDPR breach (enforcement action filed December 30, 2025).

GDPR Penalty Tiers

• Public authorities and bodies: RON 10,000 to RON 200,000 (approximately EUR 2,000 to EUR 40,000)
• Private entities (less serious violations): Up to EUR 10 million or 2% of annual global turnover, whichever is higher
• Private entities (most serious violations): Up to EUR 20 million or 4% of annual global turnover, whichever is higher

Recording and GDPR Compliance

Any recording that captures personal data requires:

• Lawful basis: Consent, legitimate interest, legal obligation, or another basis under GDPR Article 6
• Transparency: Data subjects should generally be informed about the recording and its purpose
• Purpose limitation: Recordings may only be used for the purpose that justified creating them
• Data minimization: Record only what is necessary for the stated purpose
• Storage limitation: Delete recordings when they are no longer needed for the stated purpose
• Security: Implement appropriate technical and organizational safeguards

The household exemption under GDPR Article 2(2)(c) may apply to purely personal recordings with no commercial or public dimension, but this exemption is narrow and should not be assumed without careful analysis.

Workplace Recording and Employee Surveillance

Romania has among the most detailed workplace surveillance rules in the EU, established through Law 190/2018 and GDPR requirements implemented by ANSPDCP guidance.

Four Cumulative Conditions for Lawful Monitoring

Employers implementing electronic monitoring or video surveillance must satisfy all four conditions:

1. Legitimate interest justification: The employer's legitimate interest must demonstrably outweigh the employees' privacy rights, freedoms, and interests.
2. Complete prior notification: Employees must receive mandatory, complete, and explicit advance information about the monitoring system, including its scope, methods, purposes, and any specific locations monitored.
3. Union or representative consultation: The employer must consult the trade union or, where no union exists, employee representatives before implementing any monitoring system. This is a consultation requirement, not a consent requirement: consultation must occur and be documented, but the union cannot veto implementation.
4. Subsidiarity test: The employer must demonstrate that less intrusive alternatives have actually been tested and proved inadequate. Documenting this test is critical; simply asserting that alternatives would not work is insufficient.

Audio Recording

Audio recording faces stricter scrutiny than video surveillance because it captures content, not just presence. ANSPDCP guidance indicates that audio monitoring should be avoided when the monitoring purpose can be achieved through video-only means. A notable enforcement case involved a public transport company sanctioned for real-time audio and video monitoring of drivers' cabins; ANSPDCP found violations of the legality, transparency, and purpose limitation principles.

Retention and Deletion

All workplace surveillance data, including video and audio recordings, must be deleted within 30 days unless a longer retention period is expressly required by law or justified by documented exceptional circumstances, such as an ongoing disciplinary investigation or litigation hold.

Hidden Cameras

Installing concealed surveillance cameras in the workplace is strictly prohibited. All cameras must be visible, and employees must be informed of their locations and operating schedules.

Recording Police and Public Officials

Article 226(4)(d) of the Penal Code provides that recording is not an offense when it concerns matters of public interest where the public benefit outweighs the harm to the affected person. This exception has direct application to the recording of police officers and public officials exercising official functions.

A police officer conducting a traffic stop, a public official making an arrest, or a government employee exercising coercive authority in a public setting does not retain the same privacy expectation as a private individual in a home or office. Recording police activity in a public space generally falls within the Article 226(4)(d) public interest exception, provided the recording captures the exercise of official functions rather than private conduct.

The Article 302 exception for public interest applies similarly: disclosing a recording that exposes official misconduct, corruption, or the commission of an offense by a public servant is protected when the public benefit of disclosure outweighs the harm to the individual.

Practical limits apply. Recording a police officer's personal conversations (rather than official actions), or distributing recordings in a way that endangers an officer or ongoing investigation, does not qualify for the public interest exception. The proportionality assessment under ICCJ Decision 39/2024 applies across contexts.

Video Surveillance and CCTV

Public video surveillance is regulated through Law 333/2003 on the protection of objectives, goods, values, and persons, Government Decision 301/2012, and ANSPDCP Decision 52/2012.

Organizations and authorities installing CCTV must:

• Demonstrate a legitimate purpose: public safety, crime prevention, property protection, or traffic monitoring
• Obtain police approval for security plans that include cameras in public spaces
• Post clear and visible signage notifying the public that video surveillance is in operation
• Limit data retention to a maximum of 30 days absent legal investigation requirements
• Comply with GDPR obligations, including data protection impact assessments for large-scale monitoring

Private citizens may install security cameras on their own property, but cameras must not capture public areas or neighboring properties without justification. Audio recording in addition to video on residential surveillance systems requires the same heightened justification as workplace audio monitoring.

