Data breach notifications were firstly introduced in 2009 by means of amendments to the E-Privacy Directive, where such data breaches occurred in connection with the provision of publicly available electronic communications service.

On March 14, 2018 the Romanian law for implementing measures on EU Regulation no. 2016/679 on the protection of individual rights with regard to the processing of personal data ...

Kindly be informed that over the past days a Corrigendum Deed amending several provisions of EU Regulation No. 2016/679 on the protection of individual rights with regard to the processing...

In preparation for the EU General Data Protection Regulation ("GDPR"), which comes into force in May 2018, Romania has updated its Classification of Occupations (COR) to include data protection officers (DPOs).

A first benchmark in such roadmap consists of the appointment of a Data Protection Officer ("DPO").

On 26 March 2012, Decision no. 23 issued by the Romanian Supervisory Authority for Personal Data Processing ("DPA") came into force (the "Decision").

On 24 June Law no. 129/2018 entered into force.

Decision no. 161/09/10/2018 of The National Supervisory Authority for Personal Data Processing, on the approval of the Investigations Procedure entered into force on the 23rd of October 2018, in accordance with ...

With 2018 just around the corner and the European Union setting a clock on raising the standards of personal data protection, companies are starting to prepare themselves for new challenges.

A draft legislation laying down measures in relation to the GDPR (the "Draft Law") has just been put forward for discussion in the Romanian Parliament.

In a recent enforcement action that should serve as a cautionary tale for gambling operators, the Lithuanian Data Protection Authority ("VDAI") sanctioned an online gambling...

The highly anticipated revisions to the EU legal regime for data protection have now been adopted following the publication of the official texts of the General Data Protection Regulation and Data Protection Directive.

The gaming industry sits at the intersection between a consumer base that generates large quantities of personal data, and an increasingly sophisticated regulatory framework that empowers individuals to demand access to that data.

In a recent sanctioning decision, the Romanian Data Protection Authority (“ANSPDCP”) applied multiple administrative fines to a natural person, amounting to a total of EUR 10,000.

On 27 June 2018 the legislative proposal for implementing the GDPR measures in Romania was adopted by the Romanian Parliament.

May 2026 – Romania is taking a significant step towards bringing its cookie consent rules into line with the standards established under the General Data Protection Regulation (GDPR)...

Data protection under the General Data Protection Regulation (GDPR) is set to be strengthened with the European Data Protection Board (EDPB) releasing its Guidelines 01/2025 on Pseudonymisation on January 16, 2025.

A group of undertakings may decide to appoint a single DPO, but only as long as each establishment can easily and efficiently communicate with the DPO.

As May 2023 marks the fifth anniversary of the implementation of GDPR[1], we have prepared an overview of the five years of regulatory struggle in Romania since the regulation came into effect.

Based on the information published by ANSPDCP, in the first four months of 2023, 1565 complaints, referrals and notifications of security incidents were received.