Compliance under Romanian law,
documented in English
A group framework rarely covers the national part
Most companies with foreign ownership arrive with a GDPR framework already written, usually at group level and usually sound. It tends to stop at the European layer.
What sits underneath is national and differs from one member state to the next. In Romania, the personal numeric code has its own regime under Law no. 190/2018, which allows processing on legitimate interest only with specific safeguards, one of them being the appointment of a data protection officer. Workplace monitoring has conditions of its own. The internal reporting channel is governed by Law no. 361/2022. Access to information stored on a user’s device falls under Law no. 506/2004, not only under the GDPR.
And when the authority writes, it writes in Romanian, with a short deadline to reply. That is the part we handle.
What we do
GDPR
Audit, implementation and outsourced DPO. Covers what a group policy usually leaves out: the national identification number, employee monitoring, the internal reporting channel and dealings with ANSPDCP.
- Compliance audit and remediation plan
- Records of processing activities
- Outsourced DPO, from 350 EUR/month
- Preparation for an inspection
AI Act
Regulation (EU) 2024/1689 applies to the company that uses an AI system, not only to the one that builds it. Inventory, classification and the documentation each role requires.
- Inventory of AI systems in use
- Risk classification, including Annex III
- Internal AI use policy
- Documentation for high-risk systems
NIS2
Directive (EU) 2022/2555, transposed in Romania by GEO no. 155/2024, approved with amendments by Law no. 124/2025. Scoping, measures and the incident reporting procedure to DNSC.
- Scoping: essential or important entity
- Technical and organisational measures (Art. 21)
- Incident reporting to DNSC (24h / 72h)
- Supply chain risk assessment
Training
Two sessions for management and staff, delivered in English. What the rules require in practice, and what the people who handle data are expected to do differently.
- Two sessions of three hours
- On site or online
- Up to 30 participants
- Certificate of attendance
Four stages
- 01
Free initial audit
We go through what you process, on what basis and with which suppliers. You receive a written picture of where the company stands. No obligation to continue.
- 02
Report and plan
The gaps, ordered by exposure rather than by ease. Each item says what has to be produced, who signs it and what it changes in daily work.
- 03
Implementation
We draft the documentation and adapt it to how the company actually operates. Policies that describe a process nobody follows are the most common finding in an inspection.
- 04
Ongoing work
Outsourced DPO, periodic review, staff training and correspondence with the authority when it arrives.
What we are, and what we are not
GLOBAL DATA PROTECTION SRL, trading as dataconsulting.ro, is a compliance consultancy. We are not a law firm and we do not represent clients before the courts. We are not a certification body and we do not issue certificates of compliance.
What we produce is documentation that holds up when it is examined: records, policies, assessments and, at the end of an implementation, a compliance audit report describing the measures actually in place. Where a recognised certification is required, we prepare the file and submit it to the accredited body, which decides.
Frequently asked
Do you work in English?
Yes. Documentation, reports, policies and correspondence are produced in English. Where a document has to be filed with the Romanian authority or signed by employees, we provide the Romanian version as well, since that is the one that applies locally.
Our group already has a GDPR framework. Why would we need anything local?
Because several obligations are national, not European. The national identification number has its own regime under Law no. 190/2018, workplace monitoring has specific conditions, the internal reporting channel is governed by Law no. 361/2022, and correspondence with the supervisory authority is in Romanian. A group framework rarely covers these.
Who is the supervisory authority in Romania?
ANSPDCP, the National Supervisory Authority for Personal Data Processing. For cybersecurity under NIS2 the competent body is DNSC, the National Cyber Security Directorate. Both correspond in Romanian.
Do you issue certificates of compliance?
No. We are a consultancy, not a certification body and not a law firm. At the end of an implementation we produce a compliance audit report documenting the technical and organisational measures in place. Where a recognised certification is required, such as Europrivacy, we prepare the file and submit it to the accredited certification body, which decides.
Want to know where your company stands?
The initial audit is free. You receive a written picture of what you process, on what basis, and what is missing. No contract, no commercial pressure.
We reply directly, with no obligation.