Voyeurism and Non-Consensual Intimate Images (NCII)

Romania criminalized the non-consensual sharing of intimate images through a 2023 amendment to the Penal Code. The offense covers the disclosure, dissemination, presentation, or transmission of an intimate image of an identified or identifiable person without that person's consent, where the sharing is likely to cause psychological suffering or harm to the person's image. The penalty is 6 months to 3 years imprisonment or a fine.

This provision applies to both real photographs and videos and to digitally altered intimate imagery. Its interaction with Article 226 is direct: unauthorized recording of a person in an intimate setting (Para 1) followed by distribution of that recording to others (Para 2) or distribution as NCII content triggers both provisions.

EU Directive 2024/1385 on combating violence against women and domestic violence requires EU member states to criminalize non-consensual sharing of intimate images, including deepfake intimate content, with member states having three years from the directive's entry into force to implement the requirement. Romania's 2023 NCII amendment places it ahead of the directive's minimum requirements.

Deepfake Laws and AI-Generated Content

Romania's Parliament has debated dedicated deepfake legislation since 2023. The Senate adopted draft law PL-x 471/2023 on June 26, 2023. The bill was sent to the Chamber of Deputies, where it was referred back to committees for reconsideration after concerns arose about overly broad criminal provisions and freedom-of-expression implications. As of May 2026, the bill had not been promulgated and was still pending a final Chamber vote.

Key provisions in the draft as most recently amended:

• Fines of RON 10,000 to RON 200,000 for distributing deepfake content without the required labeling
• A labeling requirement: AI-generated or AI-manipulated visual content must carry a disclosure notation on at least 10% of the visible surface at both the beginning and end of the material
• The National Audiovisual Council (CNA) would have authority to stop broadcasts of unlabeled deepfake content
• Criminal imprisonment provisions were modified in committee reconsideration

Until the deepfake bill is promulgated, existing Penal Code provisions govern:

• Article 226 covers recording a person in a private space without authorization, including through digitally manipulated imagery that simulates such capture
• The NCII amendment covers non-consensual distribution of intimate images, whether real or synthetic
• Article 325 (computer fraud) and related cybercrime provisions may apply where deepfakes are used to deceive or defraud

EU AI Act

The EU AI Act (Regulation 2024/1689) entered into force on August 1, 2024. It applies to Romania as an EU member state. Key dates:

• February 2, 2025: First obligations applied, including prohibition of certain AI practices (such as social scoring and certain biometric categorization systems) and mandatory AI literacy measures
• August 2, 2025: Obligations for providers of general-purpose AI (GPAI) models became applicable; Romania was required to designate market surveillance authority (MSA) by this date
• August 2, 2026: The Act's general application date, including the Article 50 transparency duties (chatbot disclosure, deepfake labelling, machine-readable marking of synthetic content) and the rules on standards, conformity assessment, and registration
• December 2, 2027: The comprehensive compliance framework for the high-risk AI systems listed in Annex III becomes applicable. This date was August 2, 2026 until Regulation (EU) 2026/1744, the July 2026 Digital Omnibus on AI, moved it
• August 2, 2028: The same framework applies to AI built into products already regulated under EU product-safety law (Annex I), moved from August 2, 2027 by the same regulation

The AI Act restricts real-time remote biometric identification in public spaces to specific law enforcement uses with judicial authorization, reinforcing the existing constitutional and Code of Criminal Procedure requirements for law enforcement surveillance in Romania. For businesses, AI systems used in employment, workplace monitoring, or customer screening that meet the high-risk AI definition will require compliance with AI Act obligations from December 2, 2027, layered on top of existing GDPR requirements. That deadline moved back from August 2026 under the July 2026 Digital Omnibus.

Recording in Public Places

Romania follows the general EU principle that photography and video recording in public spaces where there is no reasonable expectation of privacy is generally permitted. Restrictions apply:

• Photographing or recording individuals in a way that infringes dignity or private life may give rise to civil liability under Articles 73 to 75 of the Civil Code and Article 26 of the Constitution
• Romanian copyright law (Law 8/1996) limits freedom of panorama to non-commercial use
• Publishing or distributing recordings of identifiable individuals triggers GDPR obligations
• Recording a private conversation between third parties in a public place remains illegal under Article 302, Para 2 of the Penal Code; privacy attaches to the communication, not only to the physical location

Cross-Border Recording

When parties to a recording are located in different countries, cross-border legal analysis is required.

