--- title: "Romania Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/romania/ source_html: /jurisdictions/romania/index.html description: "Romania data protection and privacy regulation: 10 categories, 44 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 7fce5a877afcc29aa79cfeec5e799ef4449c7261c26c80a4b254d31988a2197e generator: "fe-fleet/md-twin@1.0" --- # Romania Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/romania/), [World Payments](https://payments.gi/jurisdictions/romania/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 44 claims · 37 sources in the cumulative register Download report (PDF) Expand all Continental Automotive Products SRL was fined RON 76,336, approximately EUR 15,000, by ANSPDCP for violations of GDPR Articles 32(1)(b) and 32(2), following a data breach involving employees' medical data. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (2 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=ROMANIA)[Build Report](/reports/?j=ROMANIA)[Compare](/compare/?j=ROMANIA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANS Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 44 Claims 13 Tier-1 sources Traffic-light mix 4 green 6 amber (sums to 10 rendered categories; click to filter) No categories are currently flagged red. Law made at European Economic Area (Bloc) level that applies in Romania is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Romania’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,140 Full executive summary 150 ###### Latest update · 25 October 2026 #### Lead Signal Romania's data protection enforcement posture continued to intensify across this reporting window, with the Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal issuing a sustained sequence of sanctions concentrated on security-of-processing failures under Article 32 of the GDPR. A fine announced on 25 September 2026 referenced the sensitivity of biometric data, though the fined entity and exact amount were not established within the retrieved material; this was followed by a EUR 5,000 fine on 2 October 2026 against an operator following a self-notified cyber-attack, for breaches of Article 32(1)(b), 32(1)(d) and 32(2), and a further fine of approximately EUR 1,000 on 7 October 2026 against a veterinary-hospital operator for failing to properly resolve a data subject access request. The largest sanction within the broader 2026 pattern, EUR 125,000 against Renault Commercial Roumanie S.R.L. in March 2026, also centred on Article 32 security failures compounded by an Article 28(1) processor-oversight breach after a cyberattack on a processor-administered application led to unauthorised publication of personal data. The analytically significant pattern is the dominance of Article 32 security-of-processing findings across ANSPDCP's enforcement activity this year, spanning fine amounts from the low thousands of euros to six figures, and the sustained cadence with which such decisions have been issued within and adjacent to this recency window. #### Other Developments Romania's institutional architecture for artificial-intelligence oversight has taken a further step forward, with timing lagging the EU deadline. On 12 March 2026 the Romanian Government adopted a Memorandum designating the Autoritatea Nationala pentru Administrare si Reglementare in Comunicatii as the national AI Act market-surveillance authority and single national contact point, arriving roughly seven months after the EU's 2 August 2025 deadline for such designations. Separately, ANSPDCP has been notified to the European Commission as one of nine Romanian public authorities responsible for protecting fundamental rights in the context of high-risk AI systems, giving the data protection authority a formal role within the broader AI Act institutional architecture alongside ANCOM's market-surveillance function. A national implementing framework for the EU Data Act moved through public consultation but remains unadopted. ANCOM launched a public consultation on 2 July 2026, which closed on 3 August 2026, on a draft law establishing measures for application of the Data Act, including designation of competent authorities and an enforcement and sanctions framework; the draft law has not been adopted as of the material reaching. #### Cross-Monitor Connections Romania's AI Act institutional build-out, spanning both ANCOM's market-surveillance designation and ANSPDCP's fundamental-rights role, connects directly to the artificial-intelligence monitor's coverage of Member State AI Act implementation timelines, where the seven-month lag behind the EU's August 2025 designation deadline is relevant comparative context. The Data Act consultation closure likewise intersects with the financial-integrity and world-payments monitors' interest in data-sharing and interoperability frameworks affecting regulated financial-sector entities operating in Romania, though neither of those monitors' Romania coverage addresses the Data Act directly. #### Outlook Several open questions will shape how these developments resolve. Whether the ANCOM Data Act implementing law advances from its 3 August 2026 consultation close toward adoption remains unclear from the material reaching, with the regulatory horizon placing a tentative estimate in the fourth quarter of 2026, carrying a half-year uncertainty band that should be read as scheduled rather than assured. Whether Romania has since adopted secondary legislation detailing ANCOM's inspection powers under the AI Act, beyond the 12 March 2026 Memorandum establishing its designation, was not established. On enforcement, the sustained cadence of Article 32 security-of-processing fines observed across this window suggests ANSPDCP's sanctioning activity in this area is unlikely to slow in the near term, though the specific legal basis and sanctioned entity behind the 25 September 2026 biometric-data-referencing fine remain to be confirmed. 1 earlier update not shown here. ###### Standing brief · as of 23 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Continental Automotive Products SRL was fined RON 76,336, approximately EUR 15,000, by ANSPDCP for violations of GDPR Articles 32(1)(b) and 32(2), following a data breach involving employees' medical data. The investigation that produced this fine was triggered by the controller's own breach notification under Law 363/2018's 72-hour reporting rule, meaning the enforcement action originated from the controller's compliance with its notification duty rather than from an external complaint or a regulator-initiated inspection. The fine, dated 19 January 2026 and reported this cycle, anchors the controller-processor-duties and enforcement signal for Romania, and sits alongside two further named enforcement actions that together define an active, moderate-intensity enforcement cycle. #### Other Developments Data subject rights enforcement. ANSPDCP's decision concerning the operator of evita-teparii.ro reaffirmed deletion-request and Article 12 information obligations, applying even to a natural-person-operated website rather than only to conventional corporate controllers. The investigation, closed in early 2026 and reported in May 2026, resulted in four separate administrative fines together with three Article 58(2) corrective measures, indicating that ANSPDCP is willing to pursue a full enforcement stack against a small or informal operator rather than limiting enforcement intensity to larger corporate targets. Algorithmic governance horizon. The EU AI Act's high-risk-system obligations, including AML and fraud-detection tools falling under Annex III, become fully applicable from 2 August 2026. This creates an approaching compliance intersection for Romanian financial-sector data processing, which already operates under GDPR Article 32 security obligations; from the applicability date, financial-sector controllers deploying AML or fraud-detection tooling classified as high-risk will need to satisfy AI Act risk-assessment and governance duties layered on top of their existing data-protection security obligations. Further enforcement activity. Roumasport was fined EUR 10,000 for a GDPR breach, reported 20 April 2026, adding a third named enforcement action to this cycle's record alongside Continental Automotive Products and the evita-teparii.ro operator, and reinforcing the read of a sustained rather than escalating enforcement tempo. #### Cross-Monitor Connections The EU AI Act's approaching full-applicability date for high-risk AML and fraud-detection systems intersects directly with obligations tracked by the Financial Integrity Monitor: Annex III high-risk systems used for anti-money-laundering purposes will need to satisfy both AI Act risk-assessment duties and existing AML/CFT control requirements from the same 2 August 2026 compliance date, creating a compounding burden for the same class of Romanian financial-sector controllers. No adtech, cross-border-transfer, or World Payments Monitor-relevant development surfaced on the data-protection side this cycle to connect further. #### Outlook Romania's enforcement posture this cycle reads as active but moderate: three named actions, against Continental Automotive Products, the evita-teparii.ro operator, and Roumasport, sit within GDPR's statutory fine range rather than approaching its maxima, suggesting a sustained rather than escalating regulatory environment. The clearer horizon marker for the coming cycle is 2 August 2026, when EU AI Act high-risk obligations for AML and fraud-detection systems become fully applicable; how Romanian financial-sector controllers absorb this compounding compliance burden alongside their existing GDPR Article 32 duties will be the key development to watch. Read full brief · 1140 words Standing brief, as of 23 August 2026. #### Regulatory Status Romania's data-protection enforcement environment this cycle is active but moderate: three named ANSPDCP actions (Continental Automotive Products, the evita-teparii.ro operator, and Roumasport) span controller/processor duties (GDPR Article 32 security violations following a self-reported breach) and data subject rights (deletion-request and Article 12 obligations applied even to a natural-person operator, with a full stack of fines plus Article 58(2) corrective measures). Separately, the EU AI Act's high-risk-system obligations for AML and fraud-detection tools under Annex III become fully applicable from 2 August 2026, creating an approaching compliance intersection with Romanian financial-sector data processing already governed by GDPR Article 32. #### Outlook The key markers for the coming cycle are whether ANSPDCP's enforcement tempo remains moderate or escalates, and how Romanian financial-sector controllers absorb the EU AI Act's 2 August 2026 high-risk obligations for AML and fraud-detection systems alongside their existing GDPR security duties. Read full brief · 150 words Key regulatory facts for Romania Regulatory Dimension Romania Standing Position Jurisdiction Romania (RO) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 44 sourced findings) Regulator & Framework Fully operational GDPR-aligned regime with an active, resourced DPA and a national implementing statute in force since 2018. Lawful Processing & Special Data Direct GDPR application with CJEU-clarified consent standard originating from a Romanian reference. Data Subject Rights Rights framework mirrors GDPR baseline; enforcement record shows the regulator actively polices non-compliance with erasure and access obligations. Controller/Processor Duties Framework is GDPR-aligned (green in principle) but repeated enforcement findings of Article 32/33 non-compliance among controllers warrant an amber operational rating. Primary Instruments Cited DataGuidance, DataGuidance, EUR-Lex, DataGuidance, ANSPDCP Last Confirmed / Updated 2026-11-04 (37 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Romania: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Fully operational GDPR-aligned regime with an active, resourced DPA and a national implementing statute in force since 2018. Primary framework Regulation (EU) 2016/679 (GDPR) as implemented by Law No. 190/2018 Supervisory authority [Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)](https://www.dataprotection.ro/) Traffic-light rationale — Green Fully operational GDPR-aligned regime with an active, resourced DPA and a national implementing statute in force since 2018. #### Sub-modules (5) #### Regulator And AuthorityGreen ANSPDCP is the single national competent authority for GDPR matters in Romania, operating under Law No. 102/2005 (organisational statute) and Law No. 190/2018 (GDPR implementation). Claims (2): - The National Supervisory Authority for Personal Data Processing (ANSPDCP) is the competent supervisory authority for data protection matters in Romania under Law No. 190/2018. - ANSPDCP published an update on 19 October 2026 reporting on the EDPB's 13-14 October 2026 plenary session, within this recency window. #### Act And InstrumentsGreen The operative instruments are the GDPR itself and the national implementing Law No. 190/2018. Claims (1): - Romania implemented the GDPR through Law No. 190/2018 Implementing the General Data Protection Regulation (Regulation (EU) 2016/679). #### Material ScopeGreen Material scope follows GDPR Art 2/4 directly; Law 190/2018 adds detailed rules for journalistic, academic, artistic and literary expression processing. Claims (1): - Law No. 190/2018 is relatively comprehensive and includes detailed provisions on the processing of data for journalistic purposes or academic or artistic expression, on certification bodies, and on corrective measures and sanctions for both private and public bodies. #### Territorial ScopeGreen Territorial scope follows GDPR Art 3 directly (establishment + targeting tests); no Romania-specific narrowing or broadening identified. Claims (1): - Territorial scope of the Romanian regime tracks GDPR Article 3 directly, applying to controllers/processors established in Romania and, via the targeting test, to non-established controllers processing data of subjects in Romania. #### Registration And FilingGreen Romania abolished the pre-GDPR general notification/registration obligation; ANSPDCP issued a public statement confirming elimination of the notification duty, consistent with GDPR's accountability-based model (Recital 89). Claims (1): - ANSPDCP issued a statement on the elimination of the obligation to notify data processing operations, consistent with the GDPR's shift away from ex-ante registration toward accountability-based compliance (Recital 89, Articles 36-37 GDPR). Romania implements the GDPR through Law No. 190/2018 Implementing the General Data Protection Regulation, with the National Supervisory Authority for Personal Data Processing (ANSPDCP) as the competent supervisory authority. The regime is a fully-operational EU Member State omnibus regime; Romania did not enact a broad derogation architecture beyond the sector-specific carve-outs (journalism/academic/artistic expression, certification bodies) permitted by GDPR opening clauses. No periodic updates recorded in this cycle Sources and claims (6) - [DataGuidance](https://www.dataguidance.com/jurisdictions/romania?topic=residency) — The National Supervisory Authority for Personal Data Processing (ANSPDCP) is the competent supervisory authority for data protection matters in Romania under Law No. 190/2018. - [DataGuidance](https://www.dataguidance.com/legal-research/law-no-1902018-implementing-general-data) — Romania implemented the GDPR through Law No. 190/2018 Implementing the General Data Protection Regulation (Regulation (EU) 2016/679). - [DataGuidance](https://www.dataguidance.com/jurisdictions/romania?topic=residency) — Law No. 190/2018 is relatively comprehensive and includes detailed provisions on the processing of data for journalistic purposes or academic or artistic expression, on certification bodies, and on corrective measures and sanctions for both private and public bodies. - [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj) — Territorial scope of the Romanian regime tracks GDPR Article 3 directly, applying to controllers/processors established in Romania and, via the targeting test, to non-established controllers processing data of subjects in Romania. - [DataGuidance](https://www.dataguidance.com/notes/romania-data-processing-notification) — ANSPDCP issued a statement on the elimination of the obligation to notify data processing operations, consistent with the GDPR's shift away from ex-ante registration toward accountability-based compliance (Recital 89, Articles 36-37 GDPR). - [ANSPDCP](https://www.dataprotection.ro/) — ANSPDCP published an update on 19 October 2026 reporting on the EDPB's 13-14 October 2026 plenary session, within this recency window. ### Romania: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Direct GDPR application with CJEU-clarified consent standard originating from a Romanian reference. Primary framework GDPR Articles 6, 7, 9; Law No. 190/2018 Supervisory authority [ANSPDCP](https://www.dataprotection.ro/) Traffic-light rationale — Green Direct GDPR application with CJEU-clarified consent standard originating from a Romanian reference. D2 · Lawful Processing — Full Module Record 4 sub-modules · 51 