A GDPR data breach in Romania creates an immediate legal decision window. The company must contain the incident, determine whether personal data were compromised, assess the risk to individuals and decide whether the Romanian supervisory authority, the ANSPDCP, must be notified within 72 hours.

This guide is designed for Romanian companies, foreign investors, directors, compliance teams and data protection officers responding to an actual or suspected incident. It should be used together with an incident-specific legal and technical assessment. For preventive support and breach response, see our data protection services in Romania.

What qualifies as a personal data breach?

Article 4(12) of the General Data Protection Regulation defines a personal data breach as a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data. The concept is wider than a cyberattack and covers confidentiality, integrity and availability incidents.

A security event that does not involve personal data is not a personal data breach under GDPR. Conversely, a small incident can still be a breach. Under the data protection rules applicable in Romania, the number of affected people matters, but so do the sensitivity of the data, the ease of identification, the possible consequences and the vulnerability of the people concerned.

When does the 72-hour notification period start?

Article 33 requires notification without undue delay and, where feasible, no later than 72 hours after the controller becomes aware of the breach. According to the EDPB breach-notification guidelines, awareness exists when the controller has a reasonable degree of certainty that a security incident occurred and led to personal data being compromised.

A brief initial investigation may be necessary to determine whether personal data were actually affected. That does not permit an organisation to delay investigation or postpone escalation. Once there is reasonable certainty, the clock runs even if the full cause, exact number of records or final consequences are still being investigated.

Do not wait for a final forensic report before making the legal notification decision. Article 33 expressly permits phased notification when all information cannot be provided at the same time.

Must every breach be notified to the ANSPDCP?

No. Every breach must be recorded internally, but not every breach must be reported to the authority. The controller must assess the likely impact on the rights and freedoms of natural persons. The result falls into one of three practical levels.

Risk is not determined by a single formula. The company should consider the type of breach, nature and volume of data, identifiability, severity and likelihood of consequences, number and characteristics of affected people, and the effectiveness of safeguards such as encryption. The EDPB’s practical breach examples are useful benchmarks, but the actual incident must be assessed on its own facts.

What must an ANSPDCP notification contain?

Article 33(3) establishes the minimum information. The ANSPDCP’s current online notification form requests additional operational details that allow the authority to understand the incident and the controller’s response.

If exact figures are not yet available, provide reasonable estimates and state that the investigation continues. Under Article 33(4), missing information may be supplied in phases without undue further delay. If the filing occurs after 72 hours, it must include reasons for the delay.

How is a breach notified in Romania?

The ANSPDCP maintains a dedicated personal data breach notification page with access to its online form. Before submission, the company should identify the correct controller, confirm whether the incident also affects other group entities or joint controllers, and determine whether the ANSPDCP is the competent or lead supervisory authority for any cross-border processing.

The notification should be consistent with the internal breach register, technical evidence, communications plan and any supplemental filing. A company should not understate confirmed facts, speculate beyond the evidence or present an incomplete notification as final.

Who should be involved in the response?

A data breach cannot be handled by IT alone. The legal assessment depends on verified technical facts, while technical containment must preserve evidence and avoid creating inconsistent records. A small decision team should be activated immediately, with clear authority and one incident chronology.

• Security and IT: containment, forensic preservation, affected-system analysis, eradication, recovery and evidence of technical safeguards.
• DPO and legal counsel: awareness timestamp, controller or processor status, risk assessment, authority competence, notification drafting and privilege strategy where applicable.
• Management and communications: decision authority, resources, operational continuity, messaging and escalation to insurers or relevant corporate bodies.
• Processors and vendors: incident facts, contractual notification, audit cooperation, subprocessor information and coordinated remedial action.

What is the difference between a controller and a processor?

The controller decides why and how personal data are processed and carries the Article 33 duty to notify the competent supervisory authority. A processor must notify the controller without undue delay after becoming aware of a personal data breach. GDPR does not give processors a separate 72-hour period for notifying the controller.

Data processing agreements should therefore establish an immediate escalation channel, minimum incident information, continuous updates, preservation duties and cooperation with notifications and communications. A processor’s delayed or incomplete report does not remove the controller’s obligation once the controller becomes aware.

Vendor and technology contracts should be reviewed before an incident occurs. Our IT law services in Romania cover data-processing terms, security obligations, audit rights and incident-response clauses.

When must affected individuals be informed?

Under Article 34, the controller must communicate the breach to affected individuals without undue delay when it is likely to result in a high risk to their rights and freedoms. This obligation is separate from the 72-hour authority-notification rule. The communication must use clear and plain language and explain the nature of the breach, the contact point, likely consequences and measures taken or proposed.

