Articles and analysis
19 articles. Each is also available on the Romanian blog.
GDPR fines in Romania — real cases, and what they teach
ANSPDCP has imposed more than 260 fines since 2018. UniCredit, Rompetrol, Raiffeisen, UiPath, Orange, EON: what went wrong in each case, which breaches recur, and where AI Act enforcement stands in Romania.
Read the articleOutsourced DPO in Romania — when it is mandatory, and what it costs
The three Article 37 cases, the Romanian rule that makes a DPO mandatory when the personal numeric code is processed on legitimate interest, group DPOs and the language question, indicative market costs and how to choose a provider.
Read the articleNIS2 in Romania — who is in scope, and what the obligations are
GEO 155/2024 and Law 124/2025: sectors, size thresholds and the Romanian additions, essential and important entities, registration and risk assessment with DNSC, the 24-hour reporting timeline and the fines.
Read the articleCookie banners and GDPR in Romania — what the law requires
Article 4(5) of Law 506/2004 and the GDPR consent standard, why the one-stop shop does not apply to cookies, the five mistakes that are fined, a Romanian cookie fine upheld in court, and a seven-point checklist.
Read the articleEU AI Act: what it means for your company, and where to start
A company whose staff use ChatGPT or Copilot is a deployer under the AI Act. Provider and deployer roles, the risk categories, what a deployer must do, the dates as amended by the Digital Omnibus in July 2026, the fines, and where enforcement stands in Romania.
Read the articleHigh-risk AI classification: the two routes, the Article 6(3) filter and the new dates
An AI system becomes high-risk through regulated products (Annex I) or the uses in Annex III. The Article 6(3) filter can take it out — but never when it profiles people. The Commission draft guidelines, documenting the exception, and the dates after Regulation 2026/1744.
Read the articleCyber Resilience Act: the reporting obligation also covers the products you have already sold
The CRA applies from December 2027, but Article 14 has applied since 11 September 2026 — and the derogation in Article 69(3) extends it to the whole portfolio on the market, including unmodified legacy products. Triggers, the 24-hour timeline, the ENISA platform and DNSC.
Read the articleChatGPT at work — GDPR and AI Act obligations
What happens when staff enter data into ChatGPT or Copilot: Articles 4 and 50 of the AI Act, the GDPR requirements, consumer versus business plans, the Romanian rule on monitoring employees, and what an AI use policy should contain.
Read the articleDPIA — data protection impact assessment in Romania (Article 35 GDPR)
The seven operations on the ANSPDCP list (Decision 174/2018), the steps of an assessment, prior consultation under Article 36, common mistakes, and how the AI Act fundamental rights impact assessment relates to it.
Read the articleGDPR in Romania: what every company should know
The core obligations — lawful basis, notices, the record of processing, processor agreements, breaches, requests — and the Romanian layer a group policy usually misses: the CNP, employee monitoring, cookies and the national DPIA list.
Read the articleZero-knowledge proofs and GDPR: identity verification without a copy of the ID card
Many companies collect an ID copy, a selfie and an address to learn a single fact. Zero-knowledge proofs verify a condition without passing on the data behind it. What Articles 5 and 25 GDPR require, where the European wallet stands, and who remains responsible.
Read the articleMobile data: how it travels from apps to the data broker market
App data is described as anonymous and collected for advertising, yet it reaches a market from which identifiable people’s movements can be reconstructed. Why the advertising identifier is personal data, when location becomes special category data, and what app publishers must do.
Read the articleGDPR for online shops in Romania — an e-commerce checklist
Data categories and lawful bases, processors versus independent controllers, email marketing under Article 12 of Law 506/2004, cookies and retargeting, data subject requests, and a 10-point checklist.
Read the articleShadow AI — the AI tools staff use without approval, and what the AI Act changes
Why unapproved AI use spreads, the GDPR and AI Act risks, how to detect it without breaching the Romanian rules on monitoring employees, and how to govern it with policy, training and approved tools.
Read the articleThe EU guidelines on high-risk AI systems: what companies need to know
The Commission draft guidelines of 19 May 2026 on high-risk classification, the eight Annex III areas, the Article 6(3) exceptions and the profiling rule, and six steps to take before December 2027.
Read the articleGV.OC — the foundation of NIS2 compliance and cybersecurity
Organizational Context in NIST CSF 2.0: the five outcomes, how they support management accountability under GEO 155/2024, common mistakes, and how to carry it out step by step.
Read the articleAI regulatory sandboxes: what they are and how they work for your company
Articles 57 to 62 of the AI Act: the process, who can take part, what participation does and does not change, personal data under Article 59, real-world testing, and the 2 August 2027 deadline.
Read the articleAre crypto wallet addresses personal data? What it means for companies that process them
Pseudonymous is not anonymous. The reasonable means test, self-custody addresses, the right to erasure versus an immutable ledger, special categories by inference, and the EDPB blockchain guidelines.
Read the articleVPN and proxy for ordinary users: what actually protects you
A VPN hides the IP address and encrypts traffic but does not stop cookies, fingerprinting or account tracking. Why an IP address is personal data (Breyer), the VPN provider as controller, and where the GDPR and the AI Act come in.
Read the article