GDPR Compliance in Romania: A Practical Guide for Businesses

The General Data Protection Regulation (GDPR) has been directly applicable in Romania since 25 May 2018, replacing the previous national law on data protection. Any business that collects or processes personal data of individuals in Romania—whether customers, employees, or website visitors—must comply with its requirements. This guide outlines the core obligations and practical steps for companies operating in Romania.

Who does GDPR apply to?

GDPR applies to any organisation, regardless of its location, that offers goods or services to individuals in the European Union or monitors their behaviour. In Romania, this includes both Romanian companies and foreign businesses with Romanian customers. Even small firms and sole traders must comply if they handle personal data such as names, email addresses, or identification numbers.

Key obligations for businesses

• Lawful basis for processing: you must identify a valid legal ground, such as consent, contract performance, legal obligation, or legitimate interest, before collecting or using personal data.
• Transparency and privacy notices: inform individuals clearly about what data you collect, why, how long you keep it, and their rights.
• Data subject rights: individuals can request access, rectification, erasure, restriction, portability, and object to processing. You must respond within one month.
• Data security: implement appropriate technical and organisational measures to protect personal data from breaches.
• Data breach notification: notify the Romanian supervisory authority (ANSPDCP) within 72 hours of becoming aware of a breach if it risks individuals' rights and freedoms; also inform affected individuals if high risk.
• Records of processing activities: keep internal documentation of data processing operations, unless your organisation has fewer than 250 employees and processing is not risky.

Special considerations in Romania

The Romanian data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), is responsible for enforcement. It has issued guidance and fines consistent with the GDPR. Romanian law also includes specific provisions on employee monitoring, CCTV use, and the processing of national identification numbers (CNP), which require extra caution.

Practical steps to achieve compliance

1. Map your data: identify what personal data you collect, where it is stored, who has access, and why it is processed.
2. Update privacy policies: draft clear, concise privacy notices for your website, apps, and other touchpoints.
3. Review consent mechanisms: ensure consent is freely given, specific, informed, and unambiguous; use opt-in boxes and allow easy withdrawal.
4. Train staff: educate employees about data protection principles, secure handling, and how to recognise and report breaches.
5. Appoint a Data Protection Officer (DPO) if your core activities involve large-scale regular monitoring or processing of sensitive data.
6. Vet third-party processors: sign data processing agreements with any vendor handling personal data on your behalf.

Penalties for non-compliance

Failure to comply with GDPR can result in administrative fines of up to €20 million or 4% of annual global turnover, whichever is higher. The ANSPDCP has imposed fines on various organisations, including for unlawful video surveillance and failure to respond to data subject requests. Beyond fines, non-compliance can damage trust and business reputation.

Staying compliant with GDPR is an ongoing process, not a one-off task. By embedding data protection principles into everyday operations, businesses in Romania can build customer confidence and avoid regulatory risk.