GDPR Compliance for Businesses Operating in Romania 2026: Practical Guide

GDPR Compliance for Businesses in Romania 2026: Practical Guide

The General Data Protection Regulation (EU) 2016/679 (GDPR) applies to all businesses processing personal data in Romania, regardless of their size, legal form, or country of origin. This robust framework, combined with specific national implementing provisions, primarily Legea nr. 190/2018 privind măsuri de punere în aplicare a Regulamentului (UE) 2016/679 al Parlamentului European și al Consiliului din 27 aprilie 2016 privind protecția persoanelor fizice în ceea ce privește prelucrarea datelor cu caracter personal și privind libera circulație a acestor date și de abrogare a Directivei 95/46/CE (Regulamentul general privind protecția datelor), mandates comprehensive data protection compliance for any entity operating within Romania or targeting Romanian data subjects. Businesses must navigate both EU and national legal requirements to ensure their data processing activities are lawful, fair, and transparent.

Who Must Comply? A Detailed Scope

GDPR and Romanian data protection laws have a broad extraterritorial scope. Your business must comply if you:

• Collect customer data: This includes any identifying information such as names, email addresses, phone numbers, transactional data, IP addresses, location data, or online identifiers (e.g., cookies). This applies to e-commerce, service providers, retail, and any interaction involving individuals.
• Process employee data: This encompasses a vast array of information including ID numbers (CNP), salary details, bank accounts, residential addresses, health information, performance reviews, and any records stored in ReGES (Registrul General de Evidență a Salariaților), as mandated by Hotărârea Guvernului nr. 295/2025 privind registrul general de evidență a salariaților, as subsequently amended and supplemented.
• Operate a website or mobile application targeting Romanian users: This includes websites that have Romanian-language versions, offer goods/services in RON, mention Romania, use specific country-code top-level domains (.ro), or simply use tracking technologies (cookies, pixels) that collect data from users located in Romania.
• Use video surveillance systems: Any system capturing images of identifiable individuals in public or private spaces (offices, retail stores, warehouses) falls under GDPR. Strict rules apply regarding notice, purpose limitation, and storage periods, as detailed generally under Legea nr. 190/2018, art. 5-6.
• Send marketing communications or newsletters: Direct marketing, whether via email, SMS, or other electronic means, requires explicit consent from recipients, unless specific "soft opt-in" conditions are met for existing customers, as per Legea nr. 506/2004 privind prelucrarea datelor cu caracter personal și protecția vieții private în sectorul comunicațiilor electronice, art. 12.
• Process sensitive data: This includes special categories of personal data (e.g., health data, genetic data, biometric data, religious beliefs, political opinions, sexual orientation) or data relating to criminal convictions and offenses. Handling such data triggers enhanced compliance obligations.
• Monitor public behavior: This extends to advanced analytics, AI-driven monitoring, or location tracking of individuals.

Core Obligations for Businesses: Beyond the Basics

1. Record of Processing Activities (ROPA): The Data Inventory

The Record of Processing Activities (ROPA) is a fundamental accountability tool required by GDPR, art. 30. It's mandatory for organizations with 250 or more employees, unless the processing is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data (sensitive data) or data relating to criminal convictions and offenses. Given that nearly any business will process employee data (non-occasional) or customer data, most SMEs are obligated to maintain a ROPA, even with fewer than 250 employees.

2. Legal Basis for Processing: The Foundation of Lawfulness

Every single data processing activity must be grounded in a valid legal basis, as stipulated in GDPR, art. 6 (and art. 9 for special categories of data). Without a legal basis, the processing is unlawful.

• Consent: GDPR, art. 6 alin. (1) lit. a). Must be freely given, specific, informed, and unambiguous. Silence, pre-ticked boxes, or inactivity do not constitute consent. For sensitive data, explicit consent is often required (GDPR, art. 9 alin. (2) lit. a)). This is highly relevant for marketing and non-essential cookies.
• Contract: GDPR, art. 6 alin. (1) lit. b). Necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract (e.g., processing customer data for order fulfillment, employee data for salary payment).
• Legal obligation: GDPR, art. 6 alin. (1) lit. c). Required by Romanian or EU law (e.g., reporting employee data to tax authorities, retaining financial records as per Legea Contabilității nr. 82/1991).
• Legitimate interest: GDPR, art. 6 alin. (1) lit. f). The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Requires a balancing test and transparent communication (e.g., fraud prevention, network security, direct marketing to existing customers under specific conditions). This basis is frequently scrutinized by the ANSPDCP.
• Vital interests: GDPR, art. 6 alin. (1) lit. d). To protect the vital interests of the data subject or of another natural person (e.g., emergency medical situations). Rare for most businesses.
• Public interest: GDPR, art. 6 alin. (1) lit. e). For public authorities carrying out tasks in the public interest or in the exercise of official authority. Not typically relevant for private businesses, unless acting on behalf of public bodies.

