When you may ask for a criminal record at hiring, what the behavioural integrity certificate is, how candidates get both online for free, how long they last and how to store them under GDPR.
Translated from Romanian. This article covers Romanian labour and tax law; the Romanian version is canonical and is updated first.
“Ask for their criminal record too, just to be safe.” It’s a common reflex in small companies, but a criminal record certificate (cazier judiciar) is not an ordinary hiring document. It shows data about criminal convictions, and the law treats that data separately: you may ask for it only where a rule entitles or obliges you to. And for certain sectors, since 28 March 2026, failing to ask for the document the law prescribes can itself be a criminal offence. The good news: a candidate with Romanian citizenship can now get the certificate online and free of charge, without a trip to a police counter.
Below you’ll find when you have a legal basis to ask for the criminal record certificate or the behavioural integrity certificate, how the candidate gets them, what each one shows and how to keep them without breaching GDPR.
The Labour Code does not list the criminal record among hiring documents. What it does say, in art. 29(3), is that the information you ask a candidate for during the preliminary check may serve only to assess whether they can fill the post and what professional skills they have. On top of that rule sits GDPR: under art. 10, data about criminal convictions may be processed only under the control of an official authority, or when a law permits the processing and provides appropriate safeguards for the person’s rights.
In practice, that means four things:
The list is not exhaustive. The first two rows are the cases where a private company most often meets an express rule; the third has a narrow scope, explained right below the table:
| Situation | What you ask for | Where it is written |
|---|---|---|
| Entities in education, health, social protection, physical education and sport, or with direct contact with children, older people, people with disabilities or other vulnerable people | The behavioural integrity certificate | Law no. 118/2019, art. 18 |
| Staff with guarding or bodyguard duties (security guards, doormen, access controllers, valuables escorts) | The criminal record certificate, together with the professional attestation; the condition: no criminal record for intentional offences | Law no. 333/2003, arts. 35–37 |
| Stock custodians (gestionari) of public authorities and institutions, or of legal persons that administer or exploit public property — employees whose main duty is receiving, keeping and issuing goods | A check of criminal antecedents; a person convicted of certain offences cannot be a custodian (intentional offences against property, corruption and service offences, forgery, tax evasion, money laundering, those under Law 31/1990) | Law no. 22/1969, arts. 1, 4 and 5 (referring to art. 176 of the Criminal Code) |
Take care with the last row. Since 1 February 2014, art. 1 of Law 22/1969 defines a custodian as an employee of a legal person covered by art. 176 of the Criminal Code, that is, a public authority or institution or a legal person that administers or exploits public property. For an ordinary private company (a shop, a warehouse), whether the law applies is debatable; get a lawyer’s opinion before you ask for a custodian’s criminal record. Art. 5 of the same law provides that the employer asks the police directly for information on the criminal antecedents of the future custodian: that is an exception to the rule above, valid only within the scope of this law.
For ordinary SME positions — shop assistant, courier, accountant, operator, waiter — the texts we checked contain no general rule that authorises you to ask for a criminal record. Other special acts (for example those on public office or regulated professions) may impose the same condition, so the first step is always to identify the act that regulates the position.
If you think a position would justify the check without an express rule (access to large sums of money, say), treat the case as a risky one. You need a clear basis, a written assessment of necessity and, ideally, the opinion of a lawyer or your data protection officer — not company habit.
The behavioural integrity certificate is not the criminal record. It is the document under Law no. 118/2019 showing whether a person is entered in the National Automated Register of people who have committed sexual offences, exploitation offences or offences against minors (the “Register”) — and, if they are, what data appears.
The duty to request the certificate has existed since 2019, when Law 118/2019 was adopted. Law no. 38/2026 (Official Gazette no. 232 of 25 March 2026, in force from 28 March 2026) added the express prohibition for people entered in the Register and criminal liability. Among other things, it amended art. 18 and added to art. 21. A rectification published in Official Gazette no. 270 of 3 April 2026 gave art. 18 its final wording, which also covers the physical education and sport sector and uses “public or private entities” for the listed sectors. The current text provides:
Examples of businesses that may fall under the law: a private kindergarten or after-school club, a medical practice, a care centre for older people, a sports club for children. The text speaks about entities, not positions: if your company operates in such a field, ask for legal advice on whether the duty covers all positions (administrative ones included) or only those with direct contact.
| Criminal record certificate | Behavioural integrity certificate | |
|---|---|---|
| What it shows | Criminal penalties from final court judgments that produce legal effects (Law 290/2004, art. 17) | Data from the National Register of people who committed sexual offences, exploitation offences or offences against minors, or the absence of an entry (Law 118/2019, art. 16) |
| When the law requires it | Guarding and bodyguard staff; other special acts (including Law 22/1969, only within its narrow scope) | The sectors covered by Law 118/2019 |
| Validity | 6 months from issue | 6 months from issue |
| Online, free | Romanian citizens, with a validated account in the Ministry of Internal Affairs (MAI) hub | From 1 July 2026, Romanian citizens who are not entered in the Register; everyone else at a police counter |
Each law names its own document: in the sectors covered by Law 118/2019 the integrity certificate is required, for guarding it is the criminal record. In principle, one does not replace the other; the exception is the foreign national, for whom art. 18(2) of Law 118/2019 accepts the criminal record or an equivalent document from the country of origin.
