GDPR compliance
under Romanian law
What we do
GDPR audit
We map how personal data moves through the company, identify the gaps and deliver a report with remediation steps in order of exposure.
- Mapping of data flows
- Identification of lawful bases
- Risk assessment
- Audit report and action plan
Outsourced DPO
We take on the data protection officer function: monitoring, advice to management, the interface with ANSPDCP and staff training. Includes a monthly visit to your premises.
- Ongoing compliance monitoring
- Monthly on-site visit and review
- Advice to management
- Correspondence with ANSPDCP
- Periodic staff training
Implementation
We draft the full compliance documentation: policies, procedures, records of processing, breach notification procedures and processor agreements.
- Data protection policies
- Records of processing (Art. 30)
- Breach procedures
- Processor agreements with suppliers
Compliance audit report
At the end of implementation we produce a report documenting the measures adopted. It supports the accountability principle under Article 5(2) and can be shown to the authority or to partners who ask for evidence.
- Documentation of the measures in place
- Inventory of processing operations
- Evidence for partners
- Annual update included
Preparing for Europrivacy
Europrivacy is the GDPR certification scheme formally recognised at European level, accredited under Articles 42 and 43 of the Regulation and approved by the European Data Protection Board. The certificate is valid in every member state.
We handle the process: we assess compliance against the Europrivacy criteria, draft the technical and organisational documentation, remediate what is missing and submit the file to the accredited certification body. That body certifies, not us.
Services for specific situations
Four situations that come up most often. Each has its own page, setting out what we review and what you are left with.
Website and cookies
We check what actually runs on your site and bring the banner into the form the law requires. You keep the documentation showing what you chose to use and on what basis.
- Compliant banner
- Inventory of scripts actually running
- Cookie policy
- Record of consents
Employee data
Processing that concerns your own staff is the most frequently complained about. We review what you collect about them and produce the notices and lawful bases required.
- Video surveillance
- Biometric clocking
- Monitoring of work communications
- Vehicle tracking
Internal reporting channel
For whistleblower reports: we build the channel and the procedure behind it, so that reports are received and handled in an orderly way.
- Internal procedure
- The reporting channel
- Notice to staff
- Register of reports
Inspection readiness
We review your compliance file before anyone else does, and rehearse how an inspection unfolds. If a request has already arrived, we help you draft the reply.
- Review of the compliance file
- Rehearsal of an inspection
- Preparation of the people who will speak
- Help drafting replies to ANSPDCP
Frequently asked
We already comply with the GDPR at group level. What is different in Romania?
The European layer is the same everywhere. The national layer is not. In Romania the personal numeric code has its own regime under Law no. 190/2018, which permits processing on legitimate interest only with specific safeguards, including the appointment of a data protection officer. Workplace monitoring has additional conditions. Access to information stored on a user device falls under Law no. 506/2004. None of this is usually covered by a group policy.
When is a data protection officer mandatory?
Under Article 37 of the GDPR, where processing is carried out by a public authority, where core activities require regular and systematic monitoring on a large scale, or where they consist of large-scale processing of special categories of data. In Romania there is an additional route: Article 4 of Law no. 190/2018 requires a designated officer as one of the safeguards for processing the personal numeric code on legitimate interest.
What does it cost?
A compliance project starts from 700 EUR, depending on the number of processing activities, headcount and systems in use. An outsourced DPO starts from 350 EUR per month. Both figures are starting points, not fixed prices; the quote follows the initial audit.
Do you issue a certificate at the end?
No. We are not a certification body. At the end of an implementation we produce a compliance audit report documenting the technical and organisational measures adopted. It supports the accountability principle under Article 5(2) and can be shown to the authority, to partners or to clients who ask for evidence.
Where does your company stand?
The initial audit is free. You receive a written picture of what you process, on what basis, and what is missing.
Request a free audit