Romania

Romania's national add-on is Law 190/2018, in force since 31 July 2018. It does not change who is covered. It adds duties on top for particular kinds of data use. Two Romanian points matter. First, Law 190/2018 defines 'public authorities and bodies' very widely. It expressly treats religious units and public-benefit associations and foundations as public bodies. That pulls them into the softer penalty track. Second, gambling has a real requirement for someone on the ground. An operator licensed elsewhere in the European Economic Area or Switzerland that serves Romanian players must appoint an authorised representative. That representative's tax home or registered seat must be on Romanian territory. They must be able to act before Romanian authorities.

Industry by industry, checked on 18 August 2026. BANKING, PAYMENTS, INSURANCE AND SECURITIES: we found no rule forcing data to stay in the country. Romania brought in the European digital resilience rules by emergency ordinance in March 2026. It named the central bank and the financial supervisory authority as enforcers. Those rules make you know and disclose where your provider handles data, and be able to exit. They do not require the data to be in Romania. HEALTH: we found no rule forcing data to stay in the country on official sources, checked 18 August 2026. The national health insurance house runs the electronic health record centrally. That is a state system, not a duty on private firms. TELECOM: no rule forcing data to stay in the country. Unusually, there is no duty to keep call records either. GOVERNMENT: the Government Cloud Platform is built and run by state bodies on Romanian territory. Public institutions are being moved onto it. Treat public-sector work as staying in the country by default. GAMBLING: a strict rule, see below. EDUCATION, ONLINE RETAIL, SOCIAL MEDIA: we found no industry rule. DEFENCE AND CLASSIFIED MATERIAL: Romania runs a separate approval process for classified information systems. We did not check it this time. MAPPING AND GEOSPATIAL: we found no rule, low confidence. The gambling rule is the real one. The technical rules require the 'safety server' and the 'mirror server' to be on Romanian soil. Every transaction must reach the safety server within 24 hours. The data must stay there in its original form for at least six years. The game server itself may sit anywhere in the European Union, the European Economic Area or Switzerland. So it is a copy-in-country rule, not a total ban on handling data abroad.

Romania uses the European system: an approved list of countries, plus approved paperwork for everywhere else. The list is well populated. It covers Andorra, Argentina, Brazil, Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom and Uruguay. The United States counts only for companies that have self-certified under the European Union - United States Data Privacy Framework. The 2021 standard contract clauses are still the set in use and have not been amended. New clauses were promised for recipients already directly covered by the Regulation. They are still not adopted. You are still expected to write a transfer risk assessment. Clauses you write yourself need the Romanian supervisory authority's approval first. One point is worth knowing. European guidance finalised in June 2025 says an order from a non-European government is not by itself a lawful reason to hand data over. The item most likely to change is the European Union - United States arrangement. It is valid today. But it is under appeal at the European Court of Justice. In July 2026 the European Data Protection Board formally asked the Commission to look at it again. Do not make it your only route.

Here is the evidence that it works, from the authority's own site. On 1 July 2026 it issued a fine of 57,839 lei, about 11,000 euros. France's regulator had handed Romania the lead in that case. On 20 March 2026 it issued fines of 10,190 lei and 5,095 lei. Those were for filming employees with body cameras without telling them. It published further penalties dated 2, 17 and 31 July and 6 August 2026. The authority is headed by a president, Ancuta Gianina Opre. Two enforcement gaps are worth naming. First, public bodies get a warning and a written repair plan before any fine. Their fines are capped at 200,000 lei, roughly 45,000 dollars. Second, and more striking, Romania's Court of Accounts reported on the National Gambling Office in February 2025. It had never actually connected to or monitored the safety and mirror servers it makes operators install. So the country's strictest data-location rule has been largely unpoliced. The rule is in force. The policing of it is not.

The thirty-day limit on workplace monitoring data is the one that surprises people. Law 190/2018 makes it absolute. The only exceptions are where a specific law says otherwise, or the case is strongly justified. On the minimum side, Accounting Law 82/1991 sets the ten-year rule and the fifty-year payroll rule. A 2023 change allows payroll registers to be kept only five years. That applies where the employer has filed the matching declarations with the pension authority. We flag that as needing confirmation against the consolidated text. Telecoms traffic data must be erased or made anonymous once it is no longer needed to carry the communication. The exception is billing. There you may keep it until the claim is time-barred. Where a minimum and a maximum collide, the minimum usually wins. The law that creates it is the legal duty that justifies keeping the data. But that only rescues the specific records the law names. It does not rescue everything else sitting in the same database. Law 190/2018 also makes writing down your keeping periods a formal condition, not just good practice. That applies whenever you rely on your own business interests to handle someone's national identification number. It also applies when you handle data in the public interest.

The privacy regulator publishes two separate breach forms on its own site. One is for the General Data Protection Regulation. The other is for Law 506/2004. That is the practical proof that the two sets of rules run side by side. One does not absorb the other. Companies providing public electronic communications services must notify without delay under Law 506/2004. The detailed European rules on that notification set a 24-hour first deadline. The cyber security clocks come from Emergency Ordinance 155/2024. It brought in the European network and information security directive on 30 December 2024. Law 124/2025 approved it with changes in July 2025. Two orders of the National Cyber Security Directorate made it work from 20 August 2025. Those orders also opened a 30-day window for organisations to register themselves. We report the 24 hour, 72 hour and one month deadlines as the deadlines of the European directive. We could not open the Romanian text directly, because the directorate's site blocks automated access. So treat the exact Romanian wording as unconfirmed. The most common failure here is a single incident-response plan written to one deadline. If you are a bank that is also an essential organisation and you lose customer records, all four clocks start at once.

On trap two, the trigger is broader than people expect. Romanian law treats several numbers as 'national identification numbers'. They are the personal numeric code, identity card series and number, passport number, driving licence number and health insurance number. Using any of them on a business-interests basis brings four conditions, all at once. You need technical and organisational measures aimed at collecting as little as possible. You need a named data protection officer. You need written storage and deletion deadlines. And you need regular training for the staff who touch the data. Almost every Romanian contract, invoice and HR file carries the personal numeric code. So this quietly catches a lot of foreign employers. On trap three, the softer treatment also covers religious units and public-benefit associations and foundations. Romanian law treats them as public bodies. On trap four, the Constitutional Court struck down the 2012 record-keeping law in July 2014. In May 2022 it repeated that Parliament had still not replaced it. That is a gap in what evidence exists, not a privacy win. Parliament can close it at any time. Trap five has a criminal edge too. The Court of Accounts referred parts of gambling supervision to prosecutors in 2025. So this is not a purely administrative area.

Powers that already exist matter more here than pending bills. Romania has three. First and largest: the government legislates by emergency ordinance as a matter of routine. Both the cyber security rules and the financial resilience rules arrived that way. They were in force on publication, with Parliament approving later. So a rule keeping data in the country, or a new record-keeping duty, could appear overnight with no consultation. Second: Parliament can pass a new telecoms record-keeping law at any time. The Constitutional Court has twice noted that there is none. Any replacement would land on providers immediately. Third: the gambling regulator sets the technical rules for the safety and mirror servers by order of its president, not by statute. So what those servers must capture, and how fast, can change with no legislative process. Watch two European items as well. One is the cloud certification scheme, still not adopted. The other is the June 2026 European cloud and artificial intelligence proposal. Both would push public-sector work further towards hosting inside the country. Neither has legal effect today. We found no Romanian bill in progress that would force ordinary businesses to keep data in the country, checked 18 August 2026.