Data protection in Romania: the laws, the authority and the rules

Data protection in Romania is governed by the GDPR (Regulation (EU) 2016/679), which applies directly, and by national laws that complete it: Law no. 190/2018, which implements the GDPR; Law no. 506/2004, which covers cookies and electronic marketing; and Law no. 102/2005, which establishes the supervisory authority, ANSPDCP. The authority is active — more than 260 fines since 2018 — and it works in Romanian.

At a glance

The legal framework

The supervisory authority: ANSPDCP

ANSPDCP — Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal, the National Supervisory Authority for Personal Data Processing — is the Romanian data protection authority (dataprotection.ro). It receives complaints, investigates on complaint and on its own initiative, and applies the corrective powers of Article 58 GDPR. Sanctions are imposed by a report finding the breach and applying the sanction, which can be challenged in court.

The authority acts mostly on individual complaints and corresponds in Romanian, with short deadlines to reply. That, rather than the size of the fines, is what usually catches foreign-owned companies off guard.

For a group whose main establishment is in another Member State, cross-border processing is led by that country's authority under the one-stop shop. ANSPDCP remains competent for complaints and matters that concern only the Romanian entity (Article 56(2) GDPR), and fully competent for the cookie and electronic marketing rules of Law no. 506/2004, which sit outside the one-stop shop.

The Romanian rules in Law no. 190/2018

This is the layer that differs from other EU countries, and the one most often missing from group-wide policies:

• Genetic, biometric and health data used for profiling — Article 3

  Processing these data for automated decision-making or profiling is allowed only with the explicit consent of the person or on the basis of an express legal provision, with appropriate safeguards. Health data processed for public health purposes may not be further processed by third parties for other purposes.

• National identification numbers — Article 4

  A national identification number covers the personal numeric code (CNP), the series and number of an identity card, and passport, driving licence and health insurance numbers. Processing one on the basis of legitimate interest requires safeguards: security and data minimisation measures, the appointment of a DPO, defined retention and erasure periods, and periodic staff training.

• Employee monitoring — Article 5

  Monitoring through electronic communications or video surveillance at work, on legitimate interest, is allowed only if the interest is duly justified and prevails, employees were informed in advance, completely and explicitly, the union or employee representatives were consulted, less intrusive means did not work, and data is kept no longer than 30 days unless the law provides otherwise or in duly justified cases.

• Journalism, academic, artistic and literary expression — Article 7

  Derogations from most chapters of the GDPR apply where the data were made manifestly public by the person or are closely linked to their public role or to the public nature of the facts.

• Research, statistics and archiving — Article 8

  Certain data subject rights do not apply where they would make the purpose impossible or seriously impair it, subject to the safeguards of Article 89 GDPR.

• Political parties, minority organisations and NGOs — Article 9

  They may process personal and special category data for their objectives without express consent, provided they inform people, ensure transparency and guarantee rectification and erasure.

• Sanctions — Articles 12 to 14

  Breaches of Articles 3 to 9 of the law are sanctioned at the higher GDPR tier (Article 83(5)). Public authorities and bodies first receive a warning with a remediation plan of up to 90 days; only if the plan is not carried out can fines of 10,000 to 100,000 lei, or 10,000 to 200,000 lei for the most serious breaches, be imposed.

Cookies and electronic marketing: Law no. 506/2004

Article 4(5)makes storing or reading information on a user's device conditional on prior consent after clear and complete information, except where strictly necessary for a service the user requested. In 2025 ANSPDCP fined the owner of a website 30,000 lei under this article for cookies set without consent; the court upheld the fine in February 2026.

Article 12requires prior express consent for commercial email, with one exception: a company that obtained a customer's email address in the context of a sale may market its own similar products, provided the customer was offered a simple, free way to object when the address was collected and in every message. Details in cookie banners and GDPR in Romania and GDPR for online shops.

What a company in Romania needs in place

1. 1

   A documented lawful basis for each processing activity

2. 2

   Privacy notices for customers, employees and website visitors

3. 3

   A record of processing activities — in practice, every employer

4. 4

   Data processing agreements with processors

5. 5

   A DPO where Article 37 GDPR or Article 4 of Law 190/2018 requires one

6. 6

   A DPIA for operations on the ANSPDCP list

7. 7

   A breach procedure that meets the 72-hour deadline

8. 8

   A process for answering requests within one month

9. 9

   Cookie consent that actually blocks trackers before consent

10. 10

    Monitoring of staff only within Article 5 of Law 190/2018

Enforcement in practice

ANSPDCP fines often and at medium amounts. The largest Romanian fines include Raiffeisen Bank (150,000 EUR in 2019, reduced to 15,000 EUR in court), UniCredit Bank (130,000 EUR, 2019), Rompetrol Downstream (110,000 EUR, 2023) and UiPath (70,000 EUR, 2023). The recurring causes are inadequate security (Article 32), late or missing breach notification (Article 33) and unanswered data subject requests (Articles 12 and 17). The cases are analysed in GDPR fines in Romania — real ANSPDCP cases.

Data protection beside the AI Act and NIS2

Two other regimes increasingly meet data protection. For the AI Act, ANCOM was designated in March 2026 as market surveillance authority, with ANSPDCP for biometric systems; the national law giving them enforcement powers had not been adopted according to the most recent public information. For NIS2, the authority is DNSC, under GEO 155/2024 as approved by Law 124/2025. A significant cyber incident that also affects personal data is reported to both: DNSC on the NIS2 timeline and ANSPDCP within 72 hours.

For foreign-owned companies

• A group GDPR framework covers the European layer; the Romanian rules above usually have to be added locally.

• A group DPO can cover the Romanian entity only if easily accessible, which the EDPB-endorsed guidelines read as including the language of the authority and of data subjects — here, Romanian.

• Correspondence with ANSPDCP, notices to employees and the cookie banner for Romanian users are in Romanian; internal documentation for management can be in English.

Frequently asked questions