Recruit
Romania applies the GDPR to recruitment alongside a Labour Code provision that limits what an employer may ask before hiring. The criminal record certificate is easy to obtain, which makes it tempting to request routinely, but that is exactly what the rules discourage.
The Labour Code limit
Information requested from a candidate before hiring may only concern their professional skills and capability to perform the role. Anything outside that boundary, including general enquiries into private life, is not a legitimate line of questioning. Asking a former employer for information about a candidate requires the candidate to be informed first.
Criminal record checks
The cazier judiciar is issued by the Romanian Police and can be obtained by the individual in person or through the national online service, usually within a short period. Employers cannot search the record themselves. A certificate is justified where a law requires it or the role warrants it, which covers banking and finance, private security, education, childcare, healthcare, public sector roles, and positions with access to significant assets.
Data protection
The GDPR applies alongside Romanian implementing legislation, supervised by the national supervisory authority, which has issued fines to employers for excessive processing. Criminal conviction data attracts additional protection and consent is a weak basis in employment because of the imbalance between the parties. Collect the minimum, be transparent about purpose, and delete unsuccessful applicants’ data once recruitment closes.
Medical checks
A pre-employment medical examination is mandatory and is arranged through occupational health services. The output confirms fitness for the role rather than disclosing clinical detail, and the scope should not be widened into general health enquiry.
Practical guidance
Decide role by role whether a cazier is justified and record the reason, view rather than retain it where possible, and set a retention period for applications. An employer of record can manage this if you have no Romanian entity.
