What to Do During a Dawn Raid in Romania (2026): Law 111/2025, Privilege Rules and On‑site Checklist

Knowing what to do during a dawn raid is the single most important compliance skill a Romanian in‑house team can develop, yet most companies only think about it after inspectors are already standing in reception. Romania’s Law 111/2025, published in the Monitorul Oficial and now fully in force, has reshaped the rules around attorney–client privilege during competition inspections, giving companies a clearer, but more demanding, on‑site process for protecting privileged communications. At the same time, the Romanian Competition Council (Consiliul Concurenței, or RCC) retains broad statutory powers to enter premises, copy documents, and forensically image electronic devices.

This article delivers a complete, Romania‑specific dawn raid playbook for 2026: the immediate actions your team must take, the precise limits on inspector powers, the step‑by‑step privilege assertion process under Law 111/2025, forensic imaging best practice, and a practical do’s‑and‑don’ts checklist you can share with every employee who might encounter inspectors.

TL;DR Action Card, Immediate Actions When Inspectors Arrive

If Romanian Competition Council inspectors, or any other authority exercising dawn raid powers, arrive at your premises, follow these steps in order. Every minute counts, and the actions taken in the first quarter‑hour often determine the legal outcome.

1. Reception: verify identity and scope. Ask every inspector for official identification and a copy of the inspection order or court authorisation. Use this script: “We cooperate fully. Please provide your inspector IDs, the written inspection order and its scope. We are contacting our legal department now.”
2. Call your dawn raid response team. Immediately notify in‑house counsel, the compliance officer, and, if your dawn raid policy requires it, external criminal or competition counsel.
3. Alert IT. Instruct the IT team to suspend any automatic data‑deletion routines, backup overwrites, or scheduled purges. Preservation is paramount.
4. Escort, do not obstruct. Assign a senior employee to accompany each group of inspectors at all times. Record which rooms they enter, which documents they review, and which devices they request.
5. Segregate privileged materials. If inspectors reach for documents that may be covered by attorney–client privilege, immediately flag them and request the sealed review procedure under Law 111/2025.
6. Log everything. Start a contemporaneous written log: inspector names, arrival time, rooms visited, documents copied, devices imaged, questions asked, and answers given.
7. Do not destroy, delete, or conceal anything. Obstruction carries severe penalties and can transform a regulatory investigation into a criminal matter.
8. Obtain copies. Request copies of every document the inspectors copy or seize, and obtain the full imaging report for any electronic devices.

What a Dawn Raid Looks Like, Who May Arrive, What Powers They Have, and the Typical Timeline

Understanding what happens during a dawn raid removes much of the shock and allows your team to respond methodically rather than reactively. A Romanian Competition Council dawn raid follows a broadly predictable pattern, though the details vary depending on the nature of the investigation.

Who Carries Out Dawn Raids in Romania

The RCC is the primary authority empowered to conduct unannounced inspections at business premises in competition matters. Inspectors from the RCC’s Investigation Directorate carry out the on‑site work. In certain cases, particularly cross‑border cartel investigations, the RCC may act in coordination with the European Commission’s Directorate‑General for Competition or with competition authorities from other EU Member States. Police officers may accompany the inspection team where a court has authorised forced entry or where there are concerns about physical obstruction.

Typical Timeline: Arrival → Entry → Inspection → Seizure/Imaging → Exit

Dawn raid procedures generally unfold across four distinct phases over the course of a single business day, though complex inspections can extend into a second day.

• Minutes 0–15 (arrival and entry). Inspectors present identification and the written inspection order at reception. They explain the legal basis for the inspection and the general scope of documents and data they intend to examine. Entry should not be physically prevented.
• Minutes 15–60 (initial sweep). The inspection team fans out across the premises. They typically begin with the offices of senior management, the legal department, commercial and sales departments, and any shared meeting rooms. Inspectors may ask employees to step away from their workstations.
• Hours 1–4 (document review and copying). Inspectors review physical files and electronic data. They may use keyword searches on servers, email systems, and individual devices. Documents of interest are copied or flagged for seizure. This is the phase where privilege claims most commonly arise.
• Hours 4–8+ (imaging, wrap‑up, and exit). Forensic imaging of selected devices takes place. The inspection team prepares an inventory of all documents seized and data imaged, obtains signatures from company representatives, and departs. Companies should insist on receiving a copy of the inventory before the inspectors leave.

Common Documents and Items Inspectors Seek

RCC inspectors focus on evidence that could reveal anti‑competitive agreements, market allocation, price‑fixing, or abuse of dominance. In practice, the most commonly targeted items include:

• Board minutes, strategy presentations, and internal pricing memoranda
• Email correspondence (including personal email accessed on company devices) between competitors or containing sensitive competitive intelligence
• Messaging applications (WhatsApp, Signal, Teams) on company‑issued phones and laptops
• Handwritten notes, diaries, and calendars of commercial directors
• Shared drive folders, CRM databases, and contract management systems
• Travel expense records and meeting logs that may indicate contact with competitors

Law 111/2025 and Attorney–Client Privilege During Dawn Raids, What Companies Must Know

Law 111/2025 represents the most significant change to the treatment of attorney–client privilege during dawn raids in Romania in over a decade. Published in the Monitorul Oficial and applicable to all inspections conducted from its effective date, the law codifies a structured procedure for asserting privilege on site, replacing what had previously been an inconsistent, inspector‑by‑inspector approach. For in‑house teams, understanding the privilege framework under Law 111/2025 is no longer optional; it is a core dawn raid survival skill.

The statute establishes that communications between a company and its qualified legal counsel, whether external lawyers registered with a Romanian bar or in‑house lawyers holding a valid UNBR (Uniunea Națională a Barourilor din România) membership, are protected from inspection, provided the company follows the prescribed on‑site procedure to assert the claim. The protection covers written opinions, litigation strategy documents, and communications made for the purpose of seeking or providing legal advice.

The on‑site privilege assertion process under Law 111/2025 operates as follows:

1. Immediate identification. The moment an inspector reaches for or identifies a document that the company considers privileged, the company representative must verbally assert the privilege claim and physically segregate the document. Do not allow the inspector to read, copy, or photograph the material.
2. Marking and logging. Each claimed document must be marked with a notation such as “Attorney–client privilege asserted, Law 111/2025” and recorded in a privilege log. The log should include: the date, a brief non‑revealing description of the document, the identity of the lawyer involved, and the basis for the privilege claim.
3. Sealed envelope procedure. Disputed documents are placed in a sealed envelope (or digital equivalent for electronic files) in the presence of both the inspector and the company representative. The envelope is signed across the seal by both parties. Neither party may access the contents until the dispute is resolved.
4. Independent review. Where the inspectors contest the privilege claim, Law 111/2025 provides for an independent review mechanism. The sealed materials are submitted to a reviewing authority, typically a judge, who examines each document and determines whether the privilege claim is valid without disclosing the content to the inspection team.
5. Outcome. Documents confirmed as privileged are returned to the company without being included in the investigation file. Documents where the privilege claim is rejected are released to the RCC, though the company retains the right to challenge this determination through further judicial review.

The practical risk is clear: if your team fails to assert privilege before inspectors read a document, the privilege may be treated as waived for that material. Instructing all employees to flag any document involving legal advice, and to refuse politely but firmly to hand it over unmarked, is therefore essential. Industry observers expect the independent review mechanism to be tested frequently in the first years of Law 111/2025’s operation, and early indications suggest that companies with well‑prepared privilege logs and pre‑labelled legal files will fare significantly better than those attempting to assert privilege retroactively.

The recommended on‑site script when asserting privilege is: “We assert attorney–client privilege over these documents under Law 111/2025. We request that they be placed in a sealed envelope, signed by both parties, and submitted for independent review. We will provide a privilege log describing each document.”

Inspectors’ Powers and Legal Limits (Romania), What They Can and Cannot Do

Understanding the boundaries of a Romanian Competition Council dawn raid is critical. Dawn raid procedures are governed by Romania’s competition legislation and the inspection order, which defines the scope of the specific investigation. Knowing your rights during a dawn raid in Romania allows your team to cooperate fully while protecting legitimate interests.

