RomaniaLaw 506/2004 Article 3, Personal Data Breach Notification by Electronic Communications Providers
Legea nr. 506/2004 privind prelucrarea datelor cu caracter personal și protecția vieții private în sectorul comunicațiilor electronice Art. 3(5)-(12)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://legislatie.just.ro/Public/DetaliiDocument/56973In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice
As of .
What it requires
- If you provide publicly available electronic communications services, notify the ANSPDCP without delay of a personal data security breach (Law 506/2004 Article 3, paragraph 6).
- Notify the subscriber or other person without delay where the breach could affect their personal data or private life, unless you have shown the ANSPDCP, to its satisfaction, that adequate technological protection measures were applied to the data concerned (Article 3, paragraphs 7 and 8).
- In the notice to the subscriber, describe the nature of the breach, give contact points and recommend mitigating measures, and add the consequences and the measures you proposed or took in the notice to the ANSPDCP (Article 3, paragraph 10).
- Inform subscribers of the risk and its possible consequences where a breach of data security creates a risk (Article 3, paragraph 5).
- Keep a record of all personal data breaches that describes what happened, its effects and the remedial measures taken (Article 3, paragraph 12).
Who enforces it
Enforcement body
National Supervisory Authority for Personal Data Processing (ANSPDCP), whose staff find the contraventions and apply the sanctions under Law 506/2004.
What this law does
A provider of publicly available electronic communications services must notify the National Supervisory Authority for Personal Data Processing (ANSPDCP) without delay of a personal data security breach. The provider must also notify the subscriber or other person without delay where the breach could affect that person's personal data or private life.
That notice is not needed where the provider has shown the ANSPDCP, to its satisfaction, that adequate technological protection measures were applied to the data concerned. The ANSPDCP may ask a provider that has not yet notified the subscriber to do so. The notice to the subscriber must describe the nature of the breach, give contact points and recommend mitigating measures, and the notice to the ANSPDCP must also describe the consequences and the measures proposed or taken.
Providers must keep a record of all personal data breaches. Where a breach of data security creates a risk, providers must inform subscribers of the risk and its possible consequences.
When LexLint raises it
When your app profile says your app provides telecom services.