A share purchase agreement in Romania should do more than record the number of shares and the price. It must connect the buyer’s due diligence findings with the conditions for closing, the seller’s warranties, specific indemnities, price mechanics and the corporate and regulatory steps needed to transfer control safely.

This guide is written for foreign investors, international groups, founders and business owners negotiating the acquisition or sale of a Romanian company. It focuses on private acquisitions of shares or social parts, particularly Romanian limited liability companies (SRLs). Listed-company rules, regulated-sector acquisitions, privatisations and public takeovers require additional analysis.

The article complements our procedural guide to changing shareholders in a Romanian company. That guide covers the Trade Register implementation. This one explains how the commercial acquisition should be investigated, negotiated and protected contractually.

What does a share purchase agreement do in Romania?

A share purchase agreement, commonly called an SPA, is the principal contract under which the seller agrees to transfer and the buyer agrees to acquire shares or social parts in a Romanian company. It identifies the securities, price, conditions, closing process and allocation of risk between the parties.

The agreement operates within Romanian contract law and the mandatory rules applicable to the target’s corporate form. For an SRL, the transfer mechanics must be aligned with Articles 202 and 203 of Company Law no. 31/1990 and the applicable registration formalities before the National Trade Register Office (ONRC).

Why must legal due diligence come before the SPA is finalised?

Due diligence should identify the matters that can change the decision to buy, the valuation, the deal timetable or the contractual protection. A report that merely lists documents does not complete the task. Each material finding should be converted into a transaction response.

The scope normally covers corporate title and governance, financing and security, material contracts, real estate, employment, tax, disputes, permits, regulatory compliance, intellectual property, IT, data protection, environmental matters and beneficial ownership. Sector, size and business model determine the emphasis.

Which clauses matter most in a Romanian share purchase agreement?

The SPA should describe the transaction as one coherent mechanism. Definitions, price, conditions, warranties, disclosure, indemnities, limitations, covenants and closing deliverables must work together. Imported English-law wording should not be used without checking how it operates under the chosen governing law and Romanian mandatory rules.

How should the purchase price be structured?

The price clause should explain both the headline value and the route from that value to the amount paid. A fixed price is not necessarily simple if debt, cash, working capital, leakage, earn-outs, holdbacks or currency conversion remain unresolved.

A buyer should not treat escrow as a substitute for a coherent claims regime. The SPA should state whether recovery is limited to the escrow, whether the buyer may set off, how competing claims are handled and what happens when the escrow expires.

What is the difference between signing and closing?

Signing creates the contractual commitment. Closing completes the agreed transfer and payment once the applicable conditions are satisfied or waived. They may occur on the same day in a simple transaction, but regulatory approvals, third-party consents, financing or restructuring often require a split process.

Which Romanian approvals and filings can affect closing?

The regulatory analysis should begin before the SPA timetable is agreed. A condition drafted after signing cannot restore leverage or time already lost.

Corporate approval and ONRC registration

For an SRL transfer to an outside buyer, Article 202 of Company Law no. 31/1990 applies together with the target’s articles of association. The parties should verify statutory approval thresholds and any pre-emption or consent rights created by the articles of association, as well as pledges and other restrictions. The applicable ONRC registration formalities and the update of the company’s shareholder register should be built into the completion process.

ANAF notification and tax-debt safeguards

The practical scope of Article V of Law no. 239/2025, as amended by Government Emergency Ordinance no. 13/2026, should be verified in light of the transaction structure and current ONRC and ANAF practice. Although the regime was introduced in the context of transfers affecting company control, registration practice during 2026 has raised questions regarding its application to a broader range of SRL share transfers, as discussed in this analysis of emerging ONRC practice. The parties should confirm the current notification, tax-certificate, guarantee and registration requirements before signing and again before filing.

Merger control

An acquisition of sole or joint control may constitute an economic concentration. Under Competition Law no. 21/1996, the Romanian thresholds are generally met where the combined worldwide turnover of the undertakings concerned exceeds EUR 10 million and at least two undertakings concerned each achieved Romanian turnover exceeding EUR 4 million in the previous financial year. The EU Merger Regulation may apply instead where its thresholds are met. Closing before the required clearance can expose the parties to gun-jumping risk.

Investment screening

Romania’s investment-screening regime under Government Emergency Ordinance no. 46/2022 was substantially amended by Government Emergency Ordinance no. 17/2026. The general value threshold is now EUR 5 million, but a transaction below the threshold may still be examined if it may affect security, public order or EU projects or programmes. The rules can apply to EU and non-EU investors, and the filing contribution is EUR 5,000 where an authorisation application is required. Sector, investor, control, value and transaction structure must be screened early.

Sector approvals, lender consents, foreign-subsidy review or contractual change-of-control notices may also be relevant. The SPA should allocate responsibility, information, cooperation, remedies and the long-stop date for each approval.

What should happen at closing?

Closing should be a coordinated exchange, not a loose collection of signatures. The SPA should identify every deliverable, who provides it, its agreed form and whether all actions are deemed simultaneous.

1. Confirm conditions. Record satisfaction or valid waiver of every closing condition.
2. Approve the transfer. Deliver the required shareholder and corporate resolutions.
3. Transfer the shares. Execute the required instruments and update the shareholder register.
4. Pay the consideration. Follow the funds flow, escrow and debt repayment arrangements.
5. Release security. Deliver releases of share pledges, guarantees or target security where agreed.
6. Change governance. Coordinate resignations, appointments, powers of attorney and bank mandates.
7. Deliver control items. Transfer corporate books, credentials, keys, seals and agreed records.
8. Complete filings. Submit ONRC and ANAF documents, together with beneficial-owner filings where required under the applicable transparency rules, within the relevant timetable.

What limitations should apply to seller liability?

Seller limitations often include a de minimis threshold, basket, aggregate cap, time limits, mitigation, exclusion of double recovery and a formal claim procedure. Tax, title, authority, fraud and specific indemnities may have different limits. The commercial result depends on how these provisions interact, not on any one headline cap.

The buyer should also test recoverability. A contractual claim against a seller with no accessible assets may provide little protection. Escrow, holdback, bank security, parent guarantee or warranty and indemnity insurance may be considered depending on transaction size and risk.

A buyer’s pre-signing checklist

1. Define the acquisition perimeter. Confirm percentage, target entities, securities and excluded items.
2. Verify title and authority. Check ownership, encumbrances, approvals and signatory powers.
3. Complete risk-focused due diligence. Prioritise issues that affect value, continuity or closing.
4. Translate findings into protections. Allocate each material issue to remediation, price, condition, warranty, indemnity or withdrawal.
5. Select the price mechanism. Define accounting rules, leakage, debt, cash, working capital and dispute resolution.
6. Screen regulatory approvals. Review merger control, investment screening, sector approvals and third-party consents.
7. Align signing and closing. Specify conditions, conduct rules, long-stop date, termination and closing deliverables.
8. Test recovery. Check caps, time limits, exclusions, seller credit and available security.
9. Plan filings and integration. Prepare ONRC and ANAF filings, beneficial-owner filings where required under the applicable transparency rules, governance steps and day-one actions.

The bottom line

A Romanian SPA should be the final expression of the buyer’s investigation and the parties’ negotiated risk allocation. The strongest agreement is not the longest. It is the one that identifies what is being bought, states how price is calculated, prevents closing before essential approvals, allocates known and unknown risks clearly and gives the parties an executable closing process.

Disclaimer: This article provides general information and does not constitute legal or tax advice. The correct structure, approvals, tax treatment and contractual protections depend on the parties, target, sector and facts of each transaction.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.

A GDPR data breach in Romania creates an immediate legal decision window. The company must contain the incident, determine whether personal data were compromised, assess the risk to individuals and decide whether the Romanian supervisory authority, the ANSPDCP, must be notified within 72 hours.

