Data protection · Company response · Romania

A GDPR complaint in Romania can reach your company through customer support, HR, a supplier or the data protection authority.

Before sending a standard reply, identify what the person is asking, preserve the relevant record and establish who must respond.

This guide is for Romanian companies, foreign-owned subsidiaries and managers handling an initial personal-data complaint.

It distinguishes three situations often described as GDPR complaints: a complaint addressed directly to the company, a request to exercise GDPR rights and a communication received from ANSPDCP.

It focuses on organising the response file, with separate escalation points for an authority investigation, a security incident or a formal decision.

The applicable framework includes the General Data Protection Regulation (GDPR) and Romanian supervisory procedures.

What has the company actually received?

Classify the message before choosing a reply or a deadline.

A customer may describe unlawful sharing and request deletion in the same email.

An employee may complain about monitoring while also asking for a copy of their personal data.

One message can therefore require several connected actions.

The European Data Protection Board’s guide to individual remedies distinguishes contacting a company, complaining to a supervisory authority and bringing proceedings.

A person’s statement that they have complained to ANSPDCP is different from an actual communication issued by that authority.

Romania’s National Supervisory Authority for Personal Data Processing is referred to below as ANSPDCP.

Its official complaints guidance also distinguishes rights requests addressed to an organisation from complaints lodged with the authority.

Preserve each document separately, including all attachments and the original delivery record.

Select one or more cards to add the relevant situations to your review packet.

Which response deadline applies?

There is no single 30-day deadline for every document described as a GDPR complaint.

Under Article 12(3) GDPR, information on action taken on requests under Articles 15–22 must be provided without undue delay and within one month of receipt.

The period may be extended by two further months where necessary, taking account of the complexity and number of requests.

The controller must explain the extension and its reasons within the original month.

ANSPDCP’s guidance on complaints repeats that distinction between the initial month and a conditional extension.

Record when the request reached the controller through an appropriate contact channel, rather than treating a later internal referral to legal or the DPO as a fresh starting date.

The EDPB’s access guidelines explain that a dedicated request channel cannot be made compulsory where the person uses another appropriate official or regular contact channel.

Calculate the one-month period under the EU time-calculation rules identified in those guidelines, rather than substituting 30 days or the Romanian court rules for periods expressed in days.

An acknowledgement confirms receipt but does not complete the substantive response or automatically extend the period.

If the controller takes no action on a rights request, Article 12(4) GDPR requires it to explain its reasons without delay and at the latest within one month of receipt of the request, and to inform the individual of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Where a message raises concerns without requesting a right under Articles 15–22, identify any other applicable duties and respond promptly as a practical complaint-handling measure.

If ANSPDCP has requested a written response, its official investigation procedure requires the company to answer within the period set by the authority.

Do not borrow the individual’s one-month period for that correspondence or assume that asking for more time suspends the stated deadline.

What should the response file contain?

Preserve evidence that explains the disputed processing and the company’s handling of the complaint.

As a practical measure, identify relevant email threads, request tickets, privacy notices, consent or preference records, access logs, contracts and earlier replies before routine deletion removes useful evidence.

Ask the system owner which records exist, how long they remain available and whether a controlled preservation step is needed.

Keep originals and create an indexed working copy, recording who collected each item and when.

Separate confirmed facts, allegations and points still being investigated.

Evidence preservation must remain proportionate and lawful.

The EDPB’s explanation of processing principles covers purpose limitation, data minimisation, storage limitation and security.

A complaint does not justify retaining every record indefinitely or continuing unrelated use of the person’s data.

Document the purpose, legal basis, access restrictions and review date for any retained complaint evidence.

For an erasure request, assess any applicable exception under Article 17(3) GDPR, including necessary retention for a legal obligation or the establishment, exercise or defence of legal claims.

An erasure exception does not replace the need for a lawful processing basis or justify indefinite retention.

The EDPB’s access guidelines explain how controllers should prevent routine deletion from defeating access to data held when the request was received.

Who is responsible when a vendor or foreign parent is involved?

Establish the role for the disputed activity before assigning the response.

