Data protection & GDPR compliance in Romania (2026)

Yes. As an EU/EEA member, Romania applies the GDPR (Regulation (EU) 2016/679) directly, enforced by the National Supervisory Authority for Personal Data Processing (ANSPDCP).

The National Supervisory Authority for Personal Data Processing (ANSPDCP).

Up to €20 million or 4% of global annual turnover, whichever is higher.

A DPO is required where you carry out large-scale monitoring or process special-category data at scale.

Personal-data breaches must be notified to the supervisory authority within 72 hours of becoming aware.

GDPR (Regulation 2016/679/EU) applies directly. Law no. 190/2018, published in Official Gazette no. 651/26.07.2018 and applicable from 31 July 2018, provides the national implementing measures required or permitted by the GDPR, including derogations and further specifications for Romania.

ANSPDCP (National Supervisory Authority for Personal Data Processing) is Romania's independent data protection authority, established by Law no. 102/2005. It handles complaints, conducts investigations, and issues corrective measures and fines for GDPR and Law 190/2018 violations, with enforcement actions documented through at least January 2026.

Law 190/2018 imposes additional requirements for processing national identification numbers and special-category data (genetic, biometric, health). Processing of health/biometric data for automated decision-making or profiling requires explicit consent or an express legal basis; a DPO must be designated where a national ID number is processed on legitimate-interest grounds.

Law 190/2018 permits workplace video surveillance only where the employer's legitimate interests outweigh employees' rights. Employees must receive clear prior notification and the employer must consult the trade union or employee representatives before deploying monitoring measures.

Law no. 506/2004 implements Directive 2002/58/EC (ePrivacy) for electronic communications. It requires prior opt-in consent for cookies (with narrow technical-necessity exemptions) and for unsolicited e-marketing, and obliges electronic communications providers to notify ANSPDCP of personal data breaches without undue delay.

GDPR's standard fine tiers (up to €20 million or 4% of global turnover) apply in Romania. Law 190/2018 caps fines on public authorities at RON 200,000 (~€43,000). ANSPDCP has issued sanctions against banks (e.g., Raiffeisen Bank €150,000 for a data breach), marketing firms, and high-profile individuals (e.g., RON 50,000+ fine against Călin Georgescu in July 2025 for unlawful data collection).