This guide is designed for Romanian companies, foreign investors, directors, compliance teams and data protection officers responding to an actual or suspected incident. It should be used together with an incident-specific legal and technical assessment. For preventive support and breach response, see our data protection services in Romania.

What qualifies as a personal data breach?

Article 4(12) of the General Data Protection Regulation defines a personal data breach as a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data. The concept is wider than a cyberattack and covers confidentiality, integrity and availability incidents.

A security event that does not involve personal data is not a personal data breach under GDPR. Conversely, a small incident can still be a breach. Under the data protection rules applicable in Romania, the number of affected people matters, but so do the sensitivity of the data, the ease of identification, the possible consequences and the vulnerability of the people concerned.

When does the 72-hour notification period start?

Article 33 requires notification without undue delay and, where feasible, no later than 72 hours after the controller becomes aware of the breach. According to the EDPB breach-notification guidelines, awareness exists when the controller has a reasonable degree of certainty that a security incident occurred and led to personal data being compromised.

A brief initial investigation may be necessary to determine whether personal data were actually affected. That does not permit an organisation to delay investigation or postpone escalation. Once there is reasonable certainty, the clock runs even if the full cause, exact number of records or final consequences are still being investigated.

Do not wait for a final forensic report before making the legal notification decision. Article 33 expressly permits phased notification when all information cannot be provided at the same time.

Must every breach be notified to the ANSPDCP?

No. Every breach must be recorded internally, but not every breach must be reported to the authority. The controller must assess the likely impact on the rights and freedoms of natural persons. The result falls into one of three practical levels.

Risk is not determined by a single formula. The company should consider the type of breach, nature and volume of data, identifiability, severity and likelihood of consequences, number and characteristics of affected people, and the effectiveness of safeguards such as encryption. The EDPB’s practical breach examples are useful benchmarks, but the actual incident must be assessed on its own facts.

What must an ANSPDCP notification contain?

Article 33(3) establishes the minimum information. The ANSPDCP’s current online notification form requests additional operational details that allow the authority to understand the incident and the controller’s response.

If exact figures are not yet available, provide reasonable estimates and state that the investigation continues. Under Article 33(4), missing information may be supplied in phases without undue further delay. If the filing occurs after 72 hours, it must include reasons for the delay.

How is a breach notified in Romania?

The ANSPDCP maintains a dedicated personal data breach notification page with access to its online form. Before submission, the company should identify the correct controller, confirm whether the incident also affects other group entities or joint controllers, and determine whether the ANSPDCP is the competent or lead supervisory authority for any cross-border processing.

The notification should be consistent with the internal breach register, technical evidence, communications plan and any supplemental filing. A company should not understate confirmed facts, speculate beyond the evidence or present an incomplete notification as final.

Who should be involved in the response?

A data breach cannot be handled by IT alone. The legal assessment depends on verified technical facts, while technical containment must preserve evidence and avoid creating inconsistent records. A small decision team should be activated immediately, with clear authority and one incident chronology.

• Security and IT: containment, forensic preservation, affected-system analysis, eradication, recovery and evidence of technical safeguards.
• DPO and legal counsel: awareness timestamp, controller or processor status, risk assessment, authority competence, notification drafting and privilege strategy where applicable.
• Management and communications: decision authority, resources, operational continuity, messaging and escalation to insurers or relevant corporate bodies.
• Processors and vendors: incident facts, contractual notification, audit cooperation, subprocessor information and coordinated remedial action.

What is the difference between a controller and a processor?

The controller decides why and how personal data are processed and carries the Article 33 duty to notify the competent supervisory authority. A processor must notify the controller without undue delay after becoming aware of a personal data breach. GDPR does not give processors a separate 72-hour period for notifying the controller.

Data processing agreements should therefore establish an immediate escalation channel, minimum incident information, continuous updates, preservation duties and cooperation with notifications and communications. A processor’s delayed or incomplete report does not remove the controller’s obligation once the controller becomes aware.