Consent standard conflict: Romania's default rule leans all-party consent: Article 226 requires a legitimate interest even for a participant's own recording. Germany and France are also all-party consent jurisdictions (German StGB Section 201; French Code Penal Art. 226-1), so a call between a Romanian participant and a German or French participant is governed by an all-party-leaning standard on both ends. The United Kingdom and most US states are one-party consent; where the other party is in one of those jurisdictions, the safer course is still to satisfy Romania's stricter Article 226(4)(a) legitimate-interest standard.

GDPR cross-border enforcement: For calls and recordings that involve processing of personal data across EU borders, GDPR coordination rules apply. The EU Procedural Regulation 2025/2518, dated November 26, 2025, published in the Official Journal on December 12, 2025, and applicable from April 2, 2027, streamlines how national data protection authorities (including ANSPDCP) coordinate on cross-border GDPR cases, giving the European Data Protection Board (EDPB) enhanced decision-making authority to ensure consistent application.

Business compliance for international calls: A Romanian business recording calls with customers or partners in other EU states should apply the stricter of the applicable national laws. For calls involving parties outside the EU, GDPR data protection requirements still apply to any processing by the Romanian entity, regardless of where the other party is located.

Law Enforcement Surveillance

Law enforcement agencies in Romania must obtain judicial authorization before conducting surveillance activities. Articles 138 to 145 of the Code of Criminal Procedure establish a comprehensive framework for special surveillance methods (tehnici speciale de supraveghere sau cercetare).

Article 138 defines authorized methods including: interception of communications, access to computer systems, video, audio, or photographic surveillance, location and tracking by technical means, financial transaction data retrieval, postal item searches, use of undercover investigators and collaborators, and obtaining traffic and location data from electronic communications providers.

Authorization requires a motivated order from a judge, issued at a prosecutor's request, based on reasonable suspicion of an offense prosecuted ex officio. The order is issued by the president of the court with first-instance jurisdiction. Wiretap authorizations carry a maximum initial duration with judicial extension procedures. All law enforcement surveillance is subject to the constitutional constraint in Article 28: secrecy of communications may be limited only through judicial order within a system of checks and balances.

Penalties Reference Table

Recording Scenarios Quick Reference

Practical Compliance Checklist

• Confirm participation and a legitimate interest. Being a participant is necessary but not sufficient: Article 226(4)(a) also requires a legitimate interest you could justify if challenged. Recording a conversation you are not part of at all is separately a criminal offense under Article 302.
• Document your legitimate interest at the time. Article 226(4)(a)'s defense depends on being able to point to the legitimate interest that existed when you made the recording, not one invented afterward; GDPR's purpose-limitation principle imposes a parallel requirement once the recording exists.
• Keep recordings secure. Store recordings with appropriate access controls. Unauthorized access by third parties creates independent liability under GDPR.
• Respect the 30-day rule. Workplace and CCTV recordings must be deleted within 30 days absent legal justification for longer retention.
• Notify callers (businesses). Commercial call recording requires informing callers at the start of the call of the recording, its purpose, and their options.
• Do not install hidden devices. The Art. 226(5) installation offense is complete upon placement, regardless of whether any recording occurs.
• Know the public interest exception. Recordings documenting a crime or matters of genuine public concern are protected under Art. 226(4)(d) and Art. 302's parallel exception; document why the exception applies.
• Consult a Romanian lawyer for specific situations. Romanian recording law involves multiple overlapping statutes, GDPR obligations, and evolving jurisprudence. Consult a lawyer licensed in Romania for advice on specific recording scenarios.

Frequently Asked Questions

Is Romania a one-party or two-party consent country for recording?

Romania is best classified as an all-party consent country, though the label does not map perfectly onto its Penal Code. Article 226 makes it an offense, without right, to record a person in a private space or to record a private conversation, and the only exception for a participant applies where that participant can justify a legitimate interest under Article 226(4)(a). Law 506/2004, a telecom-sector confidentiality law, is sometimes cited for a broader participant exception, but it applies to network operators implementing EU Directive 2002/58/EC and does not override the Penal Code's legitimate-interest requirement. Recording a conversation you are not a party to at all is separately a criminal offense, typically prosecuted under Article 302, punishable by 6 months to 3 years imprisonment.

What is the difference between Article 226 and Article 302 of the Romanian Penal Code?