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Romania: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Rights framework mirrors GDPR baseline; enforcement record shows the regulator actively polices non-compliance with erasure and access obligations. Primary framework GDPR Articles 12-22; Law No. 190/2018 Supervisory authority [ANSPDCP](https://www.dataprotection.ro/) Traffic-light rationale — Green Rights framework mirrors GDPR baseline; enforcement record shows the regulator actively polices non-compliance with erasure and access obligations. #### Sub-modules (5) #### Access RightGreen Access right follows GDPR Article 15 directly; no national supplementary access regime identified. Claims (1): - Spitalul Veterinar Tineretului SRL — ANSPDCP fined the operator 5,242 RON (approx. EUR 1,000) on 7 October 2026 for failing to properly resolve a data subject's access request for call-recording and CCTV data. #### Rectification And ErasureAmber ANSPDCP sanctioned an individual for, among other violations, failing to respond to a data-subject erasure request under GDPR Article 17(1) after identity cards were published online. Claims (1): - ANSPDCP fined an individual RON 50,890 for, inter alia, violating GDPR Article 17(1) by failing to respond to a request to delete personal data, in addition to publishing identity cards online without a legal basis. #### Restriction And ObjectionAmber Restriction/objection rights follow GDPR Articles 18/21 directly; no Romania-specific case identified in this research pass. #### Data PortabilityAmber Portability follows GDPR Article 20 directly; no Romania-specific derogation or guidance identified in this research pass. #### Deadlines And Response WindowsGreen Response deadlines follow the GDPR Article 12(3) one-month default (extendable by two further months for complex requests); no Romania-specific shortening/lengthening identified. Claims (1): - The individual sanctioned by ANSPDCP was found to have breached GDPR Article 12(3)-12(4) transparency and response-timeliness obligations toward data subjects. Data subject rights (access, rectification, erasure, restriction, objection, portability) apply per GDPR Articles 15-22 with no Romania-specific derogations identified in Law 190/2018 beyond the general journalistic/academic/artistic exemptions. ANSPDCP enforcement actions confirm active supervision of erasure-request compliance (e.g., the evita-teparii.ro case for failure to honour a deletion request). No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (3) - [DataGuidance](https://www.dataguidance.com/news/romania-anspdcp-fines-individual-ron-50890-sharing) — ANSPDCP fined an individual RON 50,890 for, inter alia, violating GDPR Article 17(1) by failing to respond to a request to delete personal data, in addition to publishing identity cards online without a legal basis. - [DataGuidance](https://www.dataguidance.com/news/romania-anspdcp-fines-individual-ron-50890-sharing) — The individual sanctioned by ANSPDCP was found to have breached GDPR Article 12(3)-12(4) transparency and response-timeliness obligations toward data subjects. - [LegalUp](https://legalup.substack.com/p/auchan-amendata-cu-8000-de-euro-ce) — Spitalul Veterinar Tineretului SRL — ANSPDCP fined the operator 5,242 RON (approx. EUR 1,000) on 7 October 2026 for failing to properly resolve a data subject's access request for call-recording and CCTV data. ### Romania: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Framework is GDPR-aligned (green in principle) but repeated enforcement findings of Article 32/33 non-compliance among controllers warrant an amber operational rating. Primary framework GDPR Articles 5, 24-25, 28, 30, 32-35, 37-39; Law No. 190/2018 Supervisory authority [ANSPDCP](https://www.dataprotection.ro/) Traffic-light rationale — Amber Framework is GDPR-aligned (green in principle) but repeated enforcement findings of Article 32/33 non-compliance among controllers warrant an amber operational rating. Periodic update · new data 2026-10-18 #### Controller/Processor Duties Article 32 security-of-processing obligations dominate ANSPDCP's controller and processor enforcement activity within this recency window. On 2 October 2026, the authority fined GLOBAL CUSTOMER CARE SERVICES S.R.L. EUR 5,000 for breaches of Article 32(1)(b) and 32(1)(d), together with Article 32(2), following a self-notified cyber-attack. The self-notification detail is significant: the operator appears to have reported the incident to ANSPDCP rather than the breach surfacing through complaint or external discovery, yet the authority nonetheless proceeded to sanction, indicating that voluntary notification does not by itself forestall enforcement where the underlying technical and organisational measures are found deficient. This fine sits within a broader pattern anchored by ANSPDCP's largest sanction of 2026, a EUR 125,000 fine against Renault Commercial Roumanie S.R.L., decided in March 2026. That decision similarly rested on breaches of Article 32(1)(b), 32(1)(d) and 32(2), but combined these security findings with an Article 28(1) processor-oversight breach, after a cyberattack on an application administered by a processor on the controller's behalf led to unauthorised publication of personal data. The Renault decision is directly sourced from ANSPDCP's own press release, giving it a higher evidentiary standing than the press-reported October decisions, and its combination of a security failure with a processor-supervision failure under Article 28 illustrates how ANSPDCP treats inadequate oversight of a processor as compounding, rather than separate from, the underlying security deficiency. The consistency of the legal bases cited across these two decisions, Article 32(1)(b), 32(1)(d) and 