Vendor and technology contracts should be reviewed before an incident occurs. Our IT law services in Romania cover data-processing terms, security obligations, audit rights and incident-response clauses.

When must affected individuals be informed?

Under Article 34, the controller must communicate the breach to affected individuals without undue delay when it is likely to result in a high risk to their rights and freedoms. This obligation is separate from the 72-hour authority-notification rule. The communication must use clear and plain language and explain the nature of the breach, the contact point, likely consequences and measures taken or proposed.

Communication is not required when one of the Article 34(3) conditions applies:

• appropriate protection measures applied to the affected data and made them unintelligible to unauthorised persons, such as effective encryption;
• subsequent measures ensure that the high risk is no longer likely to materialise; or
• individual communication would involve disproportionate effort, in which case a public communication or similarly effective measure is required.

The message should help people protect themselves. Depending on the incident, practical steps may include changing credentials, enabling multi-factor authentication, contacting a bank, monitoring accounts, watching for targeted phishing or using a dedicated support contact. Avoid minimising the event or overwhelming recipients with technical detail.

How should breach risk be assessed?

The legal threshold concerns risk to people, not only damage to the company. Business interruption, contractual liability and reputational harm matter to the response, but they do not replace the individual-rights analysis required by Articles 33 and 34.

High-risk indicators include sensitive or criminal-offence data, authentication credentials, detailed financial or identity information, data concerning children or other vulnerable people, large-scale exposure, malicious exfiltration, weak safeguards and consequences that are difficult for individuals to reverse. Effective encryption, rapid verified retrieval from a trusted recipient and prompt credential revocation may reduce risk, but each control must be tested against the facts.

What evidence and documentation should be preserved?

Article 33(5) requires the controller to document every personal data breach, including the facts, effects and remedial action. The record must allow the supervisory authority to verify compliance. A defensible incident file should include:

• the original alert, detection data and a precise incident chronology;
• the awareness timestamp and the facts supporting it;
• affected systems, processing activities, data categories, people and record estimates;
• logs, forensic images, access records, emails, vendor reports and chain-of-custody information where relevant;
• containment, eradication, recovery and mitigation actions;
• the risk and high-risk assessments, including reasons and assumptions;
• the decision to notify or not notify, approvals and any delay explanation;
• copies of the initial and supplemental ANSPDCP filings;
• data-subject communications or the documented Article 34 exception; and
• post-incident findings, corrective actions and responsibility for completion.

Records should distinguish confirmed facts from estimates and hypotheses. The company should also consider cybersecurity, contractual and insurance requirements, DORA and other sector-specific reporting duties, and criminal-law reporting duties. These may use different thresholds and deadlines from GDPR.

A practical 72-hour response checklist

1. Activate the incident team. Establish one decision lead, secure communications and a contemporaneous chronology.
2. Contain without destroying evidence. Isolate affected resources, revoke compromised access and preserve logs and forensic material.
3. Confirm whether personal data are involved. Identify the controller, processor, systems, processing activities and data flows.
4. Record the awareness timestamp. Explain when reasonable certainty was reached and what facts supported it.
5. Map the scope. Identify data categories, affected people, approximate record volumes, jurisdictions and vulnerable groups.
6. Assess risk to individuals. Analyse likelihood, severity, safeguards, realistic misuse and reversibility of harm.
7. Decide on authority notification. Notify unless the breach is unlikely to create risk. Use phased notification if necessary.
8. Assess high risk separately. Decide whether individuals must be informed and prepare clear protective guidance.
9. Coordinate other duties. Review processors, insurers, contractual partners, cybersecurity rules and sector regulators.
10. Continue and close the response. Supplement filings, verify recovery, complete remediation and retain the breach record.

For a broader preventive review, use our GDPR compliance checklist for Romanian companies. Even though the checklist was published earlier, the core governance controls remain relevant and should be checked against current processing and security practices.