The EDPB’s controller and processor guidance explains that a controller decides the purposes and means of processing, while a processor processes data on its behalf.

The company receiving the complaint may need a supplier’s assistance without transferring away its own responsibilities.

Where your company acts only as processor for the activity, escalate the request to the controller under the agreed procedure and provide the required assistance.

Check the factual role even if the contract uses a convenient label.

Under Article 26(3) GDPR, the person may exercise their rights against each joint controller regardless of the controllers’ internal allocation of responsibilities.

Our data processing agreement guide for Romania explains how assistance, instructions and evidence obligations should operate in a controller–processor relationship.

For a complaint involving an AI service, use the actual settings, contractual documents and supplier information alongside our guide to AI vendor contracts.

Request the relevant logs and explanations early, with a clear operational contact and an agreed delivery format.

If a DPO has been appointed, involve them alongside the business and technical teams.

The DPO’s advisory and monitoring tasks under Article 39 GDPR do not transfer the controller’s responsibility to the DPO.

A foreign parent company should help reconstruct the facts without assuming that group ownership alone decides regulatory competence.

The EDPB’s guidance on supervisory authorities and cross-border cooperation explains why the relevant processing and main establishment matter.

Regulation (EU) 2025/2518 lays down additional procedural rules for GDPR enforcement in cases concerning cross-border processing.

It applies from 2 April 2027, subject to the transitional provisions in Article 36.

Check its applicability to the particular investigation or cooperation procedure.

How should the company answer the individual?

Address the allegation and each requested action using verified facts and clear language.

The EDPB’s guidance on respecting individual rights covers identity checks, clear communication and reasons for refusing a request.

Under Article 12(6) GDPR, request additional identity information where there are reasonable doubts, limiting it to what is necessary.

Avoid requesting a full identity-document copy where a less intrusive verification method is sufficient.

Use a response structure that makes the record easy to follow:

1. Identify the message. Record its receipt date and the issues or rights addressed.
2. Explain the relevant facts. Describe the processing, data, purpose and recipients that the review has established.
3. Answer each request. State what has been done, what remains necessary and any supported reason for refusing action.
4. Describe corrections. Identify completed measures and distinguish them from planned work.
5. Provide the next contact. Include applicable complaint and judicial-remedy information where required.

For access under Article 15 GDPR, confirm whether personal data are processed and, where they are, provide access and a copy together with the information required by that provision.

Check purposes, data categories, recipients, retention periods or criteria, applicable rights and complaint information, the available source where data were not collected from the person, relevant automated decision-making information and transfer safeguards where applicable.

Under the CJEU’s judgment in Case C-154/21, normally provide recipients’ actual identities where personal data have been or will be disclosed.

The Court permits recipient categories where identification is impossible or the controller demonstrates that the access request is manifestly unfounded or excessive.

Before sending the material, verify the recipient and assess any actual adverse effect on other people’s rights and freedoms under Article 15(4) GDPR.

Use justified redaction or separation of affected information rather than refusing the whole access request automatically.

Under Article 12(5) GDPR, rights-related information and action are generally free of charge.

A reasonable administrative fee or refusal is permitted for a manifestly unfounded or excessive request only where the controller can demonstrate that exception.

A dispute with the company or an intention to use the data in litigation does not by itself justify refusing access.

Keep the approved response, attachments and proof of dispatch together.

What changes when ANSPDCP requests information?

Build a separate authority response that follows the actual questions, deadline and documentary requirements.

Under Article 33(1) of the investigation procedure approved by Decision no. 161/2018, written investigations request information, data and documents needed for the case.

The response must be written, accompanied by copies certified as conforming to the originals, and provided within the period set by ANSPDCP.

Article 31 GDPR requires controllers and processors to cooperate with the supervisory authority on request.

As a practical preparation step, map each question to the answer, supporting annex, responsible person and any unresolved point.

Explain missing records accurately and identify the work underway to obtain them.

Do not backdate a policy or present a newly introduced control as evidence of an earlier practice.

Under Article 19(e) of the investigation procedure, the investigated entity must provide complete requested information and cannot oppose its confidential character, subject to the law.

