Duty LXD-1004
Processes personal data, in Romania
GDPR Articles 12-21 and Legea nr. 190/2018 Article 8, Data Subject Rights in Romaniasince 2 lines
Regulation (EU) 2016/679, Arts. 12-21; Legea nr. 190/2018, Art. 8 · Read the law's page
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Romania within one month of receipt.
- You need not give effect to the rights of access, rectification, restriction or objection, or, for archiving in the public interest, also notification and portability, for data you process in Romania for scientific or historical research, statistical purposes or such archiving, to the extent they would make that purpose impossible or seriously impair it and the derogation is necessary, under Legea nr. 190/2018 Article 8.
GDPR Articles 33-34, Breach Notificationsince 2 lines
Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page
- Notify ANSPDCP without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Romania, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
GDPR Chapter V, Cross-Border Transfer Restrictionssince 1 line
Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page
- Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Romania outside the EEA.
ANSPDCP Enforcement and GDPR Article 82since 1 line
Regulation (EU) 2016/679, Arts. 82-83 · Read the law's page
- Compensate any person in Romania who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.
Law No. 190/2018 on Measures for the Implementation of Regulation (EU) 2016/679since 1 line
Legea nr. 190/2018 privind masuri de punere in aplicare a Regulamentului (UE) 2016/679 · Read the law's page
- Establish a GDPR Article 6 lawful basis before processing personal data of a person in Romania.
GDPR Article 9 and Law 190/2018 Automated Decision-Making and CNP Rulessince 2 lines
Regulation (EU) 2016/679, Art. 9; Legea nr. 190/2018, automated decision-making and national identification number provisions · Read the law's page
- Obtain explicit consent or express legal authorization, with adequate protective measures, before using genetic, biometric, or health data of a person in Romania to drive an automated decision or profile.
- If you rely on legitimate interests to process a Romanian national identification number, put in place appropriate technical and organizational measures, appoint a Data Protection Officer, set specific retention terms with deletion or review deadlines, and train staff periodically.