The Romanian supervisory authority, ANSPDCP, has imposed more than 260 fines since the GDPR took effect in 2018, worth over 1.9 million euros in total. Below are the most significant Romanian cases, the mistakes behind them, and what a company operating in Romania can do so as not to be the next one.
How active is ANSPDCP?
Romania ranks among the four EU countries with the most fines per year, after Spain and Italy. In 2024 ANSPDCP imposed 83 sanctions worth about 373,000 EUR. In 2025 the number rose to 105 fines, totalling over 511,000 EUR.
The pattern differs from that of the Irish or Luxembourg authorities, which impose rare but very large fines. ANSPDCP fines often, and at a medium size. The typical fine in Romania is around 5,000 to 15,000 EUR — enough to hurt any company, small or large. For a foreign-owned company, the more important point is the frequency: the authority acts on individual complaints, and it corresponds in Romanian, with short deadlines to reply.
260+
Fines since 2018
1.9M
EUR in total
Top 4
in the EU by frequency
Real cases — what happened, and the lesson
UniCredit Bank SA
2019 — Art. 25(1) GDPR — data protection by design
What happened: In online payments, the payer’s personal data — including the personal numeric code (CNP) and address — was visible to the payee. More than 350,000 people were affected.
The lesson: IT systems have to be designed with data protection built in from the start, not added afterwards.
Rompetrol Downstream SRL
2023 — Art. 32 GDPR — inadequate security measures
What happened: Customer data — copies of identity cards and salary certificates — was accessed internally without authorisation and used to obtain fraudulent loans from non-bank lenders in the customers’ names.
The lesson: Staff access to customer data has to be tightly controlled and monitored. Excessive access rights are a direct GDPR risk.
Raiffeisen Bank SA
2019 — Art. 32 GDPR — insufficient security of processing
What happened: Two bank employees received the identity details of prospective customers from a brokerage firm over WhatsApp and ran 1,194 credit simulations on 1,177 people without their consent.
The lesson: Sending personal data through messaging apps or personal email is a GDPR breach. A clear policy on authorised channels is needed.
UiPath SRL
2023 — Art. 25 and 32 GDPR — insufficient technical measures
What happened: A file holding the personal data of about 600,000 users of the UiPath Academy platform — name, email, company, certifications — was publicly exposed for about ten days because of a misconfiguration.
The lesson: A single configuration error can expose hundreds of thousands of people. Periodic security audits and configuration testing are essential.
Orange Romania SA
2025 — Art. 12 and 17 GDPR — failure to honour the right to erasure
What happened: A prospective customer who never completed a subscription asked for their data to be deleted. Orange did not reply within the legal deadline and kept copies of the identity card for longer than allowed.
The lesson: Requests from data subjects have to be answered within one month. Ignoring them is one of the most frequent causes of fines.
EON Energie Romania SA
2025 — Art. 32 GDPR — inadequate security measures
What happened: A cyberattack allowed unauthorised access to, and exfiltration of, user accounts, including email addresses and passwords.
The lesson: The victim of an attack can still be fined if its security measures were insufficient beforehand. Being attacked does not remove liability.
What causes fines most often?
Across the Romanian cases, three kinds of breach recur:
- Inadequate security measures (Article 32 GDPR)
The most common ground. It covers data sent through unprotected channels such as WhatsApp or personal email, misconfigured systems, weak passwords and unrestricted access to customer data.
- Failure to notify a breach within 72 hours (Article 33 GDPR)
When a security breach occurs, the organisation must notify ANSPDCP within 72 hours. A late or missing notification is fined separately.
- Failure to respect data subject rights (Articles 12 and 17 GDPR)
Not answering requests for erasure, access or rectification within one month. The Orange case (40,000 EUR) is the most recent example.
Which sectors are fined most?
ANSPDCP does not target only large corporations. Fines have reached every sector:
Banks and financial institutions
UniCredit, Raiffeisen, Hora Credit, BCR
Energy and utilities
Rompetrol, EON
Telecommunications
Orange, Telekom, Vodafone
Retail and e-commerce
Altex, Sephora, IKEA, Kaufland
Technology and software
UiPath — the largest fine in the sector
Individuals
Calin Georgescu — cookies set without consent
And AI Act fines?
The Regulation applies in stages. The prohibited practices have applied since 2 February 2025; most of the remaining rules, including the transparency obligations, since 2 August 2026; the obligations for high-risk systems under Annex III from 2 December 2027, as amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI. The maximum fines reach 35 million EUR or 7% of worldwide turnover — well above GDPR levels.
Enforcement in Romania, however, depends on national law. By a government memorandum of 12 March 2026, ANCOM was designated as the market surveillance authority and single point of contact, with ANSPDCP for biometric systems and the financial supervisors, ASF and the National Bank of Romania, for high-risk systems in financial services. A memorandum does not confer powers of inspection and sanction, though. ANCOM stated in July 2026 that those can only follow the entry into force of the national law, which, according to the most recent public information, had not yet been adopted.
The practical reading is not that there is time to spare. The obligations already apply; only the national enforcement mechanism is pending. Once it arrives, a company that has not organised itself will be answerable to two authorities at once: ANSPDCP for the GDPR and ANCOM for the AI Act.
How to avoid a fine
- 1Check the channels personal data travels through
WhatsApp, personal email and unprotected spreadsheets are frequent sources of incidents. Customer and employee data should move only through authorised, secured systems.
- 2Put a breach notification procedure in place
Staff need to know what to do when they spot an incident. The deadline to notify ANSPDCP is 72 hours; without a written procedure it is easy to miss.
- 3Answer data subject requests within one month
Erasure, access, rectification — every request from a customer or employee has to be handled within the deadline. Ignoring it is sanctioned.
- 4Restrict access to personal data
Not every employee needs access to all data. Limiting access to what each role needs sharply reduces the risk of an internal incident.
If a letter from the authority has already arrived, or you want to know how an inspection unfolds before it does, see ANSPDCP inspection readiness.
Frequently asked questions
How many GDPR fines has ANSPDCP imposed?
More than 260 since 2018, totalling over 1.9 million EUR. Romania ranks among the four EU countries with the most fines per year. In 2024 there were 83 sanctions (about 373,000 EUR); in 2025 the number rose to 105 fines (over 511,000 EUR).
What is the largest GDPR fine in Romania?
The largest is 150,000 EUR, imposed on Raiffeisen Bank in 2019; the Bucharest Tribunal later reduced it to 15,000 EUR and the decision became final on appeal. Next are UniCredit Bank with 130,000 EUR (2019) and Rompetrol Downstream with 110,000 EUR (2023). In technology, the largest is UiPath with 70,000 EUR (2023).
What causes GDPR fines most often?
Three kinds of breach recur in Romanian cases: inadequate security measures (Article 32) — unprotected communication channels, misconfigured systems, unrestricted access; failure to notify a breach within 72 hours (Article 33); and failure to respect data subject rights (Articles 12 and 17), typically not answering erasure or access requests.
Can a small company be fined by ANSPDCP?
Yes. The authority does not target only large corporations. Fines have been imposed on companies of every size, including micro-enterprises, and even on individuals. The typical fine for a small or medium company in Romania is between 5,000 and 15,000 EUR.
Can AI Act fines already be imposed in Romania?
Not yet in practice. ANCOM was designated as the market surveillance authority by a government memorandum of 12 March 2026, but a memorandum does not confer powers of inspection and sanction. ANCOM stated in July 2026 that these can only follow the entry into force of the national law, which had not been adopted according to the most recent public information. The maximum fines under the Regulation reach 35 million EUR or 7% of worldwide turnover.