Strictly necessary

Make the site work and remember your choice here. They cannot be turned off.

Always on

Analytics

Show us how the site is used, so we can improve it.

Marketing

Let us measure how well our advertising campaigns perform.

+40 (744) 368 368office@bsa.roStr. Belgrad 10, Sector 1, 011804Buju, Stanciu & Asociații is a member of Interlegal and Legal Network International

Data Protection (GDPR)

By Buju, Stanciu & Asociații

GDPR in Romania: what companies processing personal data must comply with

Compliance with personal data protection rules is no longer a whim or a concern reserved for large EU companies. In 2024 and, certainly, in the years to come, GDPR in Romania is a hot topic, whether we are talking about tech start-ups, medical clinics, recruitment agencies or online shops.

In this article we explain what you need to know about your obligations as a company processing personal data and how a GDPR lawyer can help you avoid hefty fines and build a business reputation that respects the confidentiality of clients and employees.

What exactly does GDPR mean?

GDPR is the acronym for the General Data Protection Regulation, a European piece of legislation that entered into force in May 2018. Although it applies across the EU, each country (including Romania) has its own authority overseeing its implementation - in our case, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (National Supervisory Authority for Personal Data Processing - ANSPDCP).

The GDPR has a clear objective: to give individuals control over the way their personal data is collected, stored and used - such as their name, personal identification number, email address, IP address or even their voice and image.

Who must comply with the GDPR?

The short answer: every company that processes personal data in a professional context. That means that, in practice, almost any company has to meet the GDPR requirements:

  • If you have employees and collect their data (contracts, salaries, medical information)
  • If you have a website that uses cookies or contact forms
  • If you send newsletters or collect customer feedback
  • If you use video surveillance cameras at your premises
  • If you outsource HR or marketing services

All of these activities involve the processing of personal data and, consequently, the application of the GDPR.

The most important GDPR obligations for companies

  • Informing data subjects
    Clients, employees or partners must be informed, clearly and accessibly, about what data you collect, for what purpose, how long you keep it and to whom you may disclose it. A privacy policy is mandatory, but it is not enough - the language used must be understandable to anyone.
  • Obtain consent where required
    For certain processing operations (for example, sending newsletters or targeted marketing), you need the express consent of the individual. Consent must be freely given, specific and documented.
  • Minimising the data collected
    You may not collect more information than you actually need. If you have a contact form on your website, do not ask for a personal identification number or a physical address where these are not relevant to the purpose of the communication.
  • Securing the data
    The data collected must be stored securely, whether on servers, cloud platforms or in physical files. Access must be restricted and protected, and in the event of a security breach you are required to notify the authorities and, in some cases, the individuals affected.
  • Concluding contracts with third parties
    If you work with suppliers (e.g. accounting firms, email marketing platforms), you need clear GDPR contracts with them, imposing data protection obligations on them.
  • The rights of data subjects
    Any individual has the right to access, rectify or erase their data. Your company must have clear internal procedures in place to respond to such requests within the legal deadline.

When do you need a GDPR lawyer?

If the list above looks long, you are right. The GDPR is not a matter of copying and pasting from the internet. It has many nuances and must be applied according to your field of activity and your company's actual workflows.

A GDPR lawyer is the trusted partner who can:

  • Carry out a GDPR audit to assess your current level of compliance
  • Draft or review privacy policies, contracts and internal procedures
  • Prepare training sessions for employees
  • Provide assistance in the event of ANSPDCP inspections or complaints from clients
  • Ensure the implementation of technical and organisational security measures

In short, a specialist lawyer helps you prevent rather than cure. And given that fines can reach up to 4% of turnover, prevention is the best strategy.

What happens if you do not comply with the GDPR?

According to ANSPDCP statistics, fines and penalties are on the rise. The most frequent shortcomings identified include:

  • lack of valid consent
  • failure to properly inform data subjects
  • failure to secure the data collected
  • failure to observe the right to erasure

In addition to fines, non-compliance with the GDPR can seriously damage your reputation and your clients' trust - a cost far harder to put a figure on.

Conclusion: the GDPR is about trust, not just paperwork

In 2025, consumers are increasingly attentive to how their data is protected. The companies that take this responsibility seriously and handle the matter professionally are the ones that will win the market's trust.

Buju, Stanciu & Asociatii offers full legal advisory services in data protection matters. Whether you need a GDPR audit, the drafting of the necessary documentation or representation before the authorities, our team can support you with clear and effective solutions.