Operates a social platform, in Romania

E-commerce Law (Legea nr. 365 din 7 iunie 2002 privind comerțul electronic), Articles 11(3), 5(3) and 17, as amended by Law 50/2024, Article 52 · Read the law's page

• To stay free of liability for information you transmit, store or give access to, meet the conditions in Articles 4 to 6 and 8 of Regulation (EU) 2022/2065, which Article 11(3) of Law 365/2002 applies.
• Keep the information you make available under Article 5(1) of Law 365/2002 up to date and usable by public authorities for sending you communications.
• When the supervising authority's control staff ask you for data and information, stating the legal basis and purpose, supply them by the deadline they set.

Law on Measures for Applying the Digital Services Act (Legea nr. 50 din 18 martie 2024, Monitorul Oficial nr. 232 din 19 martie 2024), Articles 5, 8, 14, 18, 28, 32 to 34, 44 and 53 · Read the law's page

• If you are a provider of intermediary services from Romania and not a public authority, send ANCOM, within 45 days of starting to offer services, a notice with your identification data and your single points of contact for authorities (Article 11 of Regulation (EU) 2022/2065) and for recipients (Article 12), in the form ANCOM sets, and report any change within 10 days.
• When you receive an order to act against illegal content or to provide information, tell the issuing authority, no later than 10 days after receipt, whether and when you acted, and tell the affected recipient (Articles 9 and 10 of the Regulation).
• Designate and publish your single points of contact for authorities and recipients, and, if you are not established in the European Union, appoint, empower and notify a legal representative (Articles 11 to 13 of the Regulation).
• Put the restrictions you impose on users in your terms and conditions, notify users of significant changes, and publish at least one content moderation report each year (Articles 14 and 15 of the Regulation).

Ordonanța de urgență a Guvernului nr. 155 din 30 decembrie 2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civil, approved by Legea nr. 124/2025, art. 15-17 · Read the law's page

• Report to the national cybersecurity-incident-response team, without undue delay, any incident with a significant impact on the provision of your services, through the Platforma națională pentru raportarea incidentelor de securitate cibernetică (PNRISC).
• Report to the national cybersecurity-incident-response team any information that lets it establish a cross-border impact of the incident, without undue delay and in any event within 6 hours of becoming aware of that information (Article 15(3)).
• Submit an early warning within 24 hours of becoming aware of a significant incident, stating whether it is suspected unlawful, malicious, or cross-border in impact; follow with a fuller incident report within 72 hours giving an initial severity and impact assessment and any known indicators of compromise; submit an interim report if the CSIRT requests one; and submit a final report within one month of the 72-hour report, or a progress report followed by a final report if the incident is still ongoing at that point.
• Where relevant, notify the recipients of your services of a significant incident that could affect them.
• If you are a trust service provider, report an incident affecting your trust services within a flat 24 hours of becoming aware of it, rather than on the graduated clock.
• This binds an essential or important entity under Articles 5 and 6, which name a piață online (online marketplace), a motor de căutare online (online search engine) and a platformă de servicii de socializare în rețea (social-networking-services platform) among the digital-provider categories it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.

Ordonanța de urgență a Guvernului nr. 155/2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civil, approved by Legea nr. 124/2025, art. 11-14 · Read the law's page

• Take technical, operational and organisational measures proportionate to your risk exposure to identify, assess and manage the risks to the network and information systems you use in your operations or to provide your services.
• Cover at least: risk-analysis and system-security policy and its periodic review; evaluating the effectiveness of your risk-management measures; cryptography and encryption policy; supply-chain security, including the security of your relationship with your direct suppliers and service providers; security of system acquisition, development, maintenance and decommissioning, including vulnerability management and disclosure; human-resources security, access control and asset management; incident management; business continuity, including backups, disaster recovery and crisis management; basic cyber-hygiene practices and training; and multi-factor or continuous authentication.
• Have your governing body approve these measures, supervise their implementation and bear responsibility for them; have each member of the governing body attend accredited cybersecurity training and train all your staff regularly; establish permanent means of contact and allocate the resources the measures need; and designate the officers responsible for network and information-system security within 30 days of the notification of the DNSC director's decision identifying you and entering you in the register.
• This binds an essential or important entity under Articles 5 and 6, which name a piață online (online marketplace), a motor de căutare online (online search engine) and a platformă de servicii de socializare în rețea (social-networking-services platform) among the digital-provider categories it reaches expressly; the wider sector classes it also reaches (energy, transport, banking, health, water, digital infrastructure, public administration, and a size-gated telecom or managed-security-service provider) are reached too, by declaring that you are an essential or important entity.

Ordinul directorului DNSC nr. 1/2025 (11 august 2025), Monitorul Oficial nr. 776/2025, art. 1-6 · Read the law's page

• If you are an entity in a sector of Annex 1 or 2 of Ordonanța de urgență nr. 155/2024, use the NIS2@RO platform or the NIS2@RO tool to evaluate whether you are an essential or important entity and to generate the notification form for registration (Articles 2 and 3).
• Complete the notification form's six sections: general data, specific data (including size, services, contact points and your network address ranges), specific situations, attached documents, preliminary assessment and entity representation (Articles 4 and 5).
• Attach the documents that show you meet the medium or large enterprise thresholds, and any further documents DNSC asks for before registration (Article 5(4)).
• Have your legal representative sign the form with a qualified electronic signature and upload it to the platform, or send it to evidenta@dnsc.ro or file it on paper at DNSC's headquarters when you use the tool (Article 6).

Ordinul directorului DNSC nr. 2/2025 (11 august 2025), Monitorul Oficial nr. 776/2025, art. 1-5 · Read the law's page

• If you are an entity within Annex 1 or 2 of Ordonanța de urgență nr. 155/2024 that has not been qualified as essential or important under its Articles 5, 6 and 9 criteria, assess the degree of disruption of each service you provide that falls within those Annexes, using the thresholds in Annex 1 to Order 2/2025, and use the result to complete the registration information (Article 1).
• Calculate your overall risk score with the formulas in Annex 2 to the order, starting from the base values for your entity type or sector and your size, and implement the category of security measures that the score sets (Articles 4 and 5(1)).
• If you operate in several sectors, assess your risk level for each sector and implement the level of measures that matches your highest overall score (Article 5(2)).
• If your own impact or probability values differ from the sector base values, send DNSC an analysis with a sound reason for each value you ask to change (Article 5(3)).
• Recalculate your overall score every three years and whenever the high impact threshold for your sector is exceeded, unless you already apply the highest level of measures (Article 5(5)).