A website for a public institution in Romania: what the law requires, and what common sense does

A public institution's website is not a brochure site with a different logo. It carries legal obligations a company site does not, and most tenders deal with them in a single line: "the website shall comply with applicable legislation". That line means, concretely, a handful of verifiable things. Here they are, one by one.

We have built platforms for institutions and for organisations with public-utility status — most recently the Chamber of Commerce and Industry of Romania. What follows is the list we use before writing the first line of code.

Accessibility is mandatory, not optional

Since 2018, public-sector bodies in Romania have a legal obligation to run accessible websites. The basis is Government Emergency Ordinance 112/2018, which transposes Directive (EU) 2016/2102. The technical standard it points to is EN 301 549, which in practice means WCAG 2.1, level AA.

What "accessible" means, briefly: enough contrast between text and background, the whole site usable from the keyboard, visible focus, headings in logical order, images with alternative text, forms with labels, video with captions, nothing that depends on colour alone or on the mouse alone.

Two things are missing from almost every tender:

1. Who verifies. A Lighthouse score is not an accessibility audit. Verification is done with an automated tool (axe-core, for instance) and by hand, from the keyboard and with a screen reader, on every page type.
2. When. At the end, when everything is finished, is too late. Accessibility is checked at every delivery, as a threshold, not as a list to fix after launch.

The accessibility statement

The same ordinance requires every public website to publish an accessibility statement in a set format: how far the site meets the standard, which parts do not and why, how a user can report a problem and to whom.

The statement is not a text to copy from another site. Every claim in it has to be true for that particular site. At CCIR we took the published statement and checked every point against the platform; where reality did not match the text, we fixed the platform, not the text.

Data protection: more than a policy page

GDPR applies to any website that processes personal data, so to any site with a form. For a public institution there are a few extra obligations:

• A data protection officer. Public authorities and bodies are required to designate one. Their contact details must be published.
• A legal basis for every form. A contact form, an event registration and a newsletter subscription rest on different bases. The privacy policy has to say, for each, what data is collected, why, for how long, and who sees it.
• Where messages end up. If a form sends the message to a specific directorate, with a copy kept in the admin, that has to be designed, not left to a plugin's defaults. At CCIR every form routes to a department and keeps the message in the admin as a record.

Cookies and analytics

Law 506/2004 requires the user's consent before cookies that are not strictly necessary are placed on their device. Analytics fall under this. Concretely:

• no analytics script starts before consent;
• refusing is as easy as accepting;
• consent can be withdrawn at any time, from a visible place.

If the site uses Google Analytics, Google additionally requires Consent Mode v2 for data to be processed correctly according to consent. That is not law, it is a vendor condition — but without it the analytics become unusable.

Public-interest information

Law 544/2001 obliges institutions to publish, on their own initiative, a set of information: the normative acts that govern them, the organisational structure, working hours, the names of people in management, funding sources, the budget, how to file a complaint. Law 52/2003 adds decision-making transparency: draft normative acts are published before adoption, with a deadline for comments.

On the website this means a section that is easy to find, updated on time, with documents in accessible formats, not scanned as images. A scanned PDF cannot be read by a screen reader and cannot be searched.

What the law does not require, but common sense does

• Services up front. Whoever visits an institution's website usually wants a service: a certificate, a permit, an appointment. The site's structure has to start from what the visitor is looking for, not from the org chart.
• Search that works. The default search of most platforms returns anything. For a site with thousands of historical pages, the index has to be built: services and main pages get priority, the archive comes after.
• The phone. Most visitors arrive on a phone. Every template is tested at 360 px wide, not only on the developer's monitor.
• A second language, if there is one, at the same level. A half-translated English version does more harm than none. Every page has its counterpart, with its own address and hreflang markup, or it is not published.
• Migrating the old content without losses. An institutional site has years of releases and documents that other sites, the press and official documents link to. Every old address gets a destination. How we did that for 17,962 entries is in the article on migration.
• The team's autonomy. The institution must be able to publish on its own, without calling the vendor for every release. That is decided when the platform is chosen and by how the admin is built.

For the tender

If you are preparing a tender, ask explicitly for:

• WCAG 2.1 AA conformance, verified automatically and by hand, with a report at every delivery;
• an accessibility statement written for the delivered site, not copied;
• a privacy policy with a legal basis for every form and the data protection officer's details;
• working cookie consent, with refusal as easy as acceptance;
• a public-interest information section, with documents in accessible formats;
• a migration plan with a redirect map for every old address;
• testing on a phone, at 360 px, for every page type;
• handover with full access to code and content, with no dependency on the vendor.

Every point above can be checked in 30 minutes, by anyone, on the delivered site. That is the difference between "complies with applicable legislation" and a site that actually does.