What Is GDPR + Law No. 190/2018 on measures for implementing Regulation (EU) 2016/679?
Law No. 190/2018 on measures for implementing Regulation (EU) 2016/679 was published in Monitorul Oficial No. 651 on 26 July 2018 and entered into force 31 July 2018, five days after publication. The law is not currently in force exactly as originally enacted: Law No. 233/2019 amended Article 8(1), the research/statistical-processing derogation, and the current text no longer lists GDPR Article 20 (portability) among the rights that can be disapplied for that purpose — a material change from the original text that any current description must reflect. Law No. 102/2005, which establishes and governs ANSPDCP, is likewise a republished and consolidated text, not the original 2005 version, having been substantially amended and republished by Law No. 129/2018; Law No. 190/2018 also modified its sanction provision. No later direct amending act to Law No. 190/2018 itself has been located in the official portal materials reviewed.
At a glance
- Full name
- GDPR + Law No. 190/2018 on measures for implementing Regulation (EU) 2016/679
- Short code
- Romania GDPR + Law 190/2018
- Jurisdiction
- Romania
- Enacted
- 2018
- Last major update
- Law No. 233/2019 amended Article 8(1)'s research/statistical derogation, removing GDPR Article 20 portability from the list of disapplied rights; Law No. 102/2005 (ANSPDCP's establishing statute) is amended and republished, notably by Law No. 129/2018
- Regulator
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- Private right of action
- Yes
- Statutory citation
- Law No. 190/2018 on measures for implementing Regulation (EU) 2016/679
Scope, who Romania GDPR + Law 190/2018 covers
Protected data
Data subject rights
Access (GDPR Art. 15), restricted by Article 7 (qualifying journalism/academic/artistic/literary expression) and Article 8(1)-(2) (research/statistics, public-interest archiving)
Rectification (GDPR Art. 16), expressly included in the Article 8(1) research/statistics derogation
Erasure (GDPR Art. 17), not expressly listed in the current Article 8(1) or 8(2) derogations
Restriction (GDPR Art. 18)
Objection (GDPR Art. 21), with direct-marketing objection honored unconditionally
Portability (GDPR Art. 20), removed from the Article 8(1) research/statistics derogation by the 2019 amendment, though still listed under Article 8(2) for public-interest archiving
Complaint to ANSPDCP
Notable features
Romania's Article 5 sets specific conditions for workplace electronic-communications monitoring and video surveillance — prior notice, consultation, necessity of less-intrusive measures, proportional retention, and a normal 30-day retention limit — a workplace-processing rule, not a blanket removal of data-subject rights. ANSPDCP accepts complaints in either Romanian or English, unlike several other jurisdictions in this dataset that require the national language or only conditionally accept translations.
Enforcement & penalties
Regulator: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Penalties: GDPR Article 83 applies generally: up to €10M or 2% of worldwide turnover for Art. 83(4), up to €20M or 4% for Art. 83(5)-(6). Law No. 190/2018 makes GDPR Article 83(4)-(6) violations contraventions, with warning and fine as principal sanctions. For public authorities and public bodies specifically, the law sets Romania-specific fixed ranges: 10,000-100,000 lei for the Article 14(2)-(3) categories, and 10,000-200,000 lei for the Article 14(5) categories and non-compliance with an ANSPDCP decision under Article 14(7). Law No. 102/2005 provides that GDPR fines expressed in euros are applied and paid in lei at the official BNR exchange rate on the date of application. No separate universal Romanian fixed-fine schedule for ordinary private-sector controllers beyond GDPR Article 83 was located.
Private right of action: GDPR Article 82 grants a right to compensation. ANSPDCP's published procedure permits complaints in writing, in Romanian or English, personally or through a representative, via registry, postal, or electronic submission. The procedure has staged deadlines — a maximum 45-day admissibility determination, a progress/result notice within 3 months of admissibility, further 3-month update cycles during extended investigation, and 45 days after investigation completion for a final result — but no official source establishes a single unconditional deadline for a final merits decision.
Relevance to data brokers
No broker-specific complaint or deletion route, CNP or national-ID-registry opt-out mechanism, or general public-record suppression registry has been located. ANSPDCP's own published clarification states it does not directly own or access databases managed by public or private entities, and directs individuals to exercise their rights against the specific operator responsible for the data — the ordinary route is to exercise the applicable GDPR right with that controller directly, then complain to ANSPDCP if the response is absent or unsatisfactory.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does Romania grant a right to data portability under the research/statistics exception?+
No, not since Law No. 233/2019 amended Article 8(1): the current research/statistical-processing derogation excludes GDPR Articles 15, 16, 18, and 21 but no longer lists Article 20 portability — a material change from the original 2018 text that any current description must reflect.
Can I file a complaint with ANSPDCP in English?+
Yes. ANSPDCP's published procedure permits complaints in writing in either Romanian or English, personally or through a representative, submitted via registry, post, or electronic means.
How long does ANSPDCP take to resolve a complaint?+
The procedure has staged deadlines: a maximum 45-day admissibility determination, a progress or result notice within 3 months of admissibility, further 3-month update cycles during extended investigation, and 45 days after investigation completion for a final result. No single unconditional deadline for a final merits decision has been located.
Official sources & citations
Other international privacy regimes
Romania GDPR + Law 190/2018 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: