RomaniaGDPR Articles 33-34, Breach Notification
Regulation (EU) 2016/679, Arts. 33-34
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify ANSPDCP without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Romania, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
These lines are LexLint's reading of the law's text. Also read by: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.dataprotection.ro/servlet/ViewDocument?id=1650
- Guidance body
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
What it makes you log
Who may demand the log
Regulator
Logging duty
The controller documents every personal data breach, whether or not it is notified; Article 33(5) names the facts, the effects and the remedial action but no fixed log fields, and says the documentation must let the supervisory authority verify compliance with the Article. Law 190/2018 Article 7 lets journalistic and academic, artistic or literary processing derogate from Chapter IV, which holds Article 33.
- Kind
- Explicit
- As of
- Provision
- Regulation (EU) 2016/679, Art. 33(5)
- Trigger
- security_incident
What this law does
A controller must notify ANSPDCP without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. Article 1 of Law 190/2018 names the General Data Protection Regulation (GDPR) provisions the Act mainly implements, and neither Article 33 nor Article 34 is among them, so the timeline and threshold apply directly except where Article 7 of the Act provides otherwise.
Article 7 of Law 190/2018 lets processing for journalistic purposes, or for academic, artistic or literary expression, derogate from Chapter IV of the GDPR, the controller and processor chapter that holds Articles 33 and 34, where it concerns data the person has made manifestly public or data closely tied to the person's public standing.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .