Romania

Tier 2 Comprehensive law Europe

Principal framework: GDPR + Law 190/2018 (2018). Regulator: ANSPDCP. Criticised narrow journalism exemption; national ID (CNP) restrictions.

At a glance

Criminal offences: No dedicated data protection offence carrying custody
Public-sector fines: Capped
Principal law: Legea nr. 190/2018 privind măsuri de punere în aplicare a Regulamentului (UE) 2016/679 [Law No. 190/2018 on implementing measures for Regulation (EU) 2016/679]
Regulator: The National Supervisory Authority for Personal Data Processing (ANSPDCP)
Breach notification: 72 hours to the supervisory authority (Art 33); undue-delay notice to individuals at high risk
Maximum penalty: Up to €20m or 4% of global annual turnover
DPO required: Public authorities; large-scale regular monitoring or special-category processing (Art 37)
Digital consent age: 16
Extraterritorial reach: Yes — targeting or monitoring people in the EU (Art 3(2))
National implementing act: Law 190/2018

Structure

Structural pattern: Not assessed
Sub-jurisdictions: None — no sub-national axis
ISO code: RO

A Pattern 4 jurisdiction has no sub-national layer to model. Devolution elsewhere in the legal system does not imply it here — check each Act rather than reasoning from the country.

Transfers and adequacy

EU member: Yes
EEA member: Yes
Holds EU adequacy: Yes

EU/EEA member — intra-EEA transfers need no adequacy decision.

Instruments

No instrument profiled yet.

Also applies here

Directly applicable as EU law, without national transposition. The national act supplements it rather than replacing it.

GDPR

Tier 1 · directly applicable

Regulation (EU) 2016/679 (General Data Protection Regulation)

Sources

Never independently verified — seeded from the prototype.