Communication is not required when one of the Article 34(3) conditions applies:

• appropriate protection measures applied to the affected data and made them unintelligible to unauthorised persons, such as effective encryption;
• subsequent measures ensure that the high risk is no longer likely to materialise; or
• individual communication would involve disproportionate effort, in which case a public communication or similarly effective measure is required.

The message should help people protect themselves. Depending on the incident, practical steps may include changing credentials, enabling multi-factor authentication, contacting a bank, monitoring accounts, watching for targeted phishing or using a dedicated support contact. Avoid minimising the event or overwhelming recipients with technical detail.

How should breach risk be assessed?

The legal threshold concerns risk to people, not only damage to the company. Business interruption, contractual liability and reputational harm matter to the response, but they do not replace the individual-rights analysis required by Articles 33 and 34.

High-risk indicators include sensitive or criminal-offence data, authentication credentials, detailed financial or identity information, data concerning children or other vulnerable people, large-scale exposure, malicious exfiltration, weak safeguards and consequences that are difficult for individuals to reverse. Effective encryption, rapid verified retrieval from a trusted recipient and prompt credential revocation may reduce risk, but each control must be tested against the facts.

What evidence and documentation should be preserved?

Article 33(5) requires the controller to document every personal data breach, including the facts, effects and remedial action. The record must allow the supervisory authority to verify compliance. A defensible incident file should include:

• the original alert, detection data and a precise incident chronology;
• the awareness timestamp and the facts supporting it;
• affected systems, processing activities, data categories, people and record estimates;
• logs, forensic images, access records, emails, vendor reports and chain-of-custody information where relevant;
• containment, eradication, recovery and mitigation actions;
• the risk and high-risk assessments, including reasons and assumptions;
• the decision to notify or not notify, approvals and any delay explanation;
• copies of the initial and supplemental ANSPDCP filings;
• data-subject communications or the documented Article 34 exception; and
• post-incident findings, corrective actions and responsibility for completion.

Records should distinguish confirmed facts from estimates and hypotheses. The company should also consider cybersecurity, contractual and insurance requirements, DORA and other sector-specific reporting duties, and criminal-law reporting duties. These may use different thresholds and deadlines from GDPR.

A practical 72-hour response checklist

1. Activate the incident team. Establish one decision lead, secure communications and a contemporaneous chronology.
2. Contain without destroying evidence. Isolate affected resources, revoke compromised access and preserve logs and forensic material.
3. Confirm whether personal data are involved. Identify the controller, processor, systems, processing activities and data flows.
4. Record the awareness timestamp. Explain when reasonable certainty was reached and what facts supported it.
5. Map the scope. Identify data categories, affected people, approximate record volumes, jurisdictions and vulnerable groups.
6. Assess risk to individuals. Analyse likelihood, severity, safeguards, realistic misuse and reversibility of harm.
7. Decide on authority notification. Notify unless the breach is unlikely to create risk. Use phased notification if necessary.
8. Assess high risk separately. Decide whether individuals must be informed and prepare clear protective guidance.
9. Coordinate other duties. Review processors, insurers, contractual partners, cybersecurity rules and sector regulators.
10. Continue and close the response. Supplement filings, verify recovery, complete remediation and retain the breach record.

For a broader preventive review, use our GDPR compliance checklist for Romanian companies. Even though the checklist was published earlier, the core governance controls remain relevant and should be checked against current processing and security practices.

Frequently asked questions

Legal disclaimer: This article provides general information and does not constitute legal advice. The applicable response depends on the facts, the company’s role, the data and individuals affected, the competent authority and any sector-specific obligations. Obtain advice for the specific incident.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.

Employee dismissal in Romania is lawful only when the employer relies on a ground recognised by the Labour Code and follows the procedure attached to that specific ground. A genuine business reason is not enough if the required notice, investigation, evaluation, consultation or written decision is defective.

This guide is intended for Romanian companies, foreign investors, HR teams and managers considering an individual or collective dismissal. It reflects the structure of the Romanian Labour Code and highlights the points that most often create litigation risk. For advice on a particular case, see our Romanian employment law services.

Is every employment termination a dismissal?

No. Under Article 58 of the Romanian Labour Code, dismissal is the termination of an individual employment contract at the employer’s initiative. It may be based on reasons related to the employee or on reasons unrelated to the employee.

Dismissal should not be confused with termination by mutual agreement, resignation, expiry of a fixed-term contract, termination by operation of law or written termination during or at the end of a probationary period under Article 31(3). Termination during the probationary period is a distinct mechanism, separate from dismissal. Each route has different conditions. Relabelling a unilateral dismissal as a “mutual termination” does not make it consensual; genuine agreement must exist.