32(2) in both cases, suggests ANSPDCP has settled on a recurring analytical framework for assessing security-of-processing failures following a cyberattack: inadequate measures to ensure ongoing confidentiality and resilience of processing systems, and inadequate processes for regularly testing and evaluating the effectiveness of technical and organisational measures. Controllers and processors operating in Romania should note that the amounts involved vary substantially, from EUR 5,000 to EUR 125,000, suggesting that the scale of the breach, the sensitivity of the data involved, and the presence or absence of compounding factors such as inadequate processor oversight materially affect the sanction ultimately imposed, even where the underlying legal bases cited are similar. #### Outlook Given the cadence of Article 32-based enforcement observed across this window, including the 2 October 2026 decision and the earlier Renault decision, continued ANSPDCP attention to security-of-processing compliance, particularly following cyberattacks and data breaches, should be expected to persist. Controllers relying on processors for application administration or data handling should take note of the Renault precedent's combination of Article 32 and Article 28(1) findings, which indicates that inadequate processor oversight is being treated as an aggravating rather than separate factor in ANSPDCP's assessment of such incidents. D4 · Controller & Processor — Full Module Record 7 sub-modules · 56 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Romania: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Transfer mechanisms are the harmonised EU-wide GDPR Chapter V toolkit; no Romania-specific localisation mandate identified. Primary framework GDPR Articles 44-50 (Chapter V); EU adequacy decisions Supervisory authority [ANSPDCP](https://www.dataprotection.ro/) Traffic-light rationale — Green Transfer mechanisms are the harmonised EU-wide GDPR Chapter V toolkit; no Romania-specific localisation mandate identified. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 72 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Romania: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial and employment overlays are evidenced by case law/enforcement; health, education, telecoms-specific and insurance overlays were not separately confirmed in this pass and are marked absent. Primary framework GDPR (general); ECHR Article 8 (employment monitoring, via Bărbulescu); Law No. 190/2018 Supervisory authority [ANSPDCP](https://www.dataprotection.ro/) Traffic-light rationale — Amber Financial and employment overlays are evidenced by case law/enforcement; health, education, telecoms-specific and insurance overlays were not separately confirmed in this pass and are marked absent. Periodic update · new data 2026-10-25 #### Sectoral Watch Romania's domestic implementation framework for the EU Data Act, Regulation (EU) 2023/2854, progressed through a public consultation stage without reaching adoption. The Autoritatea Nationala pentru Administrare si Reglementare in Comunicatii launched the consultation on 2 July 2026, and it closed on 3 August 2026. The draft law under consultation addresses the designation of competent national authorities for Data Act purposes and establishes an enforcement and sanctions framework for the directly-applicable EU regulation. As a directly applicable EU Regulation, the Data Act's substantive provisions already bind relevant parties in Romania regardless of domestic implementing legislation; what the draft law under consultation would add is the domestic institutional machinery, designated authorities, enforcement powers and sanctions, needed to operationalise compliance and enforcement at the national level. This consultation-stage development should be read alongside Romania's broader pattern, visible elsewhere in the coverage, of EU-level direct obligations outpacing the domestic institutional infrastructure needed to give them full practical effect. The Data Act consultation closing without adoption as of the material reaching leaves open the question of which specific body or bodies will ultimately hold enforcement authority, and what sanctions regime will apply to Data Act breaches in Romania, pending finalisation of the implementing law. #### Outlook The regulatory horizon identifies the fourth quarter of 2026 as a tentative estimate for adoption of ANCOM's Data Act implementing law, carrying a half-year uncertainty band that should be read as scheduled rather than assured given the consultation closed in early August 2026 without a stated adoption date. Whether the draft law has advanced toward adoption since the 3 August 2026 consultation close was not established within the sourcing and remains an open item. Once adopted, the law would designate the competent authorities responsible for Data Act enforcement in Romania and establish the sanctions regime applicable to breaches of the directly-applicable EU Regulation. Periodic update · new data 2026-10-18 #### Sectoral Watch Romania's domestic implementation framework for the EU Data Act, Regulation (EU) 2023/2854, progressed through a public consultation stage this cycle without reaching adoption. The Autoritatea Nationala pentru Administrare si Reglementare in Comunicatii launched the consultation on 2 July 2026, and it closed on 3 August 2026. The draft law under consultation addresses the designation of competent national authorities for Data Act purposes and establishes an enforcement and sanctions framework for the directly-applicable EU regulation. As a directly applicable EU Regulation, the Data Act's substantive provisions already bind relevant parties in Romania regardless of domestic implementing legislation; what the draft law under consultation would add is the domestic institutional machinery, designated authorities, enforcement powers and sanctions, needed to operationalise compliance and enforcement at the national level. This consultation-stage development should be read alongside Romania's broader pattern, visible elsewhere in this cycle's coverage, of EU-level direct obligations outpacing the domestic institutional infrastructure needed to give them full practical effect. The Data Act consultation closing without adoption as of the material reaching this cycle leaves open the question of which specific body or bodies will ultimately hold enforcement authority, and what sanctions regime will apply to Data Act breaches in Romania, pending finalisation of the implementing law. #### Outlook The regulatory horizon identifies the fourth quarter of 2026 as a tentative estimate for adoption of ANCOM's Data Act implementing law, carrying a half-year uncertainty band that should be read as scheduled rather than assured given the consultation closed in early August 2026 without a stated adoption date. Whether the draft law has advanced toward adoption since the 3 August 2026 consultation close was not established within this cycle's sourcing and remains an open item. Once adopted, the law would designate the competent authorities responsible for Data Act enforcement in Romania and establish the sanctions regime applicable to breaches of the directly-applicable EU Regulation. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 63 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Romania: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookie-consent enforcement is confirmed and active; dark patterns, opt-out signal recognition, clean-room rules and cross-context advertising lack confirmed Romania-specific findings in this pass. Primary framework Directive 2002/58/EC as transposed by Law No. 506/2004; GDPR Supervisory authority [ANSPDCP](https://www.dataprotection.ro/) Traffic-light rationale — Amber Cookie-consent enforcement is confirmed and active; dark patterns, opt-out signal recognition, clean-room rules and cross-context advertising lack confirmed Romania-specific findings in this pass. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 51 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Romania: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Governed by directly-applicable EU-level AI Act/GDPR; amber reflects genuine EU-wide uncertainty over high-risk AI Act timelines and guidance that also affects Romanian deployers/providers. Primary framework GDPR Article 22; Regulation (EU) 2024/1689 (EU AI Act) Supervisory authority [ANSPDCP](https://www.dataprotection.ro/) Traffic-light rationale — Amber Governed by directly-applicable EU-level AI Act/GDPR; amber reflects genuine EU-wide uncertainty over high-risk AI Act timelines and guidance that also affects Romanian deployers/providers. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance Romania's institutional architecture for AI Act oversight advanced through a Government Memorandum adopted on 12 March 2026, which designated the Autoritatea Nationala pentru Administrare si Reglementare in Comunicatii as the national market-surveillance authority for the AI Act and as Romania's single national contact point for AI Act purposes. This designation arrived roughly seven months after the EU-wide deadline of 2 August 2025 for Member States to designate their national competent authorities, placing Romania among the Member States whose institutional build-out for AI Act implementation lagged the formal deadline. Separately from ANCOM's market-surveillance role, the Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal has been notified to the European Commission as one of nine Romanian public authorities responsible for protecting fundamental rights in the context of high-risk AI systems. This gives ANSPDCP a formal statutory role within Romania's AI Act institutional architecture that is distinct from, and complementary to, ANCOM's market-surveillance function: where ANCOM is positioned to oversee market compliance of AI systems placed on the Romanian market, ANSPDCP's role centres on the fundamental-rights dimension of high-risk AI system deployment, a role that naturally intersects with its existing GDPR mandate given the overlap between fundamental-rights protection and personal-data processing concerns inherent in many high-risk AI use cases. The seven-month gap between the EU's August 2025 deadline and Romania's March 2026 designation is itself a data point on the pace of Romania's regulatory institution-building relative to EU timelines, a pattern that recurs elsewhere in Romania's regulatory landscape in the form of the Data Act implementing law's unresolved consultation-to-adoption timeline. #### Outlook Whether Romania has adopted secondary legislation detailing ANCOM's inspection powers and operational procedures under the AI Act, beyond the foundational 12 March 2026 Memorandum, was not established within the sourcing and remains an open question for subsequent monitoring. As the dual-authority structure, ANCOM for market surveillance and ANSPDCP for fundamental-rights protection, becomes operational, the practical division of labour and referral mechanisms between the two bodies for cases touching both market-compliance and fundamental-rights concerns will be a relevant area to watch. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Romania's institutional architecture for AI Act oversight advanced through a Government Memorandum adopted on 12 March 2026, which designated the Autoritatea Nationala pentru Administrare si Reglementare in Comunicatii as the national market-surveillance authority for the AI Act and as Romania's single national contact point for AI Act purposes. This designation arrived roughly seven months after the EU-wide deadline of 2 August 2025 for Member States to designate their national competent authorities, placing Romania among the Member States whose institutional build-out for AI Act implementation lagged the formal deadline. Separately from ANCOM's market-surveillance role, the Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal has been notified to the European Commission as one of nine Romanian public authorities responsible for protecting fundamental rights in the context of high-risk AI systems. This gives ANSPDCP a formal statutory role within Romania's AI Act institutional architecture that is distinct from, and complementary to, ANCOM's market-surveillance function: where ANCOM is positioned to oversee market compliance of AI systems placed on the Romanian market, ANSPDCP's role centres on the fundamental-rights dimension of high-risk AI system deployment, a role that naturally intersects with its existing GDPR mandate given the overlap between fundamental-rights protection and personal-data processing concerns inherent in many high-risk AI use cases. The seven-month gap between the EU's August 2025 deadline and Romania's March 2026 designation is itself a data point on the pace of Romania's regulatory institution-building relative to EU timelines, a pattern that recurs elsewhere in Romania's regulatory landscape this cycle in the form of the Data Act implementing law's unresolved consultation-to-adoption timeline. #### Outlook Whether Romania has adopted secondary legislation detailing ANCOM's inspection powers and operational procedures under the AI Act, beyond the foundational 12 March 2026 Memorandum, was not established within this cycle's sourcing and remains an open question for subsequent monitoring. As the dual-authority structure, ANCOM for market surveillance and ANSPDCP for fundamental-rights protection, becomes operational, the practical division of labour and referral mechanisms between the two bodies for cases touching both market-compliance and fundamental-rights concerns will be a relevant area to watch. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 88 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Romania: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Age-of-consent position for Romania could not be confirmed against primary text in this pass; treated as open/Probable rather than silently assumed. Primary framework GDPR Article 8 Supervisory authority [ANSPDCP](https://www.dataprotection.ro/) Traffic-light rationale — Amber Age-of-consent position for Romania could not be confirmed against primary text in this pass; treated as open/Probable rather than silently assumed. D9 · Children's Privacy — Full Module Record 5 sub-modules · 102 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Romania: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Enforcement is active and evidenced by multiple 2026 decisions, but the regulator's absolute funding/headcount and any Romania-specific collective-redress mechanism could not be confirmed in this pass. Primary framework GDPR Articles 58, 77-84; Law No. 190/2018 Article 12-16; Law No. 102/2005 Supervisory authority [ANSPDCP](https://www.dataprotection.ro/) Traffic-light rationale — Amber Enforcement is active and evidenced by multiple 2026 decisions, but the regulator's absolute funding/headcount and any Romania-specific collective-redress mechanism could not be confirmed in this pass. Periodic update · new data 2026-11-04 #### Enforcement & Redress Romania's National Supervisory Authority for Personal Data Processing, ANSPDCP, is understood to have fined Auchan România S.A. EUR 8,000 (41,908 lei), announced 30 October 2026, following an administrator-account compromise that allowed unauthorised access to and disclosure of internal-user personal data. The finding is reported to rest on inadequate technical and organisational measures to secure access to administrator-level accounts, engaging the security obligations in Article 5(1)(f) and Article 32 of the GDPR. The decision text itself has not been independently obtained; the figure and the underlying narrative come from secondary press reporting rather than the regulator's own published decision. In a separate matter concluded around October 2026, ANSPDCP is understood to have fined SC Hayat Medical & Dental SRL on two counts: processing patient personal data without an identifiable lawful basis under Article 5(1), and failing to provide the authority with information it had requested in the course of an investigation, engaging the non-cooperation ground at Article 83(5)(e). Reported penalty figures sit at the EUR 5,000 and EUR 2,000 level across the two counts. As with the Auchan matter, this account is drawn from secondary reporting rather than the primary decision, and the combined penalty structure should be read with that caveat attached. #### Outlook Taken together, these two decisions are consistent with ANSPDCP's standing enforcement cadence rather than a departure from it: the authority has maintained a broadly monthly rhythm of published fines, placing it among the more active data-protection authorities within the EU by count of decisions, and nothing in these two matters points to a change in that posture. The Auchan matter illustrates the authority's continued attention to administrator-account security as a distinct failure mode under the security-of-processing obligation; the Hayat Medical & Dental matter illustrates its willingness to penalise non-cooperation with its own investigations as a distinct ground alongside the underlying lawful-basis finding. Confirmation of either decision's full text would sharpen the picture of how each ground was applied, but