Frequently asked questions

Legal disclaimer: This article provides general information and does not constitute legal advice. The applicable response depends on the facts, the company’s role, the data and individuals affected, the competent authority and any sector-specific obligations. Obtain advice for the specific incident.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.

Debt recovery in Romania is not a choice between three interchangeable remedies. The right route depends on what the creditor can prove, how the debtor responds and whether an enforceable title already exists.

A clear invoice supported by a contract and proof of delivery may fit the payment-order procedure. A claim involving defective performance, disputed quantities, damages or set-off may require ordinary litigation. A judgment or another enforceable instrument moves the matter into enforcement, where the decisive question becomes whether the debtor has reachable assets.

This guide focuses on commercial money claims involving Romanian debtors or Romanian proceedings. It should be read together with the rules on late-payment interest and recovery costs in Romania.

Which debt recovery route should a creditor use in Romania?

What should be checked before any recovery action?

The first legal question is whether the claimed amount is actually due. The invoice is important, but it rarely proves the entire case by itself. The underlying agreement, order, delivery or service records, acceptance documents, correspondence, account statements and payment history should be read together.

The creditor should also confirm the correct debtor, corporate identity, contractual notice method, governing law, jurisdiction or arbitration clause, due date, interest basis, limitation position and any security or guarantee. A focused review of the underlying Romanian contract can expose a jurisdiction clause, acceptance mechanism or liability provision that changes the recovery strategy.

Is a formal payment demand required before filing?

The Article 1015 summons is not the same as an informal reminder. It should identify the agreement, principal, accessories, due date and payment account clearly. Proof of compliant service belongs in the court file. The statutory summons also has consequences for limitation under the payment-order rules.

A contract may impose an additional notice mechanism, address or cure period. The creditor should satisfy both the statutory requirement and any relevant contractual provision rather than assume one automatically replaces the other.

When is the Romanian payment-order procedure appropriate?

The payment-order procedure under Articles 1014 to 1025 of the Romanian Code of Civil Procedure applies to certain, liquid and due claims for payment of money arising from a civil contract and established through the documentary framework required by law. Commercial invoice claims commonly fit this structure when the underlying performance and amount are not genuinely in dispute.

“Certain” concerns the existence of the debt, “liquid” means the amount is determined or determinable, and “due” means the payment date has passed. These conditions must be established, not merely asserted. A debtor may contest the contractual basis, authority, delivery, acceptance, price, due date, payment, set-off or limitation.

What happens if the debtor raises a defence?

The existence of a defence does not automatically defeat the application. The court examines the documents and the parties’ explanations. It may reject the request if the debtor’s defence is well founded or if resolving the defence requires evidence that is admissible in ordinary proceedings but falls outside the payment-order framework. If the claim is established, the court may issue the payment order for the full amount or only for the part proved within the special procedure.

Rejection on either ground regulated by Article 1021 does not prevent the creditor from bringing an ordinary claim. If the court issues a payment order for only part of the claim, the creditor may use ordinary proceedings for the remainder. The Code also sets a procedural objective of issuing the order within 45 days from filing, but periods needed for service and delays attributable to the creditor are excluded. Actual duration depends on service, court workload, objections and the individual file.

Can the payment order be challenged?

The debtor may file an application for annulment within 10 days from communication of the payment order. Article 1024(2) also gives the creditor a narrowly defined annulment application against the rejection orders referred to in Article 1021(1)-(2) and against a payment order admitting only part of the claim. This limited remedy should be distinguished from the creditor’s separate right to bring ordinary proceedings after rejection or for the remainder not granted. The annulment application is not a general substitute for a full ordinary claim. The payment order remains enforceable while an annulment application is pending, although the debtor may request suspension subject to the statutory conditions and security.

When is an ordinary court action the better route?

Unlike the payment-order procedure, ordinary litigation can accommodate a fuller evidential process, including documents, witness evidence, party examination and expert evidence where admissible and relevant. This makes it better suited to construction, technology, professional services and supply disputes in which the unpaid invoice is only one part of a wider conflict. For broader procedural context, see our overview of the Romanian litigation process and court proceedings.