Powers With a Court Authorisation vs. Standard Inspection Order

RCC inspectors may conduct inspections based on an administrative inspection order issued by the RCC President. This order permits entry to business premises, examination and copying of business records, and the taking of oral statements. Where the company refuses access or where the RCC has reason to believe evidence may be concealed or destroyed, the RCC may obtain a court authorisation. A court‑authorised inspection additionally permits forced entry, the search of non‑business areas (including locked personal offices), and, in limited circumstances, the inspection of private vehicles on company premises.

Limits on Queries, Private Communications, and Employees’ Rights

Inspectors may ask employees questions about business operations, but employees are not obliged to provide self‑incriminating statements. Employees have the right to have a company representative or counsel present during questioning. Private personal communications on personal devices not owned by the company are, as a general principle, outside the scope of a standard inspection order, though messages on company‑issued devices fall squarely within the inspectors’ remit. Any questions that exceed the stated scope of the inspection order should be noted and politely declined pending legal advice.

Penalties for Obstruction and Safe Alternatives

Obstructing an RCC inspection, whether by physically blocking entry, destroying or concealing documents, providing misleading information, or breaking sealed envelopes, carries substantial fines. Depending on the severity, obstruction may also constitute a criminal offence. The safe alternative is always to cooperate while asserting your rights: escort inspectors, log their actions, and invoke the privilege and review procedures established by Law 111/2025 rather than engaging in any form of resistance.

Device Imaging Rules and Chain‑of‑Custody, Practical Steps for Romania

Electronic evidence increasingly dominates dawn raid outcomes. How devices are imaged, handled, and tracked after seizure can determine whether the evidence is admissible and whether your company can challenge its integrity. The following device imaging rules and chain‑of‑custody procedures reflect both Romanian practice and international best practice recommended by the International Competition Network.

On‑Site Forensic Imaging: Recommended Procedure

When inspectors indicate that they intend to image a device, whether a laptop, desktop, server, or mobile phone, the in‑house team should follow these steps to protect the company’s interests:

1. Photograph the device before it is handled, showing its current state (open/closed, powered on/off, screen contents if visible).
2. Record the device’s identifying details: make, model, serial number, asset tag, and the name of the assigned user.
3. Note the power state. If the device is powered on, do not shut it down, volatile data in memory may be evidentially relevant. If powered off, do not turn it on.
4. Request the use of a write‑blocker. A hardware or software write‑blocker prevents any modification to the source data during imaging. Insist that the inspection team uses one and record the write‑blocker’s make and serial number.
5. Insist on hash verification. After imaging, a cryptographic hash (typically SHA‑256) should be generated for both the source device and the image. Matching hashes confirm that the image is a bit‑for‑bit copy. Record the hash values in the log.
6. Obtain a copy of the image or, at minimum, the imaging report. This allows your forensic counsel to conduct a parallel review.

Using a Neutral Third‑Party for Imaging

Where disputes arise over the imaging process, or where the volume of data is large and privileged material may be co‑mingled, the company may request that a neutral, court‑appointed or mutually agreed forensic expert conducts the imaging. This approach adds cost but significantly strengthens the company’s position if the integrity of the evidence is later challenged. Industry observers expect neutral third‑party imaging to become more common under the Law 111/2025 framework, particularly in cases involving large email archives where privileged communications are dispersed across thousands of messages. The European Commission’s own guidance on electronic evidence handling in competition cases supports the use of independent forensic specialists where proportionality and privilege concerns arise.

Chain‑of‑Custody Checklist and Evidence Log Template

A proper chain‑of‑custody record should accompany every device or image from the moment it is seized until its return or final disposition. Your dawn raid checklist should include a pre‑printed evidence log with fields for: date and time of seizure, device description, serial number, name of person handing over the device, name of person receiving it, storage location, hash values, and the signature of both parties at each transfer point.

Do’s and Don’ts for In‑House Teams

Distribute the following lists to every employee who might encounter inspectors during a dawn raid. Simplicity saves time, and mistakes.

Do:

• Call in‑house counsel and external competition or criminal counsel immediately.
• Cooperate with the inspection, escort inspectors, provide access, and answer non‑privileged factual questions truthfully.
• Assert privilege clearly, using the on‑site script above, for any document involving legal advice.
• Preserve all documents and electronic data. Suspend scheduled deletion or overwrite routines.
• Maintain a detailed contemporaneous log of the entire inspection.
• Insist on receiving copies of everything the inspectors copy or seize.

Don’t:

• Delete, shred, hide, or alter any document or electronic file, before, during, or immediately after the raid.
• Provide passwords or unlock devices without in‑house counsel’s approval.
• Volunteer information beyond what is asked. Keep answers factual and concise.
• Allow employees to communicate with each other about the raid via messaging apps, inspectors may later review those messages.
• Physically obstruct inspectors or refuse lawful access to premises or data.
• Break a sealed envelope containing disputed privileged documents.

After the Raid, Immediate Follow‑Up, Preservation, Legal Steps and Internal Investigation

The conclusion of the on‑site inspection is the beginning of a critical post‑raid phase. What your team does in the hours and days following a dawn raid can materially affect the outcome of the investigation.

Preservation and Internal Triage

As soon as inspectors leave, issue a formal litigation hold notice to all relevant employees and IT administrators. This notice must instruct them to preserve all documents, emails, messages, and electronic data that may be relevant to the investigation. Conduct an immediate internal triage: compare the inventory of seized or copied materials against the company’s own records. Identify any privileged documents that were inadvertently disclosed, and prepare a formal objection to their inclusion in the investigation file.

Engaging Forensic Counsel and Filing Motions or Complaints

If the company believes that the inspection exceeded its stated scope, that the imaging process was forensically unsound, or that privileged materials were improperly accessed, engage specialised forensic and legal counsel without delay. Procedural challenges, including motions to exclude improperly obtained evidence or complaints about the conduct of the inspection, are subject to tight statutory deadlines. The likely practical effect of Law 111/2025’s independent review mechanism is that disputes over privilege will be resolved more rapidly than under the previous ad‑hoc system, but only if the company has maintained meticulous records during the raid.

Internal Notice and Communications

Notify the company’s board of directors, audit committee, and, where relevant, professional liability or D&O insurers of the inspection and its scope. Consider whether disclosure obligations arise under listing rules, contractual notification clauses, or data protection regulations (where personal data of employees has been imaged). Any external communications about the raid, including to media, should be cleared through legal counsel. Internal communications should be kept to a factual minimum and marked as privileged where appropriate, to avoid creating additional discoverable material.

Quick Downloadable Assets

The following resources are designed to be printed, stored at reception, and distributed to your dawn raid response team in advance of any inspection:

• Dawn raid one‑page action card (printable A4)
• Device imaging checklist (IT team version)
• Chain‑of‑custody evidence log template
• Privilege assertion script (Law 111/2025‑compliant)

Conclusion

Knowing what to do during a dawn raid is ultimately about preparation, composure, and procedural discipline. The companies that navigate Romanian Competition Council inspections most effectively in 2026 are those that have invested in advance: establishing a written dawn raid policy, training reception and IT staff, pre‑labelling privileged files, and rehearsing the privilege assertion process mandated by Law 111/2025. Every employee who might encounter inspectors should have access to the action card and scripts outlined in this guide. By following the stepwise procedures above, verifying identity, calling counsel, escorting inspectors, asserting privilege correctly, insisting on sound device imaging, and maintaining a meticulous log, your organisation can protect its rights while demonstrating the full cooperation that Romanian law requires.

Sources

1. Consiliul Concurenței (Romanian Competition Council), Official Website
2. Legislație.just.ro, Official Romanian Legislative Database (Law 111/2025)
3. Monitorul Oficial al României
4. International Competition Network (ICN), Dawn Raid Resources
5. Uniunea Națională a Barourilor din România (UNBR)
6. European Commission, Directorate‑General for Competition