RomaniaGDPR Article 9 and Law 190/2018 Automated Decision-Making and CNP Rules
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Commencement not set.
A sensitive categories rule binding public and private bodies.
As of 24 August 2026.
What it requires
- Obtain explicit consent or express legal authorization, with adequate protective measures, before using genetic, biometric, or health data of a person in Romania to drive an automated decision or profile, per commentary describing Law 190/2018.
- Appoint a Data Protection Officer and set specific retention and deletion deadlines if relying on legitimate interests to process a Romanian national identification number, per commentary describing the Act; verify against the Act's own text before relying on it.
What it reaches
Excludes recording-derived identifiersNo
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category. Commentary describes a genuine Romanian addition tied to automated decision-making rather than employment: processing genetic, biometric, or health data for automated decision-making or profiling requires explicit consent or express legal authorization, with adequate protective measures.
A second commentary-described addition covers the national identification number: where a controller relies on legitimate interests to process it, the Act reportedly requires a Data Protection Officer, adequate technical and organizational measures, specific retention terms with deletion deadlines, and regular staff training. Neither is independently verified against the Act's own text, and no employment-specific biometric provision appears in either commentary source.
No commencement date is recorded for this instrument: no primary-source text was read and this rests entirely on commentary, so the status here is enacted rather than in force, rather than an asserted but unconfirmed effective date.
When LexLint raises it
processes_biometricsprocesses_voicehigh_risk_decisions
Read the law
CMS and DLA Piper commentary only
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.