Legal grounds for employee dismissal in Romania

The main grounds are divided between reasons related to the employee and reasons unrelated to the employee. The required evidence and procedure differ substantially.

When is dismissal prohibited?

Before any employee dismissal in Romania, the employer should check both Articles 59 and 60 of the Labour Code. Article 59 prohibits dismissal on protected grounds, including protected characteristics, trade-union membership or activity, lawful participation in a strike and the exercise of specified employment rights. Article 60 creates temporary prohibitions during specified periods, including certified temporary incapacity for work, quarantine, maternity leave, parental leave, leave to care for a sick child, annual leave, paternity leave, caregiver leave and certain emergency family absences. A pregnant employee is protected if the employer knew of the pregnancy before issuing the decision. Separate anti-discrimination and retaliation rules may also apply under Law no. 202/2002 and the Whistleblower Protection Law no. 361/2022.

The protected-period analysis should be made immediately before the dismissal decision is issued and communicated. Article 60 also contains an exception linked to judicial reorganisation, bankruptcy and dissolution of the employer, but it should be applied only after checking the employer’s precise legal status and the special insolvency rules.

Does every dismissed employee receive 20 working days’ notice?

No. Article 75 grants a minimum notice period of 20 working days for dismissal due to medical unfitness, professional inadequacy and redundancy under Articles 65 and 66. It does not create a universal notice period for every type of dismissal. In particular, disciplinary dismissal does not carry the same statutory notice entitlement.

The notice period and its start date should be documented clearly. Employers should not assume that paying an equivalent amount automatically remedies a failure to observe the statutory notice period. If the parties want a negotiated exit with compensation, that should be structured separately as a genuine mutual termination agreement.

How does disciplinary dismissal work?

Employee dismissal in Romania based on misconduct is the most procedure-sensitive route. Before imposing it, the employer must ordinarily conduct the prior disciplinary investigation regulated by Article 251. The process should include a written summons specifying the subject, date, time and place of the meeting, a real opportunity for the employee to present explanations and evidence, and a documented assessment of the defence.

The sanction must also be proportionate. Article 250 requires the employer to consider factors such as the circumstances of the misconduct, degree of fault, consequences, the employee’s general conduct and any previous disciplinary sanctions. A finding that misconduct occurred does not automatically justify dismissal if a lesser sanction is proportionate.

The disciplinary decision must be issued in writing within 30 calendar days from the date the employer became aware of the misconduct, but no later than six months from the date of the act. It must contain all mandatory elements under Article 252 and be communicated within five calendar days of issue. Read our dedicated guide to the disciplinary procedure in Romania.

Evidence that usually matters

• the internal regulation, policies and lawful instructions allegedly breached;
• proof that the employee received or could access those rules;
• emails, access logs, reports, witness statements or other lawfully obtained evidence;
• the summons, interview record, employee’s written defence and supporting documents;
• a reasoned proportionality assessment; and
• proof of issuing and communicating the final decision within the statutory periods.

How should professional inadequacy be documented?

Professional inadequacy concerns the employee’s ability to meet the professional requirements of the role; it is not a disciplinary accusation. Article 61(d) provides the legal ground for dismissal, while Article 63(2) requires the employee to undergo a prior evaluation under the procedure established by the applicable collective labour agreement or, in its absence, the internal regulation.

The evaluation should rely on objective, role-related standards communicated in advance. The job description, performance objectives, prior reviews, training records and concrete work results should tell a consistent story. A hastily created evaluation standard or a process designed around one predetermined outcome is vulnerable to challenge.

Before dismissal, Article 64 requires the employer to offer available positions compatible with the employee’s professional training or, where relevant, work capacity. If no suitable vacancy exists, the employer must seek the support of the territorial employment agency. The employee has three working days to express written consent to an offered position.

What is required for medical-unfitness dismissal?

Medical unfitness under Article 61(c) cannot rest on a manager’s impression or an ordinary performance assessment. It must be established through a decision of the competent medical bodies. The employer must then follow the compatible-vacancy process under Article 64 and grant the minimum statutory notice.

This ground should also be kept distinct from disability discrimination and reasonable workplace accommodation issues. Medical information must be handled with particular attention to confidentiality and data-protection requirements.

When is redundancy lawful?

Employee dismissal in Romania for redundancy is governed principally by Article 65. It is lawful when the employee’s position is effectively eliminated and the elimination has a real and serious cause unrelated to that employee. The employer does not have to prove that dismissal was the only imaginable business choice, but it should be able to show that the reorganisation is genuine and that the eliminated role no longer exists in substance.

A defensible file commonly includes the competent corporate decision, the business rationale, organisational charts before and after implementation, the updated headcount and job descriptions, financial or operational supporting material where relevant, and evidence that the employee’s duties were genuinely removed or redistributed.

