Romania Data Protection & Privacy Regulation

Controller/Processor Duties

Article 32 security-of-processing obligations dominate ANSPDCP's controller and processor enforcement activity within this recency window. On 2 October 2026, the authority fined GLOBAL CUSTOMER CARE SERVICES S.R.L. EUR 5,000 for breaches of Article 32(1)(b) and 32(1)(d), together with Article 32(2), following a self-notified cyber-attack. The self-notification detail is significant: the operator appears to have reported the incident to ANSPDCP rather than the breach surfacing through complaint or external discovery, yet the authority nonetheless proceeded to sanction, indicating that voluntary notification does not by itself forestall enforcement where the underlying technical and organisational measures are found deficient.

This fine sits within a broader pattern anchored by ANSPDCP's largest sanction of 2026, a EUR 125,000 fine against Renault Commercial Roumanie S.R.L., decided in March 2026. That decision similarly rested on breaches of Article 32(1)(b), 32(1)(d) and 32(2), but combined these security findings with an Article 28(1) processor-oversight breach, after a cyberattack on an application administered by a processor on the controller's behalf led to unauthorised publication of personal data. The Renault decision is directly sourced from ANSPDCP's own press release, giving it a higher evidentiary standing than the press-reported October decisions, and its combination of a security failure with a processor-supervision failure under Article 28 illustrates how ANSPDCP treats inadequate oversight of a processor as compounding, rather than separate from, the underlying security deficiency.

The consistency of the legal bases cited across these two decisions, Article 32(1)(b), 32(1)(d) and 32(2) in both cases, suggests ANSPDCP has settled on a recurring analytical framework for assessing security-of-processing failures following a cyberattack: inadequate measures to ensure ongoing confidentiality and resilience of processing systems, and inadequate processes for regularly testing and evaluating the effectiveness of technical and organisational measures. Controllers and processors operating in Romania should note that the amounts involved vary substantially, from EUR 5,000 to EUR 125,000, suggesting that the scale of the breach, the sensitivity of the data involved, and the presence or absence of compounding factors such as inadequate processor oversight materially affect the sanction ultimately imposed, even where the underlying legal bases cited are similar.

Outlook

Given the cadence of Article 32-based enforcement observed across this window, including the 2 October 2026 decision and the earlier Renault decision, continued ANSPDCP attention to security-of-processing compliance, particularly following cyberattacks and data breaches, should be expected to persist. Controllers relying on processors for application administration or data handling should take note of the Renault precedent's combination of Article 32 and Article 28(1) findings, which indicates that inadequate processor oversight is being treated as an aggravating rather than separate factor in ANSPDCP's assessment of such incidents.

Sectoral Watch

Romania's domestic implementation framework for the EU Data Act, Regulation (EU) 2023/2854, progressed through a public consultation stage without reaching adoption. The Autoritatea Nationala pentru Administrare si Reglementare in Comunicatii launched the consultation on 2 July 2026, and it closed on 3 August 2026. The draft law under consultation addresses the designation of competent national authorities for Data Act purposes and establishes an enforcement and sanctions framework for the directly-applicable EU regulation. As a directly applicable EU Regulation, the Data Act's substantive provisions already bind relevant parties in Romania regardless of domestic implementing legislation; what the draft law under consultation would add is the domestic institutional machinery, designated authorities, enforcement powers and sanctions, needed to operationalise compliance and enforcement at the national level.

This consultation-stage development should be read alongside Romania's broader pattern, visible elsewhere in the coverage, of EU-level direct obligations outpacing the domestic institutional infrastructure needed to give them full practical effect. The Data Act consultation closing without adoption as of the material reaching leaves open the question of which specific body or bodies will ultimately hold enforcement authority, and what sanctions regime will apply to Data Act breaches in Romania, pending finalisation of the implementing law.

Outlook

The regulatory horizon identifies the fourth quarter of 2026 as a tentative estimate for adoption of ANCOM's Data Act implementing law, carrying a half-year uncertainty band that should be read as scheduled rather than assured given the consultation closed in early August 2026 without a stated adoption date. Whether the draft law has advanced toward adoption since the 3 August 2026 consultation close was not established within the sourcing and remains an open item. Once adopted, the law would designate the competent authorities responsible for Data Act enforcement in Romania and establish the sanctions regime applicable to breaches of the directly-applicable EU Regulation.