3. Data Protection Officer (DPO): The Internal Guardian

The appointment of a DPO is a critical requirement under GDPR, art. 37. The DPO acts as an independent expert, advising on and monitoring compliance.

• Mandatory for:
• Public authorities and bodies (except for courts acting in their judicial capacity).
• Organizations whose core activities consist of processing operations which, by virtue of their nature, scope, and/or purposes, require regular and systematic monitoring of data subjects on a large scale. This typically applies to telecommunications providers, banks, insurance companies, and marketing agencies engaging in extensive profiling.
• Organizations whose core activities consist of large-scale processing of special categories of data (GDPR, art. 9) or data relating to criminal convictions and offenses (GDPR, art. 10). This applies to healthcare providers, security companies, and certain research institutions.
• Recommended: Even if not legally mandatory, designating a DPO or an internal data protection contact person is a best practice. It demonstrates accountability and provides a clear point of contact for the data subjects and the supervisory authority (ANSPDCP). The DPO can be an internal employee or an external consultant.

4. Data Protection Impact Assessment (DPIA): Proactive Risk Management

A DPIA is a mandatory risk assessment tool required by GDPR, art. 35 when processing is "likely to result in a high risk to the rights and freedoms of natural persons."

• Required for:
• Automated processing, including profiling, that produces legal effects concerning the data subject or similarly significantly affects him or her (e.g., credit scoring, tailored advertising with significant implications).
• Large-scale processing of special categories of data (GDPR, art. 9) or data relating to criminal convictions and offenses (GDPR, art. 10). The ANSPDCP has issued a list of processing operations requiring a DPIA in Romania.
• Systematic monitoring of a publicly accessible area on a large scale (e.g., CCTV in shopping malls, large public venues).
• Innovative use or application of new technologies.
• Data transfers outside the EEA with insufficient safeguards.
• Process: A DPIA involves describing the processing, assessing necessity and proportionality, identifying and assessing risks to data subjects, and outlining measures to address those risks. If a DPIA identifies high residual risk, prior consultation with the ANSPDCP is mandatory (GDPR, art. 36).

Implementation Roadmap: A Structured Approach

Achieving and maintaining GDPR compliance is an ongoing journey, not a one-time project.

Phase 1: Data Audit (2-4 weeks, depending on company size and complexity)

• Map all personal data flows: From collection to storage, processing, transfer, and deletion. Use questionnaires, interviews, and system reviews.
• Identify data sources, storage locations, and access points: Where is the data collected from? Where is it stored (servers, cloud, physical archives)? Who has access to it?
• Document all third-party data sharing: Identify all processors (e.g., cloud providers, marketing agencies, payroll services) and controllers with whom data is shared.
• Record processing activities: Begin populating your ROPA.

Phase 2: Gap Analysis & Risk Assessment (1-2 weeks)

• Compare current practices against GDPR requirements: Identify discrepancies in legal bases, data subject rights mechanisms, security measures, and documentation.
• Prioritize compliance gaps by risk level: Assess the likelihood and severity of harm to data subjects if a breach or non-compliance occurs. Focus on high-risk areas first.
• Conduct DPIAs for high-risk processing activities identified in Phase 1.

Phase 3: Documentation & Policy Development (2-4 weeks)

• Privacy policy: A comprehensive, transparent, and easily accessible document explaining data processing practices to data subjects (GDPR, art. 13-14).
• Cookie policy: Detailed information about the cookies and similar technologies used, their purposes, and user control options, in line with Legea nr. 506/2004 and ANSPDCP guidelines.
• Employee data processing notices: Informing employees about how their personal data is processed, in compliance with GDPR, art. 13.
• Data Processing Agreements (DPAs) with vendors/processors: Mandatory contracts explicitly defining roles, responsibilities, security measures, and data protection clauses for all third-party processors (GDPR, art. 28). Use the standard contractual clauses where applicable.
• Consent forms and mechanisms: Implement clear, explicit, and auditable consent capture methods, especially for marketing and non-essential cookies.
• Internal data protection policies: Procedures for data breach response, data subject access requests, data retention, and secure data deletion.

Phase 4: Technical and Organizational Measures (2-6 weeks)

• Data encryption: Implement encryption for personal data at rest (stored data) and in transit (data exchanged over networks) as appropriate.
• Access controls: Implement role-based access controls (RBAC) to ensure only authorized personnel can access specific data sets. Regularly review access rights.
• Regular backups with recovery testing: Ensure data resilience and availability. Test recovery procedures periodically.
• Pseudonymization and anonymization: Apply these techniques where possible to reduce the risk of re-identification, especially for analytical or testing purposes (GDPR, art. 25, 32).
• Secure data deletion procedures: Implement policies and technical means for permanent and auditable deletion of data at the end of its retention period.
• Security logging and monitoring: Maintain logs of data processing activities and monitor for suspicious behavior.

Phase 5: Training, Culture, and Continuous Improvement (ongoing)

• Staff awareness training: Regular and mandatory training for all employees on data protection principles, policies, and procedures. This is crucial as human error is a significant cause of data breaches.
• Incident response drills: Periodically simulate data breaches to test the effectiveness of your incident response plan.
• Regular policy and system reviews: Data protection is dynamic. Review and update policies, procedures, and technical measures at least annually or whenever significant changes occur (e.g., new processing activities, new technologies, ANSPDCP guidance).

Fines and Enforcement in Romania: The ANSPDCP Perspective

The Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) is the supervisory authority in Romania responsible for enforcing the GDPR. The fines imposed can be substantial and serve as a significant deterrent. GDPR, art. 83 sets out the criteria for imposing administrative fines.

Notable trends in Romanian fines (ANSPDCP) reflect a clear enforcement strategy:

• Banking sector: Fines ranging from €100,000 to €150,000 for serious breaches involving extensive customer data or system security failures. For example, a bank was fined the equivalent of €130,000 for not applying specific technical and organizational measures to ensure the security of personal data in its mobile application (ANSPDCP Decision 2018/143 – Example; actual ANSPDCP decisions are not publicly numbered as such; refer to official announcements).
• Telecom companies: Between €50,000 and €100,000 for violations related to illegal direct marketing practices, an insufficient lawful basis for processing, or inadequate security leading to data breaches.
• SMEs (Small and Medium-sized Enterprises): Fines typically range from €2,000 to €15,000 for issues such as inadequate video surveillance notices, insecure website forms, failure to respond to data subject requests, or lack of proper DPAs. The ANSPDCP often applies a proportionality principle, considering the nature, gravity, and duration of the infringement, the intent, and the categories of personal data affected.

Website Compliance Checklist for 2026

Ensuring your website is GDPR-compliant is paramount, especially as it often serves as the primary interface for data collection.

• Cookie consent banner with granular options:
• Must appear prominently on first visit.
• Provide clear options to "Accept All," "Reject All," or customize preferences by cookie category (e.g., essential, analytics, marketing).
• Must not load non-essential cookies before the user has given explicit consent.
• Include a link to the detailed cookie policy.
• Remember that Romania, via Legea nr. 506/2004, art. 4 alin. (5), requires informed consent for cookie placement, mirroring the e-Privacy Directive.
• Accessible privacy policy:
• Clearly linked from the website footer, cookie banner, and any forms collecting personal data.
• State all required information as per GDPR, art. 13-14.
• Consent checkboxes on all forms:
• For newsletter subscriptions, contact forms, account registration forms, etc.
• Checkboxes must be unticked by default.
• Explain clearly what the user is consenting to.
• SSL/TLS certificate for data in transit:
• Mandatory for any website handling personal data (e.g., through login, payment, or contact forms) to encrypt communication between the user's browser and the server. HTTPS should be standard.
• Detailed cookie policy:
• Explain what cookies are, which ones are used, their purpose, duration, and whether they are first-party or third-party.
• Provide instructions on how users can manage or delete cookies.
• Data subject rights request mechanism:
• A clear and easily accessible way for data subjects to exercise their rights (e.g., a dedicated email address, an online form).
• Third-party tracking disclosed:
• Clearly inform users about any third-party services used that collect data (e.g., Google Analytics, Facebook Pixel, live chat services).
• Ensure appropriate DPAs are in place with these service providers.
• Disclaimer for social media plugins:
• Inform users about data sharing when using social media "share" or "like" buttons.

International Data Transfers: Navigating Global Data Flows

Transferring personal data outside the European Economic Area (EEA) is subject to strict rules under GDPR, Chapter V (art. 44-50), to ensure that the protection afforded by GDPR travels with the data. This is particularly relevant given the widespread use of global cloud services.