Article 226 (violarea vietii private) covers unauthorized recordings made in private physical spaces such as homes, rooms, and dependent spaces, and of private conversations heard directly. Penalty for the base offense is 1 to 6 months imprisonment or fine; installing recording devices without authorization carries 1 to 5 years. Criminal action under Art. 226 requires a prior complaint from the victim. Article 302 (violarea secretului corespondentei) covers the interception of correspondence and electronic communications as a data stream, including phone calls, emails, and digital messages. Penalty for unauthorized telephone or electronic interception is 6 months to 3 years. Criminal action under Art. 302 can proceed without the victim's complaint. Both articles can apply where an offender places a recording device in a private space to intercept a telephone call.

Can a phone recording be used as evidence in a Romanian court?

Yes. The Romanian High Court (ICCJ) established binding precedent in Decision No. 39/2024 (September 16, 2024) that phone recordings made by a participant are admissible as evidence in labor disputes even without the other party's knowledge. Admissibility requires: (1) a just balance between the right to evidence and the right to privacy; (2) the recording is indispensable for proving critical facts with no alternative evidence available; (3) use is strictly proportional to protecting the party's legal rights. In criminal cases, participant recordings are generally admissible as documentary evidence subject to ordinary evidentiary rules.

What are Romania's workplace surveillance rules?

Under Law 190/2018 and GDPR, employers must satisfy four cumulative conditions before implementing monitoring: (1) a legitimate interest that demonstrably outweighs employee privacy rights; (2) complete prior written notification to employees; (3) documented consultation with the trade union or employee representatives; (4) demonstrated testing of less intrusive alternatives that proved inadequate. All surveillance data must be deleted within 30 days unless a legal exception applies. Audio recording requires higher justification than video. Hidden cameras are strictly prohibited. ANSPDCP has fined employers for failing to meet these requirements.

Does the GDPR apply to recording in Romania?

Yes. The GDPR applies directly in Romania since May 25, 2018. Any recording that captures voices, images, or identifying information constitutes personal data processing and triggers GDPR obligations. You must have a lawful basis for the recording, inform data subjects in most contexts, limit use to the stated purpose, minimize what you capture, and delete recordings when no longer needed. Romania's data protection authority (ANSPDCP) actively enforces GDPR compliance, publishing multiple sanction decisions monthly in 2025 and 2026. Penalties for serious violations can reach EUR 20 million or 4% of annual global turnover.

Can I record the police in Romania?

Generally yes, when police are exercising official functions in a public setting. Article 226(4)(d) of the Penal Code excludes from criminal liability any recording that concerns matters of public interest where the public benefit outweighs the harm to the affected person. Police conducting traffic stops, making arrests, or exercising coercive powers in public have a reduced privacy expectation regarding their official conduct. The public interest exception does not cover recording officers' private conversations, endangering an officer's safety, or interfering with an ongoing investigation.

Is sharing non-consensual intimate images illegal in Romania?

Yes. Romania criminalized non-consensual sharing of intimate images through a 2023 amendment to the Penal Code. The offense covers disclosing, disseminating, presenting, or transmitting an intimate image of an identified or identifiable person without consent where the sharing is likely to cause psychological suffering or harm the person's image. The penalty is 6 months to 3 years imprisonment or a fine. This provision applies to both authentic and digitally altered intimate imagery.

Does Romania have a deepfake law?

As of May 2026, Romania does not have a promulgated deepfake-specific law. The Senate passed draft law PL-x 471/2023 on June 26, 2023, which would impose fines of RON 10,000 to RON 200,000 for distributing unlabeled AI-generated or AI-manipulated content and would require labeling on at least 10% of the video surface. The bill was referred back to Chamber of Deputies committees due to concerns about overly broad criminal provisions and remained pending a final vote as of May 2026. Existing Penal Code provisions (Articles 226, 302, the NCII amendment) and the EU AI Act prohibition on certain AI practices already provide partial coverage of deepfake-related privacy and consent violations.

What happens when recording a call between Romania and another country?

When parties are in different countries with different consent standards, the stricter rule generally applies. Romania's own standard already leans all-party, since Article 226(4)(a) requires a legitimate interest even for a participant's own recording, so a call between a Romanian participant and someone in a one-party consent country (the UK, most US states) should still satisfy Romania's legitimate-interest test to be safe. A call with a participant in another all-party consent country (Germany, France) is governed by an all-party-leaning standard on both ends. GDPR data protection requirements apply to any processing by the Romanian entity regardless of where the other party is located.