RomaniaLaw 361/2022 on the Protection of Public Interest Whistleblowers (Legea nr. 361/2022), Article 7, Paragraphs 3 to 7, Documenting Telephone and Oral Reports
Art. 7 alin. (3)-(7), Legea nr. 361/2022
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://legislatie.just.ro/Public/DetaliiDocument/262872In force since .
An interception and recording consent rule binding public and private bodies.
- Obligation class
- Consent, Governance
As of .
What it requires
- If you must have an internal reporting channel and it is a telephone line or other voice messaging system, document each report either by recording the conversation in a durable and accessible form with the whistleblower's consent, or by a complete and exact transcript of the conversation (article 7, paragraph 3).NIST Privacy FrameworkCT.PO-P1
- Where the line or system cannot record conversations, draw up minutes with a complete and exact transcript of the conversation, and give the whistleblower the chance to check, correct and agree to the minutes by signing them (article 7, paragraph 4).NIST Privacy FrameworkCT.PO-P3
- Where the whistleblower asks for the report to take place in your presence, draw up minutes in a durable and accessible form with the whistleblower's consent, and give the whistleblower the chance to check, correct and agree to them by signing (article 7, paragraph 5).NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Direct a whistleblower who does not consent to transcription or recording of the conversation to report in writing, on paper to the designated person or electronically to a dedicated electronic mail address (article 7, paragraph 6).NIST Privacy FrameworkCT.PO-P1
- Set up internal reporting channels if you are a private-law legal person with at least 50 employees (article 9, paragraph 1).no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
What this law does
Article 9(1) of Law 361/2022 obliges authorities, public institutions and other public-law legal persons, whatever their number of employees, and private-law legal persons with at least 50 employees, to identify or set up internal reporting channels.
Article 7(3) requires the designated person, where a telephone line or other voice messaging system is used for reporting, to document the report either by recording the conversation in a durable and accessible form, subject to the whistleblower's consent, or by a complete and exact transcript of the conversation.
Article 7(4) requires the designated person, where the telephone line or voice messaging system cannot record conversations, to draw up minutes with a complete and exact transcript of the conversation. Article 7(4) also has the designated persons give the whistleblower the chance to check, correct and agree to the minutes of the conversation by signing them.
Article 7(5) requires the designated person, where the whistleblower asks for the report to take place in the person's presence, to draw up minutes in a durable and accessible form, subject to the whistleblower's consent. Article 7(6) directs a whistleblower who does not consent to transcription or recording of the conversation to report in writing, on paper to the designated person or electronically to a dedicated electronic mail address.
Article 36 provides that the obligation to identify or set up internal reporting channels takes effect on for private-law legal persons with between 50 and 249 employees. The consolidated text of the Law is in force from .
When LexLint raises it
When your app profile says your app records calls or processes voice recordings.