A contractual confidentiality clause or commercial-sensitivity label is therefore not a blanket reason to withhold material lawfully requested by ANSPDCP.

Assess any specific statutory or professional-secrecy protection with counsel before submission.

Retain the submitted version and proof of filing, then monitor follow-up communications.

Does the complaint also reveal a personal data breach?

Assess a possible security incident in parallel with the complaint response.

An allegation about an unclear privacy notice does not by itself establish a personal data breach.

A message describing files sent to the wrong recipient may require an immediate incident assessment.

The EDPB’s breach guidance explains documentation, notification and communication duties.

A controller must notify the competent authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to create a risk to individuals’ rights and freedoms.

A processor must notify its controller without undue delay after becoming aware of a breach.

A notification made after 72 hours must include reasons for the delay, and Article 33(4) GDPR permits information to be supplied in phases where it cannot be provided together, without undue further delay.

Where the breach is likely to result in a high risk to individuals’ rights and freedoms, Article 34 GDPR requires communication to affected individuals without undue delay, subject to the exceptions in Article 34(3).

Under Article 33(5) GDPR, document every personal data breach, including its facts, effects and remedial action, even where authority notification is not required.

Record the reasons supporting the notification assessment so that the authority can verify compliance.

If an assessed suspicion proves not to be a personal data breach, retaining the reasoning is a prudent accountability measure.

Use our separate GDPR data breach guide for Romania for the incident process, including the distinct high-risk test for informing affected individuals.

Do not wait for the ordinary complaint reply to complete an urgent breach assessment.

What if a sanction or corrective measure has already arrived?

Review the formal act and available remedy immediately, alongside any compliance work.

Article 17(1) of Law no. 102/2005, republished provides a 15-day challenge period from delivery or communication for the sanction report and/or corrective-measure decision covered by that provision.

The challenge is brought before the administrative litigation section of the competent tribunal.

Under Article 181 of the Romanian Code of Civil Procedure, procedural periods expressed in days are generally calculated by counting the prescribed number of full intervening days, excluding both the day on which the period starts and the day on which it expires.

If the final filing day is a non-working day, the deadline extends to the next working day, unless a special rule applies.

The act may be filed on that final day, subject to the applicable filing rules.

Calculate the final filing date immediately upon service and check the filing method and any applicable special rule.

Under Article 17(2) of Law no. 102/2005, bringing that challenge suspends only payment of the fine until the final judgment.

Do not assume that corrective measures are automatically suspended.

Check the complete act, service evidence, jurisdiction, calculation rules and any separate suspension request with counsel.

The investigation procedure separately permits objections to the finding or sanction report within 15 days under Article 32(4) or Article 33(4), depending on the investigation route.

Sending those objections to ANSPDCP does not substitute for the required court challenge or preserve its deadline.

A complaint is an allegation, and receipt does not itself establish an infringement or guarantee a fine.

The EDPB’s supervisory-authority guidance explains that corrective measures and sanctions depend on the findings and circumstances.

What should management approve before the response is sent?

Approve a response that matches the evidence and assigns ownership of remaining actions.

• Confirm the correct entity, recipient, signatory and secure delivery channel.
• Check that every allegation and requested right has been addressed.
• Verify the applicable deadline and any justified extension or separate filing.
• Align legal, technical and customer-facing statements on the same facts.
• Record completed corrections, outstanding work and the responsible contacts.
• Keep the final response, annexes, dispatch evidence and follow-up dates.

For recurring requests and vendor issues, review the workflow after the immediate matter has been handled.

Repeated complaint handling may fit ongoing legal support for companies, with scope and urgent work agreed separately.

Request a focused GDPR complaint review

Atrium Romanian Lawyers can review the complaint, processing documents, correspondence and proposed reply, and help identify the appropriate response and escalation steps.

Start with the complete message, proof of receipt, earlier replies, a short processing description and any authority correspondence.

The agreed work may include a response plan, evidence index, draft reply or review of an authority submission.

Any court representation or incident-response mandate should be defined expressly.