Practice areas

Regulatory and compliance for companies

Compliance programmes and support in dealings with regulators, for companies in Romania.

The Alina Szilaghi law office helps companies understand their compliance obligations, turn them into simple internal processes and manage their relationship with regulators. Requirements differ by sector and company size, and some change often, so we check them as at the date they apply.

What we cover

  • Data protection: GDPR audits, records and policies, processor contracts, security incidents, dealings with ANSPDCP (Regulation (EU) 2016/679 and Law no. 190/2018) — see the GDPR page;
  • Anti-money laundering: assessing the company’s obligations and internal procedures under Law no. 129/2019;
  • Competition: reviewing contracts and commercial practices, and merger notifications to the Competition Council (Law no. 21/1996);
  • Whistleblowing: internal channels and procedures under Law no. 361/2022;
  • Internal policies: codes of conduct, anti-corruption policies, conflicts of interest and staff training;
  • Regulated sectors: gambling, IT, telecoms and media, permits and licences, and dealings with other supervisory authorities;
  • Inspections and sanctions: assistance during inspections and challenging fines.

How we work

  1. We establish which rules apply to the company and where the gaps are, through a documented assessment.
  2. We draft the policies, procedures and contracts needed and propose a realistic implementation plan.
  3. We assist the company in dealings with the authorities and, if necessary, in disputes (litigation and arbitration).

Companies needing continuing support can opt for retained legal services. Fees are agreed before work starts (see Fees); book a consultation.

How we can help

  • GDPR audits and documentation, dealings with ANSPDCP
  • Anti-money laundering compliance
  • Competition law and merger control
  • Whistleblowing channels and protection of whistleblowers
  • Internal policies, codes of conduct and anti-corruption measures
  • Compliance in regulated sectors (gambling, communications, financial)
  • Assistance in regulatory inspections and sanction proceedings
  • Cybersecurity and incident reporting obligations

Page updated . The information on this website is general and is not legal advice on any specific matter.

Frequently asked questions

Is a data protection officer mandatory?

Not for every company. Regulation (EU) 2016/679 requires one in the cases listed in art. 37, for example regular and systematic monitoring on a large scale or large-scale processing of special categories of data. Whether you need one depends on the company’s actual activity.

Which companies must have an internal reporting channel?

Law no. 361/2022 on the protection of whistleblowers requires internal channels, in principle, for private entities with at least 50 employees, subject to exceptions and sector-specific rules. Each company’s situation should be checked.

Can you assist the company during a regulator’s inspection?

Yes. We prepare the company for the inspection, coordinate communication with the authority and the responses, and afterwards handle complaints, appeals or court action if needed.

Need a lawyer in Romania?

Tell us briefly what has happened. We reply within one business day and tell you which documents we need.

Book a consultation