European Union law applies in RomaniaRomania is a member state of the European Union, whose 223 researched instruments are listed on the European Union page, not here. The law of Romania, described on this page below, applies here too.European Union law reaches Romania two ways. A regulation, the EU AI Act and the GDPR among them, binds here as written, though Romania names its own regulator, sets its own penalties within the EU ceiling and may add rules of its own beside it. A directive binds here only through the act Romania passes to carry it into national law, and that act, listed on this page, is the one a court in Romania applies. For a concern in Romania, read both pages.
27 of 29 named instruments researched to a stage, across nine of the ten areas of law we track: 27 in force. As of .
When each starts24 of 27 carry a date, 3 do not. Earlier is before 2014.
in forcenot yet in forceblocked by a courtproposedno longer in force
Romania has not enacted the national implementing legislation the EU AI Act requires: a Government Memorandum adopted proposed the National Authority for Administration and Regulation in Communications (ANCOM) as the national market surveillance authority and single contact point, alongside sector regulators for financial services and other domains, and ANCOM's own public statement confirms that neither ANCOM nor any other designated authority can verify or sanction non-compliance with the AI Act until a national law establishing the sanctioning procedure and the applicable penalties enters into force, still under drafting as of the date below.
The National Artificial Intelligence Strategy 2024-2027, approved by Government Decision in July 2024, sets non-binding strategic priorities for public-sector AI adoption and imposes no obligation on a private or public entity.
Romania's Criminal Code does reach one AI-relevant practice directly: its child-pornography offence at art. 374 defines prohibited material to include an image that credibly simulates a minor in sexually explicit conduct without depicting a real person, bringing AI-generated or deepfake child-sexual-abuse material within the same criminal ban that covers real-person depictions.
Codul penal (Legea nr. 286/2009) art. 374, as amended by Ordonanța de urgență nr. 18/2016, publicată în Monitorul Oficial nr. 389 din 23 mai 2016, and by Legea nr. 202/2024, publicată în Monitorul Oficial nr. 607 din 28 iunie 2024Codul penal (Legea nr. 286/2009), art. 374, official consolidated text on legislatie.just.ro, Internet Archive capture
Cod penal art. 374 defines prohibited child-pornography material to include an image that does not depict a real person but credibly simulates a minor in sexually explicit conduct, bringing AI-generated, deepfake or otherwise synthetic material within the same ban that reaches real-person depictions. The same definition reaches any representation of a child's genitals for a sexual purpose.
Producing, possessing, storing, exhibiting, promoting, distributing, or making such material available carries 3 to 10 years' imprisonment. That penalty rises to 5 to 12 years where the offence is committed through a computer system or another means of storing computer data. Accessing such material through a computer system or electronic communications carries 1 to 3 years' imprisonment.
An adult who asks a minor to record, produce, distribute, display or transmit such material, including material that credibly simulates a minor, faces 5 to 12 years' imprisonment. Law 202/2024, published in the Monitorul Oficial of , set these penalties from . Paragraph 4 already defined prohibited material, before the 2016 amendments, to include an image that does not depict a real person but credibly simulates a minor.
Romania gives the General Data Protection Regulation (GDPR) domestic effect through Law 190/2018, in force since . The Act adds Romanian rules on using genetic, biometric or health data for automated decisions or profiling (Article 3), on the national identification number (Article 4), on employee monitoring (Article 5), on processing for research, statistics and archiving (Article 8), and on contraventions, where a public authority first receives a warning and a remediation plan (Articles 12 to 14). Law no. 233/2019 amended Article 8(1) with effect from .
A controller must notify ANSPDCP without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. Article 1 of Law 190/2018 names the General Data Protection Regulation (GDPR) provisions the Act mainly implements, and neither Article 33 nor Article 34 is among them, so the timeline and threshold apply directly except where Article 7 of the Act provides otherwise.
Article 7 of Law 190/2018 lets processing for journalistic purposes, or for academic, artistic or literary expression, derogate from Chapter IV of the GDPR, the controller and processor chapter that holds Articles 33 and 34, where it concerns data the person has made manifestly public or data closely tied to the person's public standing.
A provider of publicly available electronic communications services must notify the National Supervisory Authority for Personal Data Processing (ANSPDCP) without delay of a personal data security breach. The provider must also notify the subscriber or other person without delay where the breach could affect that person's personal data or private life.
That notice is not needed where the provider has shown the ANSPDCP, to its satisfaction, that adequate technological protection measures were applied to the data concerned. The ANSPDCP may ask a provider that has not yet notified the subscriber to do so. The notice to the subscriber must describe the nature of the breach, give contact points and recommend mitigating measures, and the notice to the ANSPDCP must also describe the consequences and the measures proposed or taken.
Providers must keep a record of all personal data breaches. Where a breach of data security creates a risk, providers must inform subscribers of the risk and its possible consequences.
A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier. Article 1 of Law 190/2018 names the General Data Protection Regulation (GDPR) provisions the Act mainly implements, and none of them is a transfer rule (Articles 44 to 49), so the transfer rules apply directly except where Article 7 of the Act provides otherwise.
Article 7 of Law 190/2018 lets processing for journalistic purposes, or for academic, artistic or literary expression, derogate from Chapter V of the GDPR, which holds the transfer rules, where it concerns data the person has made manifestly public or data closely tied to the person's public standing.
General Data Protection Regulation (GDPR) Article 22 gives a person in Romania the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.
Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.
Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.
Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.
Article 3(1) of Law 190/2018 adds a Romanian rule for automated decisions or profiling that use genetic, biometric or health data, which is permitted with the data subject's explicit consent or under express legal provisions, with measures to protect the data subject's rights, freedoms and legitimate interests.
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Romania can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.
Article 8 of Law 190/2018 disapplies access, rectification, restriction and objection for scientific or historical research or statistical purposes, and also notification and portability for archiving in the public interest, where those rights would make the purpose impossible or seriously impair it and the derogation is necessary, subject to the safeguards of GDPR Article 89(1).
Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP, National Supervisory Authority for Personal Data Processing) is Romania's supervisory authority. Law 190/2018 makes an infringement of the General Data Protection Regulation (GDPR) provisions listed in Article 83(4) to (6) a contravention, sanctioned by a warning or a fine. A public authority or body first receives a warning with a remediation plan. ANSPDCP may then fine it if the plan is not carried out in full.
For a public authority or body, Article 14 sets its own fine range of RON 10,000 to 100,000, or RON 10,000 to 200,000 for the infringements it lists in paragraph 5 and for breach of an ANSPDCP decision. GDPR Article 82 arms an individual with a direct private right of action.
General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category. Article 3(1) of Law No. 190/2018 adds a Romanian rule tied to automated decision-making rather than employment: processing genetic, biometric, or health data for automated decision-making or profiling is permitted with the data subject's explicit consent or under express legal provisions, with measures to protect the data subject's rights, freedoms, and legitimate interests.
Article 4(2) covers the national identification number: where a controller relies on legitimate interests to process it, the controller must apply appropriate technical and organizational measures, appoint a Data Protection Officer, set specific retention terms with deletion or review deadlines, and train staff periodically.
Article 5 of the Act permits an employer to process employee data through electronic-communications or video monitoring only on stated conditions, including prior information of the employees, and the Act has no separate rule on employee biometric data.
Romania's Criminal Code criminalizes unauthorized access to a computer system and related conduct (illegal interception, data alteration, system disruption, unauthorized data transfer, and dealing in access-defeating devices or credentials) with tiered custodial penalties, binding any person regardless of the target's public or private status.
Legea nr. 69/2022 transposed the EU Digital Single Market Copyright Directive's text-and-data-mining exceptions into Legea nr. 8/1996 privind dreptul de autor, permitting research organizations and cultural-heritage institutions to reproduce and extract text and data from lawfully accessible works without authorization, and permitting a general text-and-data-mining exception for any person subject to a rights holder's express, machine-readable opt-out.
The EU's own text-and-data-mining and copyright framework (the Digital Single Market (DSM) Directive itself, the General Data Protection Regulation (GDPR), and the AI Act) applies to Romania directly as an EU member state and is not restated here; what follows is limited to what Romania's own transposition and Criminal Code add. Romania's data-protection regime for scraped personal data is covered by the privacy topic and not restated here. Codul penal art. 360 alin.
(1) punishes access to a computer system without right with no requirement that a security measure be defeated and no exception stated for a page served openly to the public; Legea nr. 161/2003 art. 35 alin.