• If you use cloud services (Google Cloud, Microsoft Azure, Amazon Web Services, etc.):
• Verify that updated Standard Contractual Clauses (SCCs) are in place: The European Commission updated SCCs in 2021. Ensure your contracts with cloud providers incorporate the latest version, often referred to as "New SCCs" or "Modern SCCs." These are a primary transfer mechanism under GDPR, art. 46 alin. (2) lit. c).
• Conduct a Transfer Impact Assessment (TIA): As mandated by the Schrems II ruling, a TIA (also known as a Transfer Risk Assessment or TRA) must be performed for each export of personal data to a third country not covered by an adequacy decision. This assesses whether the laws and practices of the third country offer a level of protection essentially equivalent to that guaranteed within the EU. This is required even when using SCCs.
• Implement supplementary measures: Based on the TIA, if the third country's laws (e.g., government surveillance laws like FISA Section 702 in the US) could undermine the effectiveness of SCCs, you must implement additional technical, organizational, or contractual measures (e.g., robust end-to-end encryption with keys held in the EEA, anonymization prior to export).
• Monitor the evolving status of the EU-US Data Privacy Framework: The EU-US Data Privacy Framework, adopted in July 2023, provides an adequacy decision for transfers to certified US organizations. Keep abreast of its durability and acceptance by EU data protection authorities, including ANSPDCP. Organizations previously certified under Privacy Shield must transition to this new framework, if applicable. This is based on GDPR, art. 45.

Data Subject Rights Response: Empowering Individuals

Data subjects have several key rights, and businesses must have robust procedures to respond to requests within specific deadlines, as per GDPR, art. 12.

Comprehensive GDPR Compliance Checklist for Businesses in Romania

This checklist provides a structured overview of key areas to review for GDPR compliance.

Data Mapping & ROPA

• Do we have a comprehensive Record of Processing Activities (ROPA)? (GDPR, art. 30)
• Does the ROPA identify all personal data categories, processing purposes, and legal bases?
• Is the ROPA regularly updated (at least annually or when processes change)?
• Have we identified all systems, databases, and physical locations where personal data is stored?

Legal Basis & Transparency

• Is a valid legal basis identified and documented for every data processing activity? (GDPR, art. 6, 9)
• Are our privacy notices (for the website, employees, and specific applications) clear, accessible, and comprehensive as per GDPR, art. 13-14?
• Where consent is relied upon, is it freely given, specific, informed, and unambiguous? Is it easy to withdraw?
• Are consent records maintained and auditable?

Data Subject Rights

• Do we have documented procedures for handling data subject access requests (DSARs)? (GDPR, art. 12)
• Can we respond to all DSARs (access, rectification, erasure, portability, objection, restriction, automated decision-making) within the legal deadlines?
• Is there a clear contact point for data subjects to exercise their rights?

Security Measures

• Have we implemented appropriate technical and organizational measures to ensure data security? (GDPR, art. 32)
• Do we conduct regular security assessments and penetration tests?
• Is data encrypted at rest and in transit where appropriate?
• Are access controls implemented and regularly reviewed?
• Do we have a robust data backup and recovery strategy?
• Are physical security measures in place for paper records and data storage facilities?

Data Breach Management

• Do we have an incident response plan for personal data breaches? (GDPR, art. 33-34)
• Is there a clear process for detecting, assessing, and reporting breaches?
• Can we notify the ANSPDCP within 72 hours of becoming aware of a breach?
• Can we notify affected data subjects without undue delay if the breach poses a high risk to their rights and freedoms?

Data Protection Officer (DPO)

• Have we assessed whether a DPO appointment is mandatory? (GDPR, art. 37)
• If mandatory, has a DPO been appointed? Is their contact information publicly available and registered with ANSPDCP?
• Does the DPO operate independently and have adequate resources?

Third-Party Processing & International Transfers

• Are Data Processing Agreements (DPAs) in place with all third-party processors? (GDPR, art. 28)
• Do DPAs include all mandatory clauses?
• For international data transfers outside the EEA, is a valid transfer mechanism identified (e.g., SCCs, EU-US DPF)? (GDPR, Chapter V)
• Have Transfer Impact Assessments (TIAs) been conducted for relevant transfers?
• Are supplementary measures implemented where necessary?

Training & Awareness

• Do all employees who handle personal data receive mandatory data protection training?
• Is training regularly updated and conducted?
• Is there a culture of data protection awareness within the organization?

Documentation & Accountability

• Are all policies, procedures, and records related to GDPR compliance fully documented and maintained? (GDPR, art. 5 alin. (2))
• Are DPIAs conducted for high-risk processing operations? (GDPR, art. 35)
• Is there a process for regular review and update of all compliance documentation?

---