Many companies treat the GDPR as a formality. It is a legal framework that protects individuals — customers, employees, partners — and imposes concrete obligations on any organisation that processes their data. In Romania it comes with a national layer that group-level policies usually leave out.
What the GDPR is
The GDPR (Regulation (EU) 2016/679) has applied since 25 May 2018 and is directly applicable in Romania. Its aim is to give individuals control over their personal data and to make organisations process it responsibly. Personal data is any information relating to an identifiable person — from a name and an email address to an IP address, health data or information about behaviour online.
A company that keeps customer records, sends newsletters, employs staff or runs a website with a contact form is a controller, and the GDPR applies to it. The supervisory authority is ANSPDCP (Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal). It investigates complaints, carries out inspections and imposes sanctions, and it works in Romanian.
The core obligations
- A lawful basis for each processing activity
Data is not collected “just in case”. Each activity needs one of the bases in Article 6: consent, contract, legal obligation, vital interests, public task or legitimate interest — and the choice is documented.
- Information to the people concerned
A privacy notice that says what is collected, why, on which basis, for how long, who receives it, whether it leaves the EU, and which rights people have (Articles 13 and 14).
- A record of processing activities
Article 30 exempts organisations with fewer than 250 employees only for occasional processing that is unlikely to result in a risk and involves no special categories. Payroll and personnel files are neither occasional nor optional, so in practice almost every employer needs a record.
- Agreements with service providers
Every provider that processes data on the company’s behalf — payroll, accounting, IT, hosting, marketing — needs a data processing agreement under Article 28.
- A breach procedure
A personal data breach that is likely to result in a risk is notified to ANSPDCP within 72 hours of becoming aware of it (Article 33), and people are informed when the risk is high (Article 34).
- Data subject requests
Requests for access, rectification, erasure, objection and portability are answered within one month, extendable by two further months for complex cases (Article 12(3)).
The Romanian layer
The GDPR leaves room for national rules, and Romania uses it. These are the points a group policy written elsewhere most often misses:
- The personal numeric code (CNP) — Law no. 190/2018, Article 4
Processing the CNP or other national identification numbers on the basis of legitimate interest is allowed only with specific safeguards, including the appointment of a data protection officer.
- Monitoring employees — Law no. 190/2018, Article 5
Video surveillance and monitoring of electronic communications at work, on the basis of legitimate interest, require prior and complete information to employees, consultation of the union or employee representatives, proof that less intrusive means did not work, and storage in principle no longer than 30 days.
- Cookies — Law no. 506/2004, Article 4(5)
Storing or reading information on a user’s device needs prior consent, except where strictly necessary. ANSPDCP enforces it directly, outside the GDPR one-stop shop.
- DPIA — ANSPDCP Decision no. 174/2018
The national list of operations for which an impact assessment is mandatory, including large-scale automated monitoring of employees.
The consequences of non-compliance
Fines can reach 20 million EUR or 4% of worldwide annual turnover for the most serious breaches, and 10 million EUR or 2% for others.
In practice ANSPDCP fines often and at medium amounts: more than 260 fines since 2018, typically between 5,000 and 15,000 EUR for small and medium companies. The amount depends on the seriousness of the breach, how the company reacted, its cooperation with the authority and the measures it already had in place (Article 83(2)). For the cases, see GDPR fines in Romania — real cases.
An often overlooked point: AI tools
When staff enter customer or colleague data into ChatGPT, Copilot or similar tools, that data goes to an external provider. That is processing under the GDPR, with all its requirements. Since 2025 the AI Act adds its own obligations, so the same use can create exposure on two fronts. The practical side is covered in ChatGPT at work.
Where to start
With an audit: what data the company collects, how it processes it, and where the gaps are. For a Romanian subsidiary, the useful starting point is usually the group framework, checked against the national rules above. The initial audit is free.
Frequently asked questions
Who does the GDPR apply to in Romania?
Any company established in Romania that processes personal data — of customers, employees, partners or website visitors — whatever its size. Collecting names, email addresses, phone numbers, IP addresses or any other identifying information makes the company a controller.
When is a data protection officer mandatory?
Under Article 37 GDPR: for public authorities; where the core activities consist of regular and systematic monitoring of individuals on a large scale; and where they consist of large-scale processing of special categories or criminal data. In Romania, Article 4 of Law no. 190/2018 adds a case: processing the personal numeric code (CNP) on the basis of legitimate interest requires a DPO. The number of employees is not, in itself, a criterion.
What are the minimum obligations for a small company?
A documented lawful basis for each processing activity; a privacy notice; a record of processing activities, which in practice almost every employer needs; data processing agreements with service providers that handle the data; a procedure for notifying breaches to ANSPDCP within 72 hours; and answers to data subject requests within one month.
How large are GDPR fines in Romania?
The ceilings are 20 million EUR or 4% of worldwide annual turnover for the most serious breaches and 10 million EUR or 2% for others. In practice ANSPDCP has imposed more than 260 fines since 2018; the typical fine for a small or medium company is between 5,000 and 15,000 EUR.
Does a group-wide GDPR policy cover the Romanian subsidiary?
It covers the European layer. It usually does not cover the Romanian one: the rules on the personal numeric code and on monitoring employees in Law no. 190/2018, cookie consent under Law no. 506/2004, the ANSPDCP list of operations requiring a DPIA, and correspondence with the authority in Romanian.