The claim should identify the legal basis and quantify principal, interest, contractual penalties and recoverable costs separately. Material jurisdiction is determined under the procedural law applicable when the proceedings are commenced. Claim value is only one criterion: the nature of the dispute, the relief sought and any special jurisdiction rules may displace the general allocation between district courts and tribunals. The competent court should therefore be verified against the claim as framed and the law applicable when the claim is registered with the court. Contractual arbitration clauses must also be checked before filing in a state court.

Ordinary court fees are normally calculated by reference to claim value under Government Emergency Ordinance no. 80/2013. The payment-order application has a fixed RON 200 court fee. Additional costs may include translations, experts, service, lawyer fees and enforcement advances. Recoverability of costs depends on the outcome, proof and the court’s assessment.

Can the small-claims procedure be used instead?

For eligible claims not exceeding RON 50,000 at the date of filing, the claimant may consider the Romanian small-claims procedure under Articles 1026 to 1033 of the Code of Civil Procedure. The threshold was increased to RON 50,000 by Law no. 57/2025. Interest, costs and other accessories are excluded when calculating the threshold.

The procedure is mainly written and uses standard forms, but statutory exclusions apply. It should not be treated as a smaller version of the payment order. A small claim may be disputed and still fit the procedure, while a payment-order claim is assessed against the special requirements for a certain, liquid and due contractual debt.

When can a creditor start enforcement in Romania?

An invoice, demand or favourable legal opinion is not by itself an enforceable title. A payment order, final or otherwise enforceable judgment, arbitral award, notarised instrument or another document given enforceable force by law may support enforcement, subject to its terms and any applicable formalities.

Possible methods include garnishment of bank accounts and third-party receivables, seizure and sale of movable property, enforcement against real estate and measures against security or guarantors where the title permits. The creditor should coordinate the title, outstanding calculation and asset information with the judicial executor. The European e-Justice Portal guidance on enforcing a court decision in Romania provides an official procedural overview.

Can the debtor challenge enforcement?

Yes. A debtor or another interested person may file an enforcement challenge on the grounds permitted by the Code. The ordinary period is often 15 days, but its start depends on the act challenged, knowledge of enforcement and the procedural situation. A challenge does not automatically mean the underlying debt never existed; it may concern the title, limitation, amounts, service, court approval or a specific enforcement act.

The general limitation period for obtaining enforcement is three years under Article 706 of the Code of Civil Procedure, unless the law provides otherwise. For court judgments and arbitral awards, it normally runs from finality. Acts of enforcement and other statutory events can interrupt the period.

What changes if the Romanian debtor is insolvent?

When insolvency proceedings open, Article 75 of Law no. 85/2014 generally suspends individual judicial, extrajudicial and enforcement measures for recovering claims against the debtor’s estate. The creditor must usually pursue the claim within the collective insolvency procedure and observe the deadline for filing its proof of debt. This general stay is subject to statutory exceptions, including certain proceedings against co-debtors or third-party guarantors, claims arising after the opening of insolvency and specific rules concerning secured funds or amounts already affected by enforcement. The position of secured creditors, including priority, distributions and any available relief from the stay, requires separate analysis under the insolvency legislation.

A creditor may apply to open insolvency if its claim satisfies the statutory requirements, including the RON 50,000 threshold and the presumption associated with a debt unpaid for more than 60 days. Insolvency should not be used merely as pressure where the debt is genuinely disputed or the statutory conditions are absent. It changes the recovery forum and priority structure rather than guaranteeing payment.

Security interests, guarantees, co-debtors and transactions concluded before insolvency require separate analysis. The opening of insolvency against the principal debtor does not necessarily eliminate every route against a guarantor or co-debtor. Our guide on Romanian company director liability explains why corporate debt and personal liability must not be treated as the same claim.

What interest and recovery costs can be claimed?

The creditor should distinguish principal, contractual penalty, statutory penalty interest, the EUR 40 minimum compensation and documented additional recovery costs. For qualifying B2B transactions, Law no. 72/2013 and Government Ordinance no. 13/2011 regulate statutory late-payment interest. Where Law no. 72/2013 applies and the parties have not agreed the level of late-payment interest, the legal penalty rate is the National Bank of Romania reference rate plus eight percentage points.

The EUR 40 minimum compensation under Law no. 72/2013 becomes due when the statutory conditions for late-payment interest are met. Additional recovery expenses must be substantiated. Contractual penalties require separate review under the Civil Code, including the court’s statutory power to reduce a manifestly excessive penalty in the circumstances allowed by law.

How do cross-border creditors recover Romanian debts?

A foreign creditor should first determine jurisdiction, governing law, service method and the place where assets are located. A Romanian proceeding may be appropriate when the debtor or assets are in Romania, but a valid jurisdiction or arbitration clause can change the route.

For qualifying uncontested cross-border pecuniary claims within the EU, Regulation (EC) no. 1896/2006 establishing a European order for payment may provide an alternative to the national payment-order procedure. Regulation (EU) no. 655/2014 may assist with a European Account Preservation Order in qualifying cross-border cases. Neither instrument replaces the need to establish jurisdiction, service and substantive entitlement.

Recognition and enforcement of judgments also depend on the country of origin and the applicable treaty or EU regulation. Our guide to the recognition and enforcement of foreign judgments in Romania explains that separate stage, while the guide to cross-border debt collection in Romania provides additional procedural context. The specific instrument should always be verified against the current parties and claim.

Common mistakes that weaken debt recovery

• Treating the invoice as the complete case. The creditor still needs the legal basis, performance evidence, maturity and a correct calculation.
• Using the payment order for an evidence-heavy dispute. A summary procedure cannot replace full litigation merely because the creditor wants speed.
• Ignoring the contract’s forum and notice clauses. Filing in the wrong court or serving the wrong address can cause delay and cost.
• Allowing limitation to drift. Commercial discussions do not always suspend or interrupt time. Each acknowledgment, notice and procedural step must be analysed legally.
• Accepting informal instalments without protection. A settlement should state the admitted amount, schedule, interest, default consequences, security and costs.
• Waiting until assets disappear. Litigation strategy should be coordinated with recoverability and lawful protective measures.
• Confusing company debt with director liability. A director is not automatically personally liable for every unpaid company invoice.
• Continuing individual enforcement after insolvency opens. The creditor may need to file in the insolvency proceedings instead.

A practical creditor checklist

1. Identify the exact debtor, contractual basis, currency and outstanding balance.
2. Collect the contract, orders, invoices, delivery records, acceptance evidence and correspondence.
3. Check governing law, jurisdiction, arbitration, notice and limitation.
4. Calculate principal, interest, penalties, EUR 40 compensation and documented costs separately.
5. Review debtor objections, payments, set-off and any counterclaim.
6. Assess assets, security, guarantors and insolvency indicators.
7. Serve the correct commercial and statutory demand.
8. Choose payment order, ordinary claim, small claims, settlement or insolvency participation deliberately.
9. Prepare for enforcement before judgment rather than after assets have disappeared.
10. Maintain one chronological file with originals, service records and calculations.

The Bottom Line

Debt recovery in Romania works best when procedure follows evidence. A payment order can be effective for a clear contractual money claim, but it is not a shortcut around a genuine dispute. Ordinary court proceedings provide the broader evidential framework required for contested cases. Enforcement comes after title and depends on identifiable assets, while insolvency can redirect the entire claim into a collective process.

For Romanian companies managing receivables, the earlier unpaid invoices guide for Romanian SRLs explains the operational starting point. Businesses can also reduce future disputes by strengthening the payment, acceptance, security and dispute clauses in their commercial contracts governed by Romanian law.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.