is not yet available. Periodic update · new data 2026-10-25 #### Enforcement & Redress ANSPDCP maintained a sustained enforcement cadence within and immediately adjacent to this recency window, issuing at least three identified sanctions across a roughly two-week span in late September and early October 2026, alongside the already-documented March 2026 Renault decision that remains the largest sanction of the year. On 25 September 2026, the authority announced a fine in a decision referencing the sensitivity of biometric data; the fined entity's identity and the exact fine amount were not established from the material retrieved, representing a gap in the available enforcement record for that specific decision. On 2 October 2026, ANSPDCP fined GLOBAL CUSTOMER CARE SERVICES S.R.L. EUR 5,000 following a self-notified cyber-attack, citing breaches of Article 32(1)(b), 32(1)(d) and 32(2). On 7 October 2026, the authority fined a veterinary-hospital operator approximately EUR 1,000 for failing to properly resolve a data subject's access request covering call-recording and CCTV data. The range of fine amounts across this short window, from roughly EUR 1,000 to EUR 5,000 for the two fully identified October decisions, with the March 2026 Renault decision at EUR 125,000 standing well above both, illustrates that ANSPDCP's enforcement activity spans both high-volume lower-value sanctions against smaller operators and occasional high-value sanctions tied to more significant security failures. The 25 September 2026 biometric-data-referencing decision is notable for the sensitivity of the data category involved but cannot yet be assessed for materiality given the absence of confirmed fine amount or sanctioned entity in the retrieved record. Viewed together, these decisions confirm a pattern noted elsewhere in the coverage: Article 32 security-of-processing failures, whether arising from cyberattack or inadequate operational controls, are the dominant basis for ANSPDCP sanctions, while data-subject-rights failures such as the veterinary-hospital access-request case represent a secondary but still active enforcement category. #### Outlook The identity of the entity sanctioned on 25 September 2026 and the exact fine amount in that biometric-data-referencing decision remain open items, and confirming them would materially sharpen the enforcement picture for that specific case given the heightened sensitivity typically attached to biometric data processing under Article 9 of the GDPR. Based on the cadence observed across this window, three sanctions within roughly two weeks, continued active enforcement by ANSPDCP in the near term should be anticipated, consistent with the authority's demonstrated pattern of frequent, security-focused sanctioning activity through 2026. Periodic update · new data 2026-10-18 #### Enforcement & Redress ANSPDCP maintained a sustained enforcement cadence within and immediately adjacent to this recency window, issuing at least three identified sanctions across a roughly two-week span in late September and early October 2026, alongside the already-documented March 2026 Renault decision that remains the largest sanction of the year. On 25 September 2026, the authority announced a fine in a decision referencing the sensitivity of biometric data; the fined entity's identity and the exact fine amount were not established from the material retrieved this cycle, representing a gap in the available enforcement record for that specific decision. On 2 October 2026, ANSPDCP fined GLOBAL CUSTOMER CARE SERVICES S.R.L. EUR 5,000 following a self-notified cyber-attack, citing breaches of Article 32(1)(b), 32(1)(d) and 32(2). On 7 October 2026, the authority fined a veterinary-hospital operator approximately EUR 1,000 for failing to properly resolve a data subject's access request covering call-recording and CCTV data. The range of fine amounts across this short window, from roughly EUR 1,000 to EUR 5,000 for the two fully identified October decisions, with the March 2026 Renault decision at EUR 125,000 standing well above both, illustrates that ANSPDCP's enforcement activity spans both high-volume lower-value sanctions against smaller operators and occasional high-value sanctions tied to more significant security failures. The 25 September 2026 biometric-data-referencing decision is notable for the sensitivity of the data category involved but cannot yet be assessed for materiality given the absence of confirmed fine amount or sanctioned entity in the retrieved record. Viewed together, these decisions confirm a pattern noted elsewhere in this cycle's coverage: Article 32 security-of-processing failures, whether arising from cyberattack or inadequate operational controls, are the dominant basis for ANSPDCP sanctions, while data-subject-rights failures such as the veterinary-hospital access-request case represent a secondary but still active enforcement category. #### Outlook The identity of the entity sanctioned on 25 September 2026 and the exact fine amount in that biometric-data-referencing decision remain open items, and confirming them would materially sharpen the enforcement picture for that specific case given the heightened sensitivity typically attached to biometric data processing under Article 9 of the GDPR. Based on the cadence observed across this window, three sanctions within roughly two weeks, continued active enforcement by ANSPDCP in the near term should be anticipated, consistent with the authority's demonstrated pattern of frequent, security-focused sanctioning activity through 2026. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 113 words · 12 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) data localisation Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties