WHAT IS TO BE DONE BY DATA CONTROLLERS?
On September 21st, 2017, the National Supervisory Authority for
Personal Data Processing ("RDPA") published on its
website a Guidance regarding the application of the General Data
Protection Regulation (the "Guidance"), for the benefit
of the data controllers performing personal data processing
activities that fall under the jurisdiction of the Romanian
law.
The Guidance essentially provides a summary roadmap that must be
followed by such data controllers in order to ensure their
compliance with the GDPR requirements of the personal data
processing operations which they perform.
A first benchmark in such roadmap consists of the appointment of a Data Protection
Officer ("DPO"). Even though the GDPR
expressly provides an obligation to appoint a DPO only in certain
situations or to certain data controllers, RDPA recommends that any
entity should appoint such DPO, as it represents a major advantage for the
data controller in