(2) once defined acting without right for this offense's predecessor and was not itself abrogated when the offense moved to the Criminal Code in 2014, but its definition is limited by its own terms to that law's title and supplies no public-page exception either, so whether ordinary unauthenticated crawling of an open page falls inside or outside article 360 is unsettled, with no reported decision on point.
A crawler that keeps browsing after a posted, unclicked notice is bound by it only if that conduct unmistakably shows agreement to the offer as stated, the acceptance rule in Codul civil art. 1.196 alin.
(1); once a contract forms on that basis, article 1.201 lets a referenced clause bind because an anti-scraping term is not on article 1.203's closed list of clauses needing express written acceptance, but no reported decision says whether continued, unaccompanied crawling meets article 1.196 alin. (1)'s own test.
Romania has no separate trespass-to-servers doctrine; damage to a server from crawling would fall under the general fault-based tort rule in Codul civil art. 1.357, the same rule that reaches any other damage. Unfair competition is governed separately by Legea nr. 11/1991 privind combaterea concurenței neloiale.
Legea nr. 8/1996's sui generis database right, addressed on its own extraction-and-reuse test rather than a trespass-to-servers theory, is the closest Romanian analogue specific to crawling.
Unauthorized access to a computer system is punishable by 3 months to 3 years' imprisonment or a fine, rising to 6 months to 5 years where the access aimed at obtaining data and to 2 to 7 years where the system's access was technically restricted to certain categories of users, per art. 360.
Illegal interception of a non-public data transmission, alteration of the integrity of computer data, and unauthorized transfer of data from a computer system each carry 1 to 5 years' imprisonment, per arts. 361, 362 and 364. Disrupting a computer system's functioning carries 2 to 7 years, per art. 363.
Producing, importing, distributing or making available a device, program, password or access code for the purpose of committing one of these offences carries 6 months to 3 years' imprisonment or a fine, and mere possession of one of these items for that purpose carries 3 months to 2 years' imprisonment or a fine, per art. 365; an attempt at any of these offences is itself punishable, per art. 366.
Legea nr. 69/2022 art. I pct. 11, inserting art. 36^1-36^2 into Legea nr. 8/1996 privind dreptul de autor și drepturile conexe (Monitorul Oficial nr. 321 din 1 aprilie 2022)Legea nr. 69/2022 pentru modificarea și completarea Legii nr. 8/1996
Law 69/2022 was adopted on and published in the Official Gazette (Monitorul Oficial) number 321 of . It transposed the EU Digital Single Market Copyright Directive (Directive (EU) 2019/790) into Law 8/1996 on copyright and related rights, inserting two text-and-data-mining exceptions.
Article 36^1 permits a research organization or cultural-heritage institution to reproduce and extract text and data from a lawfully accessible work for scientific-research purposes without the rights holder's authorization. Copies made under Article 36^1 are stored with appropriate security measures and may be kept for scientific-research purposes, including to verify the research results.
Article 36^2 permits any person to reproduce and extract text and data from a lawfully accessible work for text-and-data-mining purposes generally, but the exception applies only where the rights holder has not expressly reserved the use of the work in an appropriate manner, such as by machine-readable means for content made public online.
Romania transposed the NIS2 Directive (Directive (EU) 2022/2555) through Ordonanța de urgență a Guvernului nr. 155/2024 (OUG 155/2024), signed and published in Monitorul Oficial nr. 1332 din 31 decembrie 2024. The Government's own preamble cites a first-quarter-2024 ransomware incident that compromised a managed-service provider and disrupted 26 hospitals nationwide as the specific trigger for the updated supply-chain-security and management-accountability duties.
Article 66(1)(a) repeals Romania's earlier NIS1-era statute, Legea nr. 362/2018 privind asigurarea unui nivel comun ridicat de securitate a rețelelor și sistemelor informatice, outright, so no predecessor regime survives alongside OUG 155/2024 the way Ireland's 2018 NIS Regulations survive pending its own Bill. Parliament approved the OUG, with amendments and completions, through Legea nr. 124/2025 din 7 iulie 2025.
The OUG's legislatie.just.ro portal page records the consolidated text as last revised on , three days after that date. Articles 11 through 14 impose the risk-management duty and Articles 15 through 17 the incident-reporting duty; both took effect on the OUG's own publication date, (Article 65(4) delayed only Articles 60 and 61, the sanctions-enforcement machinery, by 30 days).
