Outsourced DPO in Romania — when it is mandatory, and what it costs

An outsourced data protection officer is the usual arrangement for companies in Romania that must appoint a DPO but do not have the volume or budget for a full-time specialist. This article covers when the appointment is mandatory, including a Romanian rule that group policies often miss, the difference between an internal and an outsourced DPO, indicative market costs, and the criteria for choosing a provider.

When is a DPO mandatory?

Article 37 GDPR names three cases in which a data protection officer must be appointed:

• Public authorities and bodies

  Every public authority — ministries, agencies, local councils, public schools and hospitals — must appoint a DPO, whatever its size or the volume of processing. Courts acting in their judicial capacity are the exception.

• Regular and systematic monitoring on a large scale

  Organisations whose core activities consist of monitoring individuals regularly and systematically on a large scale: telecommunications networks, fraud monitoring services, extensive CCTV systems, behavioural tracking platforms, loyalty programmes with profiling.

• Special categories of data on a large scale

  Organisations whose core activities consist of large-scale processing of health, biometric or genetic data, data revealing political opinions or religious beliefs, or data on criminal convictions. Large private hospitals, clinics with hundreds of patients a day, medical laboratories, high-volume recruitment firms.

The Romanian rule: the personal numeric code

Romania adds a case of its own, and it is the one foreign groups most often miss. Article 4 of Law no. 190/2018 allows a national identification number — the personal numeric code (CNP), the series and number of an identity card, a passport number — to be processed on the basis of legitimate interest (Article 6(1)(f) GDPR) only with specific safeguards. One of them is the appointment of a data protection officer. The others are security and data minimisation measures, defined retention periods and periodic training of the staff who handle the data.

In practice this catches ordinary situations: keeping copies of customers' identity cards, recording the CNP of visitors at reception, asking for an identity document at delivery or on a rental. Where the CNP is processed because a law requires it — payroll, tax, accounting — the legal basis is Article 6(1)(c) and this safeguard does not apply in the same way. The question to ask is therefore not only “does Article 37 apply to us?” but also “on which basis do we collect identity numbers?”.

Once a DPO is appointed, voluntarily or not, Article 37(7) GDPR requires the contact details to be published and communicated to ANSPDCP. A DPO appointed voluntarily is subject to the same rules on position and tasks as a mandatory one.

If the group already has a DPO

Article 37(2) GDPR allows a group of undertakings to appoint a single DPO, provided that the DPO is easily accessible from each establishment. The Article 29 Working Party guidelines on DPOs, endorsed by the EDPB, read accessibility to include communicating with data subjects and cooperating with the supervisory authority in the language they use.

For a Romanian subsidiary, that language is Romanian. ANSPDCP corresponds in Romanian, and employees, customers and candidates write in Romanian. A common arrangement is to keep the group DPO and add local support in Romania that handles the correspondence, the requests and the Romanian legal layer, and reports to the group DPO in English.

Internal or outsourced DPO

The GDPR allows both: the DPO may be a member of staff or work under a service contract (Article 37(6)). The choice depends on size, complexity and budget.

What an outsourced DPO costs in Romania

Indicative ranges on the Romanian market, by complexity:

By comparison, an internal DPO costs at least 4,000 to 6,000 EUR a month in total: gross salary, employer contributions, benefits, courses and certifications.

What the contract covers

A complete DPO contract covers the following recurring activities:

• Monitoring the GDPR compliance of processing operations
• Keeping the record of processing activities up to date (Article 30)
• Advice on data protection impact assessments (DPIA) for new projects
• Handling data subject requests (access, erasure, rectification)
• Staff training — periodic sessions and written material
• Support in handling personal data breaches and the 72-hour notification to ANSPDCP
• Acting as the contact point for the supervisory authority
• A written report on the state of compliance
• Attending management meetings when the subject requires it

Optional but worth having: a regular visit to the company's premises. Many providers work only online; for organisations with intensive processing on site — medical, retail, manufacturing — physical presence shows problems that do not appear in reports.

How to choose a provider

Five criteria, in order of importance:

1. 1
   Recognised professional certification

   CIPP/E (Certified Information Privacy Professional / Europe), awarded by the IAPP, is the European reference. CIPM and CIPT complement it. Be wary of in-house diplomas and obscure certificates.

2. 2
   Documented experience in your sector

   Data protection in a medical clinic differs a great deal from data protection in an online shop. Ask for examples of work and references from your sector.

3. 3
   Escalation written into the contract

   A personal data breach must be notified within 72 hours of becoming aware of it. The contract should state how incidents, letters from ANSPDCP and data subject requests reach the DPO, and who does what once they do.

4. 4
   On-site visits

   For organisations with complex operations, visits bring out issues that reports do not and build a working relationship with the teams.

5. 5
   Verifiable references

   Ask for current clients you can contact. A serious provider will not refuse.

Be wary of offers of full compliance at a very low price. The DPO function carries responsibility, and a fixed fee too small to cover the work usually means the work is not done. For the fines that ANSPDCP has actually imposed in Romania, see GDPR fines in Romania — real cases.

Frequently asked questions