On 19 August 2026, the Romanian DPA concluded an investigation into an auto repair services company. According to the DPA, the controller committed a GDPR infringement concerning the security of personal data. As a result, the DPA issued an administrative fine amounting to the RON equivalent of EUR 3,000.
The investigation was initiated following a notification submitted by the controller concerning a personal data breach. During the investigation, the Romanian DPA found that the breach had resulted from a phishing attack, which led to the compromise of the credentials of a user account with administrator privileges. This enabled unauthorised access to personal data relating to the controller’s customers, including their first and last names.
Further to its investigation, the DPA found that the controller had failed to implement appropriate technical and organisational measures to ensure an adequate level of security and had not regularly tested, assessed and evaluated the effectiveness of such measures.
In addition to the fine, the DPA ordered the controller to periodically verify compliance with its procedures concerning the protection of personal data and information security and to provide regular data protection training to persons acting under its authority. The training must specifically cover the identification and handling of phishing messages and other suspicious emails.
The press release is available here (Romanian only).