A changed job title alone is not decisive. Courts can examine whether a supposedly eliminated position continues in substance or is promptly refilled under a different label.

Where only some identical or comparable positions are removed, the selection issue requires particular care. In Decision no. 30/2020, the High Court declined to rule on the merits and dismissed the recurs în interesul legii as inadmissible. It held that the question concerned applying the law to specific facts rather than resolving a genuine issue of legal interpretation. The decision therefore did not unify the divergent lower-court approaches described in the referral on whether selection criteria are required when an employer eliminates only some positions from a group of identical or similar positions. As a risk-management measure, any criteria used should be objective, consistently applied and supported by evidence.

Employers planning a broader reorganisation may also consult our guide to employee rights during company restructuring in Romania.

When do collective-dismissal rules apply?

A redundancy programme can become a collective dismissal if, within a period of 30 calendar days, the statutory thresholds in Article 68 are reached.

For threshold calculations, certain other employer-initiated terminations for reasons unrelated to the employee may also be counted when the statutory conditions are met. Fragmenting one programme into several documents or dates does not necessarily prevent the collective rules from applying.

The employer must begin consultations with the trade union or employee representatives in good time, provide the written information required by Article 69 and genuinely examine ways to avoid or reduce dismissals and mitigate their consequences. If the programme proceeds, the territorial labour inspectorate and territorial employment agency must receive the statutory notification at least 30 calendar days before dismissal decisions are issued, subject to the detailed Labour Code procedure.

What must the written dismissal decision contain?

The applicable deadline and the mandatory content should be analysed separately. Article 62 establishes the deadline for issuing decisions based on Article 61(b)–(d) and also requires the decision to state its factual and legal reasons, the challenge period and the competent court. Article 76 sets out the other mandatory elements applicable to dismissal decisions, while Article 252 contains the specific requirements for disciplinary decisions. Depending on the case, the written decision should include:

• the factual and legal reasons for dismissal;
• the duration of the notice period, where applicable;
• the collective-dismissal selection criteria, where applicable;
• the list of available positions and the Article 64 response period, where applicable;
• for a disciplinary sanction, the mandatory elements in Article 252, including why the employee’s defence was rejected; and
• the statutory challenge period and competent court, where required.

The decision produces effects from communication to the employee. Communication should therefore be provable. The employer cannot ordinarily defend the case by introducing new dismissal reasons that were absent from the decision.

What are the main employer risks if the dismissal is unlawful?

A failure to comply with the legally required procedure results in absolute nullity under Article 78. Under Article 80, if the court cancels the dismissal, it orders compensation equal to the indexed, increased and updated salaries and the other entitlements the employee would have received. At the employee’s request, the court also restores the parties to the position existing before dismissal by ordering reinstatement.

Employment disputes move quickly and the employer bears the burden of proof under Article 272. A disciplinary decision may be challenged within 30 calendar days of communication under Article 252(5). For most other dismissal-related employment disputes, employees generally have 45 calendar days to challenge the measure under Article 268, calculated from the date on which the person concerned became aware of it, subject to the specific provisions applicable to the type of claim.

Additional exposure may arise from discrimination, whistleblower retaliation, unpaid rights, data-protection violations, collective consultation failures or inconsistent treatment of comparable employees.

A practical pre-dismissal checklist for employers

1. Identify the legal route. Confirm whether the case is dismissal, mutual agreement, resignation, expiry, probationary termination or another statutory form.
2. Check protected status. Verify leave, medical incapacity, pregnancy notifications, representative status, whistleblowing and discrimination risks.
3. Confirm decision-making authority. Make sure the correct corporate or managerial body approves the measure.
4. Audit governing documents. Review the employment contract, job description, internal regulation, policies and collective agreement.
5. Build the evidence file. Preserve documents lawfully and avoid post-hoc rationales.
6. Run the ground-specific procedure. Investigation, professional evaluation, medical decision, vacancy search or reorganisation documentation cannot be interchanged.
7. Check collective thresholds. Look at the complete 30-day programme, not only one employee or one department.
8. Calculate notice correctly. Apply it only where legally required, but do not shorten it.
9. Draft and quality-check the decision. Confirm every mandatory element, factual statement, date and attachment.
10. Plan communication and litigation readiness. Retain proof of delivery and a complete, chronological file.

If employment status itself is uncertain, first review our analysis of employee versus contractor risks in Romania. For prevention at the hiring stage, see our guidance on employment contracts in Romania.

Frequently asked questions

Disclaimer: This article provides general information and does not constitute legal advice. The correct procedure depends on the dismissal ground, employment documents, employee status and facts of the case.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.