The criminal record certificate is issued electronically through the Ministry of Internal Affairs service hub (hub.mai.gov.ro). The steps, as MAI describes them:
What is worth knowing:
The criminal record certificate lists the criminal penalties from final judgments that produce legal effects (art. 17). It does not include offences committed as a minor, nor data about people against whom criminal proceedings have been started or a preventive measure has been taken (art. 18(1)). A “clean” certificate therefore does not guarantee that there is no criminal case pending — and Law 22/1969, within its narrow scope described above, also excludes from the custodian role people against whom criminal proceedings have been started for the offences it lists (art. 4(2)).
The general GDPR rule stays the same: you keep data only as long as necessary for the purpose you asked for it (art. 5(1)(c) and (e)). For criminal records, this translates into good-practice recommendations, not express obligations under the law:
| Situation | What you keep |
|---|---|
| Candidate not hired | Nothing once the process ends: the certificate received is deleted, like any other recruitment data with no basis for retention |
| Employee in a post with a legal obligation (Law 118/2019, guarding) | A copy of the certificate or, at minimum, a verification note (issue date, check date, who checked, result), in the personnel file, with restricted access. It helps you show that you met your obligation |
| A check made on a basis confirmed by a lawyer, outside the cases above | Only the verification note, no copy |
As with the fitness-for-work certificate, where HR keeps the conclusion and not the diagnosis, start from the question “what do I need to be able to prove?”, not “what can I keep?”. Four more things matter:
The rest of the hiring documents, the ones asked of everyone, are covered in our guide to documents needed for hiring.
No. There is no general rule that authorises you to. You look for the rule for the position in question (see the table above); without it, you risk breaching GDPR.
The same rule applies: without a rule, no. The obvious exception is a move into a post with a legal condition, for example a role with guarding or bodyguard duties, for which Law 333/2003 (arts. 35–37) requires the criminal record certificate alongside the professional attestation. For a move into a stock custodian role, Law 22/1969 (art. 5) also speaks about people “moved” into such roles, but it has the narrow scope described above, so do not rely on it without a lawyer’s opinion.
6 months from the date of issue (art. 27(2) of Law 290/2004). The behavioural integrity certificate has the same period (art. 16(3) of Law 118/2019).
Yes, for Romanian citizens with a validated account in the MAI hub (art. 28(3¹) of Law 290/2004). The behavioural integrity certificate is available online from 1 July 2026, but only for those not entered in the Register.
The electronic route does not apply to them: the request is submitted at a counter, with a longer processing time. In the sectors covered by Law 118/2019, art. 18(2) requires the criminal record or another official document issued by the state of which they are a national. For hiring from outside the EU, see our guide on hiring foreign workers.
It does not replace the certificate where the law requires it: Law 118/2019 speaks about presenting the certificate, and Law 333/2003 about hiring on the basis of the criminal record certificate. Otherwise, a statement is also processing of data about convictions, so you need the same legal basis.
It depends on the basis. If the law imposes the condition, you cannot enter into the relationship: under Law 118/2019, the prohibition covers any employment or volunteering relationship with the entity, not just one particular post; under Law 333/2003 (intentional offences) and Law 22/1969 (stock custodians within its narrow scope), the post in question. If you asked for the certificate on another legal basis that does not set an exclusion condition, you assess only how relevant the offence is to the post (art. 29(3) of the Labour Code), in a documented way, without sharing the information with anyone else. For borderline cases, ask a lawyer.
There is no single formula. The GDPR rule is “as long as necessary for the purpose”; for posts with a legal obligation, the purpose includes proof that you checked. See the section above and set the period in your retention policy, with written reasoning.
A criminal record is not solved with software: what you ask for and on what basis is for you to decide, together with a lawyer. Once you have decided, an application can keep the storage in order. In Workly, each employee has a digital file, with documents organised per employee and accessible according to role, so the certificate does not reach people who do not need it. Sensitive identification data (personal ID number, ID document, IBAN) is encrypted, and you set retention periods for documents; automatic deletion at the end of them is optional and switched on by the administrator, in line with your company’s policy.
Informational article, accurate at the date of publication. Not legal advice. The rules on criminal records, the behavioural integrity certificate and data protection may change through later legislation — always check the version in force (Law 290/2004, Law 118/2019, GDPR, the act that regulates the position) or consult a specialist.
The three phases of SSM training (HG 1425/2006), how often it repeats, who delivers it in a small company, what the individual sheet contains, incl. the electronic one, and the fine: 4,000–8,000 lei.
What the REGES-Online extract is, how employees generate it themselves, when the employer must issue it, what it contains, when it is valid on paper and how to fix wrong data in it.
What the Labour Inspectorate (ITM) can ask for in 2026: company, employment, working-time, payroll and SSM records, how an inspection runs, separate fines and how to contest the report.
Workly newsletter
Get Workly news (new features and modules), the legislative changes that matter for HR and payroll, new document templates and the practical guides we publish on the blog, by email.
We'll show you how time tracking, payroll and the rest of the modules work for your company, in a short demo.
Request a demo