Romania

Romania's national add-on is Law 190/2018, in force since 31 July 2018. It does not change who is covered; it adds duties on top for particular kinds of processing. Two Romanian-specific scope points matter. First, Law 190/2018 defines 'public authorities and bodies' very widely and expressly treats religious units and public-benefit associations and foundations as public bodies, which pulls them into the softer penalty track. Second, a genuine in-country personnel requirement exists in gambling: an operator licensed elsewhere in the European Economic Area or Switzerland that serves Romanian players must appoint an authorised representative whose fiscal domicile or seat is on Romanian territory, empowered to act before Romanian authorities.

Sector by sector, checked on 18 August 2026. BANKING, PAYMENTS, INSURANCE AND SECURITIES: no localisation found. Romania implemented the European digital resilience rules by emergency ordinance in March 2026, naming the central bank and the financial supervisory authority as enforcers; those rules demand that you know and disclose where your provider processes data, and that you can exit, but they do not require the data to be in Romania. HEALTH: no localisation rule found on official sources, checked 18 August 2026; the national health insurance house runs the electronic health record centrally, but that is a state system, not a duty on private firms. TELECOM: no localisation, and, unusually, no retention duty either. GOVERNMENT: the Government Cloud Platform is built and run by state bodies on Romanian territory and public institutions are being migrated onto it; treat public-sector work as in-country by default. GAMBLING: hard rule, see below. EDUCATION, ONLINE RETAIL, SOCIAL MEDIA: no sector rule found. DEFENCE AND CLASSIFIED MATERIAL: Romania runs a separate accreditation regime for classified information systems which we did not verify in this pass. MAPPING AND GEOSPATIAL: no rule found, low confidence. The gambling rule is the real wall. The methodological norms require that the 'safety server' and the 'mirror server' be located on national territory, that every transaction reach the safety server within 24 hours, and that the data stay there in original form for at least six years. The game server itself may sit anywhere in the European Union, the European Economic Area or Switzerland, so this is a mirror requirement rather than a total ban on processing abroad.

The model is an approved-list plus approved-paperwork system, and the approved list is well populated: Andorra, Argentina, Brazil, Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay, and the United States only for companies that have self-certified under the European Union - United States Data Privacy Framework. The 2021 standard contract clauses remain the operative set and have not been amended; the promised new clauses for importers already directly covered by the Regulation are still not adopted. A transfer risk assessment is still expected. Bespoke, non-standard clauses need prior authorisation from the Romanian supervisory authority. One point worth knowing: European guidance finalised in June 2025 says an order from a non-European government is not by itself a lawful reason to hand data over. The most time-sensitive item is the European Union - United States framework: it is valid today, but it is under appeal at the European Court of Justice and in July 2026 the European Data Protection Board formally asked the Commission to re-examine it. Do not build a single-route architecture on it.

Evidence of live enforcement, from the authority's own site: a fine of 57,839 lei, about 11,000 euros, on 1 July 2026 in a case where France's regulator handed Romania the lead; fines of 10,190 lei and 5,095 lei on 20 March 2026 for filming employees with body cameras without telling them; and further published sanctions dated 2, 17 and 31 July and 6 August 2026. The authority is headed by a president, Ancuta Gianina Opre. Two enforcement gaps are worth naming. First, public bodies get a warning and a written remediation plan before any fine, and their fines are capped at 200,000 lei, roughly 45,000 dollars. Second, and more striking, Romania's Court of Accounts reported in February 2025 that the National Gambling Office had never actually connected to or monitored the safety and mirror servers it requires operators to install, meaning the country's strictest data-location rule has been largely unpoliced. The rule is in force; the policing of it is not.

The thirty-day cap on workplace monitoring data is the one that surprises people, and it is written into Law 190/2018 as an absolute unless a specific law says otherwise or the case is strongly justified. On the floor side, Accounting Law 82/1991 sets the ten-year rule and the fifty-year payroll rule; a 2023 amendment allows payroll registers to be kept only five years where the employer has filed the corresponding declarations with the pension authority, which we flag as needing confirmation against the consolidated text. Telecoms traffic data must be erased or anonymised once it is no longer needed to carry the communication, except for billing, where it may be kept until the claim is time-barred. Where a floor and a ceiling collide, the floor generally wins, because the law creating it is the 'legal obligation' that justifies keeping the data - but that logic only rescues the specific records the law names, not everything sitting in the same database. Law 190/2018 also makes writing down retention periods a formal condition, not just good practice, whenever you rely on legitimate interests to handle someone's national identification number or you process in the public interest.

The privacy regulator publishes two distinct breach forms on its own site, one for the General Data Protection Regulation and one for Law 506/2004, which is the practical proof that the two regimes run in parallel rather than one absorbing the other. Providers of publicly available electronic communications services must notify without delay under Law 506/2004, with the detailed European rules on that notification setting a 24-hour initial deadline. The cyber security clocks come from Emergency Ordinance 155/2024, which transposed the European network and information security directive on 30 December 2024, was approved with changes by Law 124/2025 in July 2025, and was operationalised by two orders of the National Cyber Security Directorate on 20 August 2025 that also opened a 30-day window for entities to register themselves. We report the 24 hour, 72 hour and one month deadlines as the transposed directive deadlines; we could not open the Romanian text directly because the directorate's site blocks automated access, so treat the exact Romanian wording as unconfirmed. The most common operational failure here is a single incident-response runbook written to one deadline. If you are a bank that is also an essential entity and you lose customer records, all four clocks start at once.

On trap two, the trigger is broader than people expect. Romanian law treats the personal numeric code, identity card series and number, passport number, driving licence number and health insurance number all as 'national identification numbers'. Using any of them on a legitimate-interests basis brings four cumulative conditions: technical and organisational measures aimed at data minimisation, a named data protection officer, written storage and deletion deadlines, and periodic training for the staff who touch the data. Since almost every Romanian contract, invoice and HR file carries the personal numeric code, this quietly catches a lot of foreign employers. On trap three, the softer regime also covers religious units and public-benefit associations and foundations, which are treated as public bodies. On trap four, the Constitutional Court struck down the 2012 retention law in July 2014 and repeated in May 2022 that the legislator had still not replaced it; that is a gap in evidence availability, not a privacy win, and it can be closed by Parliament at any time. Trap five carries a criminal edge too: the Court of Accounts referred aspects of gambling supervision to prosecutors in 2025, so this is not a purely administrative area.

Dormant switches matter more here than pending bills, and Romania has three. First and largest: the government legislates by emergency ordinance as a matter of routine. Both the cyber security framework and the financial resilience rules arrived that way, in force on publication, with Parliament approving later. A localisation or retention duty could therefore appear overnight with no consultation. Second: Parliament can re-enact a telecoms data retention law at any time. The Constitutional Court has twice noted the absence of one, and any replacement would land on providers immediately. Third: the gambling regulator sets the technical procedure for the safety and mirror servers by order of its president rather than by statute, so what those servers must capture, and how fast, can be changed without any legislative process. Watch also the still-unadopted European cloud certification scheme and the June 2026 European cloud and artificial intelligence proposal, both of which would push public-sector work further towards in-country hosting; neither has legal effect today. We found no Romanian bill in progress that would impose data localisation on ordinary businesses, checked 18 August 2026.