Sectoral Watch

Romania's domestic implementation framework for the EU Data Act, Regulation (EU) 2023/2854, progressed through a public consultation stage this cycle without reaching adoption. The Autoritatea Nationala pentru Administrare si Reglementare in Comunicatii launched the consultation on 2 July 2026, and it closed on 3 August 2026. The draft law under consultation addresses the designation of competent national authorities for Data Act purposes and establishes an enforcement and sanctions framework for the directly-applicable EU regulation. As a directly applicable EU Regulation, the Data Act's substantive provisions already bind relevant parties in Romania regardless of domestic implementing legislation; what the draft law under consultation would add is the domestic institutional machinery, designated authorities, enforcement powers and sanctions, needed to operationalise compliance and enforcement at the national level.

This consultation-stage development should be read alongside Romania's broader pattern, visible elsewhere in this cycle's coverage, of EU-level direct obligations outpacing the domestic institutional infrastructure needed to give them full practical effect. The Data Act consultation closing without adoption as of the material reaching this cycle leaves open the question of which specific body or bodies will ultimately hold enforcement authority, and what sanctions regime will apply to Data Act breaches in Romania, pending finalisation of the implementing law.

Outlook

The regulatory horizon identifies the fourth quarter of 2026 as a tentative estimate for adoption of ANCOM's Data Act implementing law, carrying a half-year uncertainty band that should be read as scheduled rather than assured given the consultation closed in early August 2026 without a stated adoption date. Whether the draft law has advanced toward adoption since the 3 August 2026 consultation close was not established within this cycle's sourcing and remains an open item. Once adopted, the law would designate the competent authorities responsible for Data Act enforcement in Romania and establish the sanctions regime applicable to breaches of the directly-applicable EU Regulation.

Algorithmic, Biometric & Surveillance Governance

Romania's institutional architecture for AI Act oversight advanced through a Government Memorandum adopted on 12 March 2026, which designated the Autoritatea Nationala pentru Administrare si Reglementare in Comunicatii as the national market-surveillance authority for the AI Act and as Romania's single national contact point for AI Act purposes. This designation arrived roughly seven months after the EU-wide deadline of 2 August 2025 for Member States to designate their national competent authorities, placing Romania among the Member States whose institutional build-out for AI Act implementation lagged the formal deadline.

Separately from ANCOM's market-surveillance role, the Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal has been notified to the European Commission as one of nine Romanian public authorities responsible for protecting fundamental rights in the context of high-risk AI systems. This gives ANSPDCP a formal statutory role within Romania's AI Act institutional architecture that is distinct from, and complementary to, ANCOM's market-surveillance function: where ANCOM is positioned to oversee market compliance of AI systems placed on the Romanian market, ANSPDCP's role centres on the fundamental-rights dimension of high-risk AI system deployment, a role that naturally intersects with its existing GDPR mandate given the overlap between fundamental-rights protection and personal-data processing concerns inherent in many high-risk AI use cases.

The seven-month gap between the EU's August 2025 deadline and Romania's March 2026 designation is itself a data point on the pace of Romania's regulatory institution-building relative to EU timelines, a pattern that recurs elsewhere in Romania's regulatory landscape in the form of the Data Act implementing law's unresolved consultation-to-adoption timeline.

Outlook

Whether Romania has adopted secondary legislation detailing ANCOM's inspection powers and operational procedures under the AI Act, beyond the foundational 12 March 2026 Memorandum, was not established within the sourcing and remains an open question for subsequent monitoring. As the dual-authority structure, ANCOM for market surveillance and ANSPDCP for fundamental-rights protection, becomes operational, the practical division of labour and referral mechanisms between the two bodies for cases touching both market-compliance and fundamental-rights concerns will be a relevant area to watch.

Algorithmic, Biometric & Surveillance Governance

Romania's institutional architecture for AI Act oversight advanced through a Government Memorandum adopted on 12 March 2026, which designated the Autoritatea Nationala pentru Administrare si Reglementare in Comunicatii as the national market-surveillance authority for the AI Act and as Romania's single national contact point for AI Act purposes. This designation arrived roughly seven months after the EU-wide deadline of 2 August 2025 for Member States to designate their national competent authorities, placing Romania among the Member States whose institutional build-out for AI Act implementation lagged the formal deadline.

Separately from ANCOM's market-surveillance role, the Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal has been notified to the European Commission as one of nine Romanian public authorities responsible for protecting fundamental rights in the context of high-risk AI systems. This gives ANSPDCP a formal statutory role within Romania's AI Act institutional architecture that is distinct from, and complementary to, ANCOM's market-surveillance function: where ANCOM is positioned to oversee market compliance of AI systems placed on the Romanian market, ANSPDCP's role centres on the fundamental-rights dimension of high-risk AI system deployment, a role that naturally intersects with its existing GDPR mandate given the overlap between fundamental-rights protection and personal-data processing concerns inherent in many high-risk AI use cases.

The seven-month gap between the EU's August 2025 deadline and Romania's March 2026 designation is itself a data point on the pace of Romania's regulatory institution-building relative to EU timelines, a pattern that recurs elsewhere in Romania's regulatory landscape this cycle in the form of the Data Act implementing law's unresolved consultation-to-adoption timeline.

Outlook

Whether Romania has adopted secondary legislation detailing ANCOM's inspection powers and operational procedures under the AI Act, beyond the foundational 12 March 2026 Memorandum, was not established within this cycle's sourcing and remains an open question for subsequent monitoring. As the dual-authority structure, ANCOM for market surveillance and ANSPDCP for fundamental-rights protection, becomes operational, the practical division of labour and referral mechanisms between the two bodies for cases touching both market-compliance and fundamental-rights concerns will be a relevant area to watch.

Enforcement & Redress

Romania's National Supervisory Authority for Personal Data Processing, ANSPDCP, is understood to have fined Auchan România S.A. EUR 8,000 (41,908 lei), announced 30 October 2026, following an administrator-account compromise that allowed unauthorised access to and disclosure of internal-user personal data. The finding is reported to rest on inadequate technical and organisational measures to secure access to administrator-level accounts, engaging the security obligations in Article 5(1)(f) and Article 32 of the GDPR. The decision text itself has not been independently obtained; the figure and the underlying narrative come from secondary press reporting rather than the regulator's own published decision.

In a separate matter concluded around October 2026, ANSPDCP is understood to have fined SC Hayat Medical & Dental SRL on two counts: processing patient personal data without an identifiable lawful basis under Article 5(1), and failing to provide the authority with information it had requested in the course of an investigation, engaging the non-cooperation ground at Article 83(5)(e). Reported penalty figures sit at the EUR 5,000 and EUR 2,000 level across the two counts. As with the Auchan matter, this account is drawn from secondary reporting rather than the primary decision, and the combined penalty structure should be read with that caveat attached.

Outlook

Taken together, these two decisions are consistent with ANSPDCP's standing enforcement cadence rather than a departure from it: the authority has maintained a broadly monthly rhythm of published fines, placing it among the more active data-protection authorities within the EU by count of decisions, and nothing in these two matters points to a change in that posture. The Auchan matter illustrates the authority's continued attention to administrator-account security as a distinct failure mode under the security-of-processing obligation; the Hayat Medical & Dental matter illustrates its willingness to penalise non-cooperation with its own investigations as a distinct ground alongside the underlying lawful-basis finding. Confirmation of either decision's full text would sharpen the picture of how each ground was applied, but is not yet available.

Enforcement & Redress

ANSPDCP maintained a sustained enforcement cadence within and immediately adjacent to this recency window, issuing at least three identified sanctions across a roughly two-week span in late September and early October 2026, alongside the already-documented March 2026 Renault decision that remains the largest sanction of the year. On 25 September 2026, the authority announced a fine in a decision referencing the sensitivity of biometric data; the fined entity's identity and the exact fine amount were not established from the material retrieved, representing a gap in the available enforcement record for that specific decision. On 2 October 2026, ANSPDCP fined GLOBAL CUSTOMER CARE SERVICES S.R.L. EUR 5,000 following a self-notified cyber-attack, citing breaches of Article 32(1)(b), 32(1)(d) and 32(2). On 7 October 2026, the authority fined a veterinary-hospital operator approximately EUR 1,000 for failing to properly resolve a data subject's access request covering call-recording and CCTV data.

The range of fine amounts across this short window, from roughly EUR 1,000 to EUR 5,000 for the two fully identified October decisions, with the March 2026 Renault decision at EUR 125,000 standing well above both, illustrates that ANSPDCP's enforcement activity spans both high-volume lower-value sanctions against smaller operators and occasional high-value sanctions tied to more significant security failures. The 25 September 2026 biometric-data-referencing decision is notable for the sensitivity of the data category involved but cannot yet be assessed for materiality given the absence of confirmed fine amount or sanctioned entity in the retrieved record.

Viewed together, these decisions confirm a pattern noted elsewhere in the coverage: Article 32 security-of-processing failures, whether arising from cyberattack or inadequate operational controls, are the dominant basis for ANSPDCP sanctions, while data-subject-rights failures such as the veterinary-hospital access-request case represent a secondary but still active enforcement category.

Outlook

The identity of the entity sanctioned on 25 September 2026 and the exact fine amount in that biometric-data-referencing decision remain open items, and confirming them would materially sharpen the enforcement picture for that specific case given the heightened sensitivity typically attached to biometric data processing under Article 9 of the GDPR. Based on the cadence observed across this window, three sanctions within roughly two weeks, continued active enforcement by ANSPDCP in the near term should be anticipated, consistent with the authority's demonstrated pattern of frequent, security-focused sanctioning activity through 2026.

Enforcement & Redress

ANSPDCP maintained a sustained enforcement cadence within and immediately adjacent to this recency window, issuing at least three identified sanctions across a roughly two-week span in late September and early October 2026, alongside the already-documented March 2026 Renault decision that remains the largest sanction of the year. On 25 September 2026, the authority announced a fine in a decision referencing the sensitivity of biometric data; the fined entity's identity and the exact fine amount were not established from the material retrieved this cycle, representing a gap in the available enforcement record for that specific decision. On 2 October 2026, ANSPDCP fined GLOBAL CUSTOMER CARE SERVICES S.R.L. EUR 5,000 following a self-notified cyber-attack, citing breaches of Article 32(1)(b), 32(1)(d) and 32(2). On 7 October 2026, the authority fined a veterinary-hospital operator approximately EUR 1,000 for failing to properly resolve a data subject's access request covering call-recording and CCTV data.

The range of fine amounts across this short window, from roughly EUR 1,000 to EUR 5,000 for the two fully identified October decisions, with the March 2026 Renault decision at EUR 125,000 standing well above both, illustrates that ANSPDCP's enforcement activity spans both high-volume lower-value sanctions against smaller operators and occasional high-value sanctions tied to more significant security failures. The 25 September 2026 biometric-data-referencing decision is notable for the sensitivity of the data category involved but cannot yet be assessed for materiality given the absence of confirmed fine amount or sanctioned entity in the retrieved record.

Viewed together, these decisions confirm a pattern noted elsewhere in this cycle's coverage: Article 32 security-of-processing failures, whether arising from cyberattack or inadequate operational controls, are the dominant basis for ANSPDCP sanctions, while data-subject-rights failures such as the veterinary-hospital access-request case represent a secondary but still active enforcement category.

Outlook

The identity of the entity sanctioned on 25 September 2026 and the exact fine amount in that biometric-data-referencing decision remain open items, and confirming them would materially sharpen the enforcement picture for that specific case given the heightened sensitivity typically attached to biometric data processing under Article 9 of the GDPR. Based on the cadence observed across this window, three sanctions within roughly two weeks, continued active enforcement by ANSPDCP in the near term should be anticipated, consistent with the authority's demonstrated pattern of frequent, security-focused sanctioning activity through 2026.