IN THE SPOTLIGHT

Abstract digital data background. Wave with moving dots. Musical stream of sounds. 3D .

Romanian cybersecurity authority announces first sanction for failure to comply with NIS2 registration notification requirements

On 30 September 2026, the Romanian National Cyber Security Directorate (DNSC) announced its first administrative sanction, amounting to the RON equivalent of approximately EUR 10,000, for failure to comply with the notification obligation under the Romanian NIS2 Law. The sanction was imposed on 29 September 2026 on a body of the central public administration, falling within the public administr…
This technology-inspired data abstract background is perfect for capturing the essence of the internet's vast expanse of information.

Food company fined EUR 5,000 for unlawful processing of employees’ biometric data

On 25 September 2026, the Romanian DPA concluded an investigation into a company operating in the food sector. According to the DPA, the controller had processed employees’ biometric data without a legal basis under the GDPR and had infringed the principle of data minimisation. As a result, the Romanian DPA issued an administrative fine amounting to RON equivalent of EUR 5,000. The investigatio…
AdobeStock_242262576

Retail and e-commerce company fined for unlawful marketing calls

On 8 September 2026, the Romanian DPA concluded an investigation into a company operating in the retail sector. According to the DPA, the controller committed infringements concerning the right to object to direct marketing. As a result, the DPA issued an administrative fine amounting to RON equivalent of EUR 2,000. The investigation commenced following a complaint from a data subject who repor…

ARTICLES

Cybersecurity and information or network protection. Future cyber technology web services for business and internet project

Romanian DPA Report – A Year in Review – 2025

Authors: Iurie Cojocaru, Oana Ștefan, Eduard Rașcă 
Romanian DPA case studies – our top 5 picks 1. Incomplete response to an access request involving CCTV footage Case study: A customer filed a complaint with the Romanian DPA claiming that a financial institution had failed to fully comply with an access re…

Speaking engagements

AdobeStock_469644365 [Converted]

Iurie Cojocaru attended the IAPP UK Intensive 2026 Conference

Between 23-26 February, Iurie Cojocaru, Partner and Head of the Data Protection practice attended the IAPP UK Intensive 2026, a premier gathering for professionals in the fields of privacy, artificial intelligence governance and digital responsibility. This year’s intensive showcased a broad spectrum of voices and perspectives and explored legislations, regulations, technology and operational p…
Cyber security and information network protection. Future technology network for business and internet concept. Earth element furnished by Nasa

Oana Stefan – speaker at an online debate organized by Juridice.ro

On February 9, our colleague, Oana Stefan, Associate in the Data Protection practice, was a speaker at the online debate “Online platforms, all eyes and ears. At GDPR”, organized by Juridice.ro. The debate was live on Juridice.ro. More details about the event and speakers are available here.
AdobeStock_469644365 [Converted]

Iurie Cojocaru – speaker at the GDPR Data Privacy Observer 2026 conference

On January 22, Iurie Cojocaru, Partner and Head of the Data Protection practice, was a speaker at the 5th edition of the GDPR Data Privacy Observer 2026 conference. Iurie joined the discussions in the first panel of the event and talked about the impact of the Omnibus package on data protection. Also, during the fifth edition Awards Gala organized by the Romanian Magazine for the Protection …

Statistics