Voice phishing simulations in Romania
Romania is the only country in this portal whose legislature wrote a rule for exactly this situation, and it is the most demanding one here: five conditions that must all be true at once before the legitimate interests ground is available for monitoring by electronic means. The regulator has enforced them against software that had only ever been run in a test period, so build a voice phishing simulation around the fourth condition and the thirty-day retention cap from the first planning meeting.
Phone numbers
Supplied by Callstrike
Local numbers in Romania, after a one-time approval.
Running a simulation
Permitted on five conditions at once
Fail any one and the legitimate interests ground is not available at all.
Consent
Neither the basis nor the gate
Consultation before the system is introduced is the gate, and it needs no agreement.
Getting a phone number in Romania
One approval per country, completed in the console.
Provisioned by Callstrike after approval
Numbers here are not released from open inventory. Your workspace is cleared for this country once, and Callstrike then provisions a dedicated number against it for your simulations. Approval is a one-time, per-country step and usually takes 3 to 5 business days. We only ask for what the regulator requires.
Romania asks more about people than any other filing in this region. Alongside the company name, the trade registry or fiscal number and the business address, your authorised representative is identified twice over: their name from a passport, identity card or residence permit, and then the number and expiry date of that same document, with their date of birth typed into the form. A power of attorney or other evidence that they are a director or country manager shows they may act for the company. A trade registry certificate, a fiscal registration certificate or a registry excerpt covers most of the company side on its own, and the address line will also take a utility bill, a tax notice, a rent receipt or a title deed.
The Romanian anti-spoofing regime is operative and unusually hard to cite, which is worth knowing before somebody hands you a fabricated reference. It is not a numbered decision at all. It is a bundle of individual decisions addressed to each provider, dated June 2025 and communicated through the regulator's own portal, published only as a redacted template whose number field is blank, so anyone quoting a decision number for Romanian caller identity spoofing has invented it. What it requires is plain enough: since July 2025 providers block calls originated outside Romania that present national numbers other than the mobile ranges, unless the provider can establish with certainty that the number correctly identifies the caller. Read the mobile carve-out as what it is, a deliberate gap in one enforcement mechanism to protect roaming, not a permission.
- 01Complete the regulatory clearance formYour administrator, in the Callstrike console. The form asks only for what the regulator requires.
- 02Approval is granted against your workspaceTypically three to five business days, and once only for as long as you operate here.
- 03A dedicated number in Romania is assigned to youCallstrike
- 04Build and launch the campaignYour team
| What you provide | Accepted evidence, any one of |
|---|---|
| Name of authorized representative | Passport, Identity card, Residence or labor permit |
| Number and expiry of identity document of authorized representative | Identity card, Passport, Residence or labor permit |
| Trade registry number or fiscal numberfor example, VAT | Trade registry certificate, Fiscal registration/vat certificate, Excerpt from the commercial or trade registry |
| Authorization of representative | Power of attorney, Other documentation showing the individual is a director or country manager for the business |
| Business name | Trade registry certificate, Fiscal registration/vat certificate, Excerpt from the commercial or trade registry |
| Business addressMust be within locality or region covered by the phone number's prefix; a PO Box is not acceptable where a local address is required. | Excerpt from the commercial or trade registry showing the local address, Utility bill, Tax notice, Rent receipt, Title deed |
These requirements are set by the carrier and can change. The form in the console is generated from their current rules, so treat it as authoritative and this table as a summary of what to have ready. Checked 2026-09-07.
Is it lawful to run a simulation in Romania?
The position in short, before your counsel reads the detail below.
Yes, and then the conditions. Where monitoring systems by means of electronic communications are used at the workplace, processing employees' data on the employer's legitimate interests is permitted only if five things are true together. The interests must be soundly justified and must prevail over the rights and freedoms of the people concerned. The mandatory, complete and explicit prior information of employees must have been carried out. The trade union or, failing one, the employee representatives must have been consulted before the monitoring systems were introduced. Other, less intrusive methods of reaching your purpose must not previously have proved effective. And retention must be proportionate and in any case no longer than thirty days. Joined by and, and treated by the regulator as conditions on the validity of the ground itself rather than as formalities running alongside it.
The enforcement record is what makes those conditions real, and it is unusually close to what this page is about. The regulator's 2024 report describes an employer monitoring remote workers through an application on their laptops. It found the employer had not proved that less intrusive methods were ineffective, nor that it had consulted before implementing the application, and concluded the legitimate interest invoked could not be considered justified. Two features of that decision are worth pausing on. It applies the article to software rather than to cameras, which disposes of the argument that the provision is really about video. And the application was not even in use at the time, having previously been run only in a test period. A test period still engaged the article, which is the closest thing in Europe to a ruling about a pilot.
The rule people expect to bite does not. The prohibition on automated calling systems is gated on making commercial communications, and that term is defined in a separate statute as any communication intended to promote, directly or indirectly, the products, services, image, name, firm or emblem of a trader. An authorised internal test promotes none of those. It matters that the reason is the purpose rather than the technology, because an AI voice agent is unambiguously an automated calling system that does not require human intervention, so a live operator changes nothing about this analysis. Two details worth carrying: the prohibition covers corporate subscribers as well as individuals, unlike several of its neighbours, and enforcement sits with the data protection authority, which fined fifty thousand lei under the article in August 2026.