Article 11(1) requires an essential or important entity to take proportionate technical, operational and organisational measures across ten baseline categories mirroring NIS2 Article 21(2): risk-analysis and information-security policy and its periodic review, evaluating the effectiveness of risk-management measures, cryptography and encryption policy, supply-chain security including the relationship with direct suppliers and service providers, security of system acquisition, development, maintenance and decommissioning including vulnerability management and disclosure, human-resources security and access control and asset management, incident management, business continuity including backup management, disaster recovery and crisis management, basic cyber-hygiene practices and training, and multi-factor or continuous authentication.
Article 12(1) separately requires the DNSC director to issue an implementing order detailing the technical, operational and organisational requirements within 120 days of the OUG's entry into force (due by roughly ).
Article 14(1) requires the entity's governing body to approve these risk-management measures, supervise their implementation, and bear responsibility for them, and Article 14(3), as rewritten by Legea nr. 124/2025, requires it to designate the officers responsible for network and information-system security within 30 days of the notification of the DNSC director's decision identifying the entity.
Article 15 sets a graduated incident-notification clock to the Platforma națională pentru raportarea incidentelor de securitate cibernetică (PNRISC) run by the national computer security incident response team (CSIRT): an early warning within 24 hours of becoming aware of a significant incident (stating whether it is suspected unlawful, malicious, or cross-border in effect), a fuller incident report within 72 hours with an initial severity and impact assessment, an interim report on the CSIRT's request, and a final report within one month of the 72-hour report, or a progress report followed by a final report if the incident is still ongoing at that point, transposing NIS2 Article 23 on the same clock the corpus has already confirmed for Germany, Ireland, Lithuania, Portugal, Slovenia, Latvia, Estonia, Liechtenstein, Sweden and Slovakia.
Article 5 and Article 6, read with Article 8's cross-reference to Legea nr. 346/2004's SME criteria, bind a large or medium enterprise within the Anexa nr. 1 or Anexa nr. 2 sector lists as an essential or important entity respectively; central public-administration bodies and entities designated as critical entities under Romania's critical-entity-resilience legislation are essential regardless of size, and a public-electronic-communications-network or -service provider or a managed-security-service provider is essential even at only medium size.
Article 4's definitions (letters q, u and v) expressly recognise a piață online (online marketplace), a motor de căutare online (online search engine), and a platformă de servicii de socializare în rețea (social-networking-services platform) as digital-provider categories drawn from EU law, matching NIS2's own digital-provider sector; OUG 155/2024 also reaches the wider sector classes (energy, transport, banking, health, water, digital infrastructure, public administration, and the size-gated telecom and managed-security-service carve-outs).
Article 48 empowers DNSC to issue a warning or an amendă contravențională (administrative fine); Article 60(1) lists violating the Article 11(1) risk-management duty at letter a), and violating the Article 15(1) reporting clock or the duty to notify service recipients at letters l) and m), among the contravenții (regulatory administrative offences) it sanctions, unless the same conduct also meets a criminal offence's elements under separate law, in which case it is prosecuted as a crime instead of as this administrative offence.
Article 60(2)(a)-(b) applies the top penalty tier, the greater of a fixed euro-equivalent-in-lei cap or a percentage of annual worldwide turnover, to a violation of letters a) through m) (which includes both the Article 11(1) risk-management duty and the Article 15(1) reporting-clock and notification duties): up to EUR 10,000,000 or 2 percent for an essential entity, and up to EUR 7,000,000 or 1.4 percent for an important entity, mirroring NIS2 Article 34(4) and (5) exactly; a violation of letter n), which Legea nr. 124/2025 rewrote to cover failing to notify or remedy significant incidents or to remedy deficiencies found by the competent authorities, instead falls in the lower fixed-lei tier Article 60(2)(c)-(d) sets, from 1,000 to 300,000 lei for an important entity and from 1,500 to 500,000 lei for an essential entity.
DNSC, the Directoratul Național de Securitate Cibernetică, enforces; its sanction decisions are reviewable in contencios administrativ before the Curtea de Apel București within 30 days without a mandatory prior administrative appeal.
Romania has no general reasonable-security or information-security-programme statute with no sector gate; the closest general duty is General Data Protection Regulation (GDPR) Article 32's security-of-processing obligation, which sits in the privacy topic rather than here, and Article 62 of OUG 155/2024 separately requires DNSC to inform ANSPDCP, Romania's data-protection authority, without undue delay when a cybersecurity incident it supervises also implicates personal-data protection, a coordination duty distinct from an entity's own GDPR Article 33 and 34 breach-notification duty.
Government Emergency Ordinance 140/2021, published in Monitorul Oficial issue 1245 of , sets the rules for sale-of-goods contracts between a seller and a consumer and transposes Directive (EU) 2019/771. Article 20(1) brings the ordinance into force on , except Article 18 on sanctions, which enters into force within 10 days of publication in the Monitorul Oficial. Article 20(4) applies the ordinance to contracts concluded after .
Article 6(3) requires the seller of goods with digital elements to ensure that the consumer is informed about updates and is supplied with updates, including security updates, that are needed to keep the goods in conformity.
Where the sale contract provides a single act of supply of the digital content or digital service, Article 6(3)(a) runs the update duty for the period the consumer can reasonably expect, given the type and purpose of the goods and digital elements and the circumstances and nature of the contract. Where the sale contract provides continuous supply of the digital content or digital service over a set period, Article 6(3)(b) runs the update duty for the periods set in Article 9(3) and (4).
Article 9(3) and (4) make the seller answerable for a non-conformity of the digital content or service for two years from delivery for goods with an average period of use of up to five years, for five years from delivery for goods with a longer average period of use, and for the whole contractual supply period where the contract provides continuous supply for more than five years.
Article 6(4) relieves the seller of liability for a non-conformity caused only by the lack of an update that the consumer did not install within a reasonable time, if the seller informed the consumer of the update and the consequences of not installing it and the failure was not caused by deficient installation instructions.
Article 6(1)(d) requires goods to have the durability, functionality, compatibility and security that are normal for goods of the same type and that the consumer can reasonably expect. Article 18(1)(b) punishes non-compliance with Article 4, read with Article 6(1) and (3), by a fine of 5,000 lei to 25,000 lei.
Under Article 18(5), the authorized representatives of the National Authority for Consumer Protection (Autoritatea Națională pentru Protecția Consumatorilor) find the contraventions and apply the sanctions.
Government Emergency Ordinance 141/2021, published in Monitorul Oficial issue 1248 of , sets the rules for contracts between a trader and a consumer for the supply of digital content or digital services and transposes Directive (EU) 2019/770. Article 25(1) brings the ordinance into force ten days after its publication in the Monitorul Oficial of Romania, Part I. That clause counts the ten days from publication and names no calendar day.
Article 7(3) requires the trader to ensure that the consumer is informed that updates, including security updates, are being supplied and that they are actually supplied, where they are needed to keep the digital content or digital service in conformity. Where the contract provides continuous supply over a set period, Article 7(3)(a) runs that duty for the period in which the digital content or service must be supplied under the contract.
Where the contract provides a single act of supply or a series of individual acts of supply, Article 7(3)(b) runs it for the period the consumer can reasonably expect, given the type and purpose of the content or service and the circumstances and nature of the contract.
Article 7(4) relieves the trader of liability for a non-conformity caused only by the lack of an update that the consumer did not install within a reasonable time, if the trader informed the consumer of the update and the consequences of not installing it and the failure was not caused by deficient installation instructions.
Article 7(1)(b) requires digital content and services to have the functionality, compatibility, accessibility, continuity and security that are normal for content or services of the same type and that the consumer can reasonably expect. Article 7(7) requires the content or service to be supplied in the most recent version available when the contract is concluded, unless the parties agreed otherwise.
Article 5 requires the trader to supply digital content or a digital service that meets the requirements of Articles 6 to 8. Article 21(1)(c) punishes non-compliance with Article 5, among other provisions, by a fine of 10,000 lei to 50,000 lei. Under Article 21(3), the authorized representatives of the National Authority for Consumer Protection (Autoritatea Națională pentru Protecția Consumatorilor) find the contraventions and apply the sanctions.
Order No. 1 of of the Director of the National Cyber Security Directorate (Ordinul directorului Directoratului Național de Securitate Cibernetică) approves the requirements for the process of notification for registration of essential and important entities and the method of transmitting the information, and was published in Monitorul Oficial No. 776 of .
DNSC provides two mechanisms for notification, the NIS2@RO digital tool that generates the notification form and the NIS2@RO platform for enrolment, information and cooperation. The notification form has six sections: general data, specific data, specific situations, attached documents, preliminary assessment and entity representation.
The entity must attach documents showing that it meets the medium or large enterprise thresholds on average annual employees, annual net turnover and total assets, together with its self-assessment under DNSC Order 2/2025 where applicable. The form is signed with a qualified electronic signature and uploaded to the platform, or, when the tool is used, sent to evidenta@dnsc.ro or filed on paper at DNSC's headquarters.
Order No. 2 of of the Director of the National Cyber Security Directorate (Ordinul directorului Directoratului Național de Securitate Cibernetică) approves the criteria and thresholds for determining the degree of disruption of a service and the methodology for assessing the risk level of entities, and was published in Monitorul Oficial No. 776 of .
Article 1 requires an entity that has not been qualified as essential or important under the listed criteria of Emergency Ordinance No. 155/2024 to assess the degree of disruption of each service it provides that falls within Annex 1 or 2, so as to complete the information that DNSC Order 1/2025 asks for.
Article 4 states that the methodology determines the category of technical, operational and organizational risk-management measures an entity must implement, and that the entity's overall score sets the complexity of the security measures. Under Article 5, an entity that operates in several sectors assesses its risk level for each sector and implements the level of security measures that matches its highest overall score.
An entity recalculates its overall score every three years and whenever the high impact threshold for its sector is exceeded, unless it already applies the highest level of measures. An entity that is the only provider in Romania of a service listed in Annex 1 is an essential entity, and one that is the only provider of an Annex 2 service is an important entity, if the other criteria of Emergency Ordinance No. 155/2024 do not already identify it.
Article 11(1) requires an essential or important entity to take technical, operational and organisational measures proportionate to its risk exposure to identify, assess and manage the risks to the network and information systems it uses, across at least ten baseline categories mirroring NIS2 Article 21(2): risk-analysis and system-security policy and its periodic review; evaluating the effectiveness of risk-management measures; cryptography and, where applicable, encryption policy; supply-chain security, including the security of the entity's relationship with its direct suppliers and service providers; security of system acquisition, development, maintenance and decommissioning, including vulnerability management and disclosure; human-resources security, access-control policy and asset management; incident management; business continuity, including backup management, disaster recovery and crisis management; basic cyber-hygiene practices and cybersecurity training; and multi-factor or continuous authentication.
Article 12(1) requires the DNSC director to issue an implementing order on these technical, operational and organisational requirements within 120 days of the OUG's entry into force. Article 14 requires the entity's governing body to approve these measures, supervise their implementation and bear responsibility for them.
Article 14(2), as rewritten by Law 124/2025, requires the members of the governing body to attend accredited professional training courses and the entity to train all its staff regularly.
Article 14(3), as rewritten by Law 124/2025, requires the governing body to establish permanent means of contact, allocate the resources needed to implement the measures, and designate the officers responsible for network and information-system security within 30 days of the notification of the DNSC director's decision identifying the entity and entering it in the register.
Under Article 50(4), as rewritten by Law 124/2025, neither the general meeting of shareholders nor the board of directors is a governing body of an essential or important entity for the purposes of the Ordinance. Article 66(1)(a) repeals the predecessor statute, Legea nr. 362/2018, outright as of this OUG's own entry into force.
Article 4 defines a piață online (online marketplace) and a motor de căutare online (online search engine) as digital-provider categories among the entities Articles 5 and 6 bind as essential or important. Article 2(3) applies only Articles 5 to 10 and Article 18 of this Ordinance to an entity that Regulation (EU) 2022/2554 (DORA) covers.
Article 15(1) requires an essential or important entity to report to the national cybersecurity-incident-response team, without undue delay, any incident with a significant impact on the provision of its services, and, where relevant, to notify the recipients of its services of a significant incident that could affect them. Article 15(2) routes this reporting through the Platforma națională pentru raportarea incidentelor de securitate cibernetică (PNRISC).
Article 15(7) sets a graduated clock: an early warning within 24 hours of becoming aware of the significant incident, indicating whether it is suspected to be caused by unlawful or malicious acts or to have cross-border impact; an incident report within 72 hours, updating the early warning and giving an initial assessment of the incident's severity and impact, including indicators of compromise where available; an interim report on the national computer security incident response team (CSIRT)'s request; and a final report within one month of the 72-hour incident report, including a detailed description of the incident, its likely cause, mitigation measures applied and in progress, and any cross-border impact, or, if the incident is still ongoing at that point, a progress report followed by a final report once it has been resolved.
