Law No. 96/2025 “On whistleblowing and the protection of whistleblowers” (Law No. 96/2025) establishes a new and consolidated framework for the reporting of violations and the protection of whistleblowers, in both the public and private sectors.
This law is fully aligned with Directive (EU) 2019/1937 of the European Parliament and of the Council of 13 October 2019 on the protection of persons who report breaches of Union law.
The purpose of Law No. 96/2025 is to encourage the reporting of potential violations of the legal framework, to prevent and combat unlawful conduct, and to ensure that whistleblowers are effectively protected and treated fairly in the procedures following a report. Upon the entry into force of this law, the previous Law No. 60/2016 “On whistleblowing and the protection of whistleblowers” is repealed.
Law No. 96/2025 applies to reports concerning unlawful acts or omissions that harm the public interest, including abuse of public office, corruption, mismanagement of public funds or resources, as well as any other conduct that undermines transparency, accountability, and integrity in public administration or private entities. Particular importance is also given to areas linked to European Union standards and rules applicable through ratified agreements, including the use of EU and international organisation funds, public procurement, financial services and financial markets, the prevention of money laundering and terrorist financing, internal market and competition rules, environmental protection, public health, consumer protection, as well as the protection of personal data, privacy, and the security of information technology networks and systems.
From a personal scope perspective, the law has a broad application and applies to any person who reports or possesses information on potential violations acquired in a work-related context. This includes employees in the public and private sectors, self-employed persons, members of management or supervisory bodies of an entity, trainees, as well as persons working under the supervision of contractors, subcontractors, or suppliers. Protection is also provided where the employment relationship has not yet commenced (e.g. during recruitment), as well as where it has ended, but the report is made subsequently through external or public reporting mechanisms. Anonymous reports and public disclosures are also covered, provided that the conditions set out in the law are met. Under this law, the High Inspectorate for the Declaration and Audit of Assets and Conflict of Interests (ILDKPKI) is designated as the competent authority for administering external reports, overseeing the implementation of the law, and ensuring the protection of whistleblowers.
The law provides that the reporting of potential violations of the legal framework may be carried out through internal, external, or public reporting mechanisms. The reporting procedure begins with the submission of a report to the responsible unit of the public authority or private entity, or directly to ILDKPKI. Reports may be made in writing or orally and, as appropriate, include information on the whistleblower, the person or body involved, a description of the potential violation, and, where possible, the relevant legal references. The law allows external reporting at any stage, without the prior requirement to make an internal report, particularly where there is a risk of retaliation or a lack of effective handling of the matter.
One of the main pillars of the law is protection against retaliatory actions. The law prohibits and renders null and void any acts of retaliation, attempts at retaliation, or threats of retaliation, whether direct or indirect, against the whistleblower and persons connected to them. Retaliation may take various forms, such as dismissal, suspension, transfer, salary reduction, intimidation, discrimination, non-renewal of contracts, reputational harm, or other measures that adversely affect the whistleblower’s professional position and rights. The law further provides that any private agreement aimed at excluding or limiting the rights of the whistleblower is null and void, and that whistleblower rights prevail even over confidentiality clauses.
Confidentiality is treated as a mandatory standard. The identity of the whistleblower is protected by the responsible unit and the competent authority and may be disclosed only with the whistleblower’s explicit consent. In exceptional cases, disclosure without consent is permitted only where it is necessary, justified, and proportionate for the purposes of criminal investigation or judicial proceedings, and the whistleblower is, in principle, informed of such disclosure (with exceptions where such notification would jeopardise the investigation).
In all cases, ILDKPKI or the responsible unit must provide the whistleblower with a written notification explaining the justified reasons for the disclosure of confidential data, as well as the measures taken to limit as much as possible the risk of unnecessary exposure. At the same time, the law provides that the processing of personal data during administrative investigations must be carried out solely for the purposes of enforcing the law and in compliance with the applicable legislation on the protection of personal data.
From an institutional perspective, the law establishes specific obligations for public authorities and private entities. Every public authority and every private entity with more than 50 employees is required to establish a responsible whistleblowing unit to ensure the operation of a dedicated mechanism for the reporting and follow-up of internal reports. In certain sensitive sectors, such as financial services and other areas provided for by EU acts requiring internal reporting channels, this obligation may apply regardless of the number of employees. The responsible unit must be operational, adequately trained, ensure secure reporting channels, acknowledge receipt of reports within the prescribed time limits, and inform the whistleblower of the progress and outcome of the handling of the report within the timeframes established by law. The law also provides for an obligation to submit an annual consolidated report to the competent authority.
The law establishes a clear administrative investigation procedure, carried out by the responsible unit or by ILDKPKI, in accordance with the Code of Administrative Procedures. The investigation must be completed within the prescribed deadlines (a maximum of 90 days), guarantees the participation of the parties, the right to be heard, and limited access to the case file, while preserving the anonymity of the whistleblower. The law also provides for cases where the investigation is not initiated or is concluded without referral, as well as the obligation to notify the whistleblower through a reasoned decision.
The law provides for a system of administrative sanctions where violations do not constitute a criminal offence, aiming to ensure the effective functioning of whistleblowing mechanisms. In cases of administrative violations, ILDKPKI is the authority responsible for identifying violations and imposing administrative measures (fines), while its decisions may be appealed in accordance with the law on administrative offences. Sanctions may be imposed, inter alia, for failure to establish a responsible unit, for obstructing or threatening to obstruct reporting, for breaches of confidentiality, for failure to initiate or conclude investigations in accordance with the law, and for retaliatory actions against whistleblowers. The law also provides for liability in cases of false reports where it is proven that they were made with full knowledge.
Law No. 96/2025, published in Official Gazette No. 15, dated 21.01.2026, enters into force on 05.02.2026.
By Ened Topi, Partner, and Majlinda Karaj, Associate, Lalaj & Partners