Recording is the clearest case in this portal of the well-known provision being the wrong one. The private-life article everyone cites has a participant exception, but the Constitutional Court and then a binding High Court ruling confined its locational element to a domicile in the criminal-law sense, so an employee taking a call at their desk is outside it entirely. The provision that does bite is unlawful interception, which names telephone calls expressly, carries six months to three years, has exactly two exceptions, neither of them participation, legitimate interest or consent, and is prosecuted of the authorities' own motion rather than on anyone's complaint. What keeps you outside it is not an exception but an element: the interception has to be without right, and documented advance authority goes to whether that element is satisfied at all. Onward disclosure is a separate offence, and the High Court has held it is not conditional on the material having been obtained without right, so a lawful recording licenses nothing downstream.
What your company needs to do
7 items, in the order you will need them.
- Evidence that less intrusive methods did not work, before you buyRomania-specificThis is the condition the regulator actually enforced, and it is the one that has to be satisfied before the exercise rather than justified after it. Record what you tried, what it achieved, and why the gap it left needs a live test. A file assembled afterwards is the exact shape of the case the regulator decided against.
- Consult the union before the system is introduced, not before you decideRomania-specificThe specific duty attaches to introduction, and the general machinery adds a second layer that must be completed before implementing the decision, with a reasoned reply to any point the representatives put and a formal record of positions. That record is the concrete deliverable a regulator will ask to see. The general threshold is twenty employees, under the 2006 act rather than the 2022 one.
- Cap retention at thirty days, and let the metrics outlive the recordsRomania-specificThirty days unless a statute provides otherwise or the case is duly justified, and the regulator has penalised employers for exceeding it. Design the programme so what survives is aggregate outcome data rather than a long-lived archive of individual call records, because deleting on schedule should not cost you the trend the programme exists to produce.
- Give the complete and explicit prior information, and be able to prove itRomania-specificPut the programme in the internal regulation, which is the document that actually carries it here. You must bring it to each employee's knowledge on their first working day and be able to prove you did, and it takes effect against an employee only from the moment of that knowledge. The same applies to every modification, so amending it silently achieves nothing.
- Record the authority that makes the interception not without rightRomania-specificThe interception offence has no participation exception and no consent exception, and it does not wait for anyone to complain. The element that protects you is that the act must be without right, so written, dated authority from the officer entitled to give it is what the whole recording position stands on. Get it before the campaign, not with the incident report.
- Control who can replay a recordingOnward disclosure is punished separately, at three months to two years, and the High Court has held that the disclosure offence does not depend on the recording having been made unlawfully. Keep audio inside the team that needs it and anonymise anything that reaches awareness material. Companies are exposed directly, with fines from three thousand to three million lei.
- Run the impact assessmentThe regulator's own list of processing requiring one names employees expressly, alongside minors, where automated monitoring or systematic recording of behaviour is carried out at large scale. A company-wide campaign is the kind of thing that meets the qualifier, so treat the assessment as owed rather than as a judgement call.
The controls that do the work
How Callstrike is configured, and which provision in Romania each choice answers.
Auto-hangup before disclosure
The bot ends the call at the moment an employee starts to give up a credential or a piece of personal data, so the thing the pretext asked for is never spoken into the system and never stored.
Two of the five conditions are answered by what the exercise never holds. The first asks whether your interests prevail over the rights of the people concerned, and the honest weight of an exercise that captures a credential is not the weight of one that captures whether a person would have given it. The fifth caps retention at thirty days. The call ends the instant an employee begins to disclose, so there is no credential store to age out, and what the thirty-day rule applies to is a record of the event rather than a copy of the secret. It also keeps the balance you have to write down a short argument rather than a long one.
In-call debrief and follow-up
A second voice breaks character as soon as the call ends, explains what just happened and why it worked, and a follow-up email repeats it in writing while the moment is still sharp.
The internal regulation that carries the programme in Romania has mandatory content including the disciplinary offences and applicable sanctions, so what happens to a person who fails is a live question in the document itself rather than an internal convention. A second voice that breaks character as the call ends, vishing training in writing the same day, and an undertaking that results never reach a disciplinary record are terms you can put in that regulation and show to the representatives you are consulting.
Consent Management
Two modes: collect consent now, over email, Slack or Teams with a full audit trail per employee; or record that your organisation already has this covered, by uploading the policy, handbook clause or agreement and confirming the scope it applies to. The document is hashed, the attestation is signed and timestamped, and an audit email is issued. Included on every plan.
Romanian law makes consultation the gate and legitimate interests the ground, so employee agreement is doing neither job. What this produces is the second of the five conditions in evidenced form: the mandatory, complete and explicit prior information, dated before the campaign, per employee. That matters more here than in most countries because the labour code separately requires you to be able to prove each person was brought to knowledge of the internal regulation, and a signed and timestamped record is what proving it looks like.
SCORM module
An interactive web presentation on voice-phishing risk, delivered through your own LMS, which then invites the learner to opt into a web call with the bot. A call the person starts themselves in a browser is not a telephone call, so telephony rules do not reach it.
The Romanian delivery problem is origination rather than law, and this route does not have one. Callstrike's vishing simulator can deliver the same deepfake voice through a web call the learner starts themselves after working through the module, so there is no Romanian calling identity for the blocking decisions to examine and no automated calling system for the commercial-communications article to describe. Be precise about what it does not change: the five conditions still govern, because the exercise is still monitoring, and the European transparency duty still applies to the generated voice.
Consent Management is included on every plan. See AI voice phishing simulation and human-in-the-loop voice phishing for how each is delivered.