Romania. Comprehensive data protection. Act
Law 190/2018Law No. 190/2018 on measures implementing Regulation (EU) 2016/679
Partly verified
Medium confidence.legislatie.just.ro document ID not re-verified.
§1Summary
- Synopsis
Romania's Law 190/2018 adds national rules to the GDPR on national identification numbers, employee monitoring, health and genetic data, and sanctions for public bodies.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 16 (no national derogation). Employee electronic monitoring allowed only for legitimate interests with conditions and 30-day retention cap; public authorities first warned then fined up to RON 200,000; DPO needed for processing of national ID numbers on legitimate interest.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover; public bodies up to RON 200,000
§3Dates
- Key dates
- Adopted
- In force
- Monitorul Oficial 651/26.07.2018
§4Text and authority
- Text
- Authoritative text legislatie.just.ro
- English text dataprotection.ro
- Authority
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
§5Where it applies
- Domestic law of
- Romania
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.legislatie.just.ro document ID not re-verified.