Article 15(8) sets a flat 24-hour clock for a trust service provider's incidents affecting its trust services. Article 16 lets an entity outside the mandatory scope voluntarily report incidents, cyber threats and near misses to the national CSIRT under the same Article 15 channel, without that report itself creating any additional obligation.
Article 17 extends Articles 15 and 16 to certain electronic-communications entities under Legea nr. 58/2023 that are identified as essential or important entities under this OUG. Article 62 separately requires DNSC to inform ANSPDCP, Romania's data-protection authority, without undue delay when a cybersecurity incident it supervises also implicates personal-data protection.
Law 124/2025, which approves the Ordinance with amendments and completions, rewrites the introductory words of Article 15(6), the paragraph that sets when an incident counts as significant. Article 2(3) applies only Articles 5 to 10 and Article 18 of this Ordinance to an entity that Regulation (EU) 2022/2554 (DORA) covers.
Romania transposes the ePrivacy Directive (2002/58/EC) in Law 506/2004, and the General Data Protection Regulation (GDPR) applies directly. Article 4, paragraphs 1 to 4 of Law 506/2004 guarantees the confidentiality of communications and bans listening to, recording, storing or otherwise intercepting them and their traffic data, except by the users who take part in the communication, with those users' prior written consent, or by the competent authorities.
Article 4, paragraphs 5 and 6 allows storing information in, or accessing information in, a subscriber's or user's terminal equipment only with consent after clear and complete information, with exceptions for network transmission and for a service the user expressly requested.
Article 12 bans commercial communications by automatic calling systems, fax, electronic mail or other publicly available electronic communications services without the recipient's prior express consent, with an exception for a seller's own similar products, and it reaches legal-person subscribers as well. The National Supervisory Authority for Personal Data Processing records the contraventions, which carry fines of RON 5,000 to RON 100,000 or up to 2 percent of turnover for larger companies.
Article 7 of Law 361/2022 on whistleblowers has a telephone report recorded only with the whistleblower's consent, or documented by a transcript or minutes the whistleblower can approve. A data subject's right to object to direct marketing is held in the privacy row for GDPR Articles 12 to 21 and Law 190/2018 Article 8, Data Subject Rights in Romania.
Article 12(1) of Law 506/2004 prohibits commercial communications through automatic calling and communication systems that need no human operator, through fax or electronic mail, or through any other method that uses publicly available electronic communications services, unless the subscriber or user concerned has first given express consent to receive them.
Article 12(2) lets a person who directly obtains a client's electronic mail address when selling the client a product or service use it for commercial communications about its own similar products or services, if the client is clearly and expressly offered a simple and free way to object both when the address is obtained and with each message, where the client did not object initially.
Article 12(3) prohibits in all cases commercial communications by electronic mail that hide the real identity of the person on whose behalf they are made contrary to article 5 of Law 365/2002, that give no valid address to which the recipient can send a request to stop such communications, or that encourage recipients to visit internet pages contrary to article 5 of Law 365/2002. Article 12(4) applies paragraphs 1 and 3 correspondingly to subscribers that are legal persons.
Article 13(1)(q) makes failing to meet article 12 on unsolicited communications a contravention. Article 13(2) sanctions the contraventions in article 13(1)(a) to (l), (n), (o) and (q) with a fine of RON 5,000 to RON 100,000 and, for a company with turnover above RON 5,000,000, with a fine of up to 2 percent of turnover. Article 13(5) has the staff of the National Supervisory Authority for Personal Data Processing (ANSPDCP) record those contraventions and apply the sanctions. Emergency Ordinance 13/2012, published on , amended article 12(1).
Article 4(5) of Law 506/2004 allows storing information in, or gaining access to information stored in, the terminal equipment of a subscriber or user only if the conditions that follow are all met. Article 4(5)(a) requires the subscriber or user to have given consent. Article 4(5)(b) requires that, before consent is given, the subscriber or user has been given clear and complete information in accordance with the data protection law the provision cites.
That information must be expressed in language that is easy to understand and be easily accessible to the subscriber or user. It must also state the purpose of processing the information stored by the subscriber or user, or the information to which the subscriber or user has access.
Where the provider allows third parties to store or access information in the terminal equipment, the information must include the general purpose of the third parties' processing and how the subscriber or user can use browser settings or similar technologies to delete stored information or refuse third-party access.
Article 4(5^1) allows the consent to be given through the settings of an internet browsing application or similar technologies through which the subscriber or user can be considered to have expressed it. Article 4(6) leaves in place technical storage or access exclusively to carry out the transmission of a communication through an electronic communications network.
Article 4(6) also leaves in place storage or access that is strictly necessary to provide an information society service the subscriber or user expressly requested. Article 13(1)(i) makes failing to meet the conditions of article 4(5) a contravention. Article 13(2) sanctions the contraventions in article 13(1)(a) to (l), (n), (o) and (q) with a fine of RON 5,000 to RON 100,000 and, for a company with turnover above RON 5,000,000, with a fine of up to 2 percent of turnover.
Article 13(5) has the staff of the National Supervisory Authority for Personal Data Processing (ANSPDCP) record those contraventions and apply the sanctions. Emergency Ordinance 13/2012, published on , amended article 4(5) and added article 4(5^1).
Article 9(1) of Law 361/2022 obliges authorities, public institutions and other public-law legal persons, whatever their number of employees, and private-law legal persons with at least 50 employees, to identify or set up internal reporting channels.
Article 7(3) requires the designated person, where a telephone line or other voice messaging system is used for reporting, to document the report either by recording the conversation in a durable and accessible form, subject to the whistleblower's consent, or by a complete and exact transcript of the conversation.
Article 7(4) requires the designated person, where the telephone line or voice messaging system cannot record conversations, to draw up minutes with a complete and exact transcript of the conversation. Article 7(4) also has the designated persons give the whistleblower the chance to check, correct and agree to the minutes of the conversation by signing them.
Article 7(5) requires the designated person, where the whistleblower asks for the report to take place in the person's presence, to draw up minutes in a durable and accessible form, subject to the whistleblower's consent. Article 7(6) directs a whistleblower who does not consent to transcription or recording of the conversation to report in writing, on paper to the designated person or electronically to a dedicated electronic mail address.
Article 36 provides that the obligation to identify or set up internal reporting channels takes effect on for private-law legal persons with between 50 and 249 employees. The consolidated text of the Law is in force from .
Article 4(1) of Law 506/2004 guarantees the confidentiality of communications transmitted through public electronic communications networks and publicly available electronic communications services, and the confidentiality of the related traffic data. Article 4(2) prohibits listening, recording, storing and any other form of interception or surveillance of communications and the related traffic data, except in the cases that follow.
The first exception covers operations carried out by the users who take part in the communication. The second exception covers operations to which the users who take part in the communication gave their prior written consent. The third exception covers operations carried out by the competent authorities under the conditions of the law. Article 4(3) leaves in place the technical storage needed to transmit the communication, provided confidentiality is respected.
Article 4(4) leaves in place recordings authorized under the law and made in the course of lawful professional practices to provide proof of a commercial act or of a communication made for commercial purposes. Article 13(1)(h) makes failing to respect the prohibition on interception and surveillance in article 4(2) a contravention.
Article 13(2) sanctions the contraventions in article 13(1)(a) to (l), (n), (o) and (q) with a fine of RON 5,000 to RON 100,000 and, for a company with turnover above RON 5,000,000, with a fine of up to 2 percent of turnover. Article 13(5) has the staff of the National Supervisory Authority for Personal Data Processing (ANSPDCP) record those contraventions and apply the sanctions.
Romania applies the Digital Services Act directly and holds its national layer in Law 50/2024 of , which makes the National Authority for Management and Regulation in Communications (ANCOM) the digital services coordinator, requires providers of intermediary services from Romania to notify ANCOM, sets the procedure for orders against illegal content and for inspections, and fixes fines of up to 6 percent of worldwide annual turnover.
The same Law amended the e-commerce Law 365/2002 so that its Article 11(3) points to the Digital Services Act conditions for the liability exemptions, and repealed Articles 12 to 15 of that Law. The Digital Services Act's own duties are held with the European Union's page and are not restated here. Other national duties of hosting services are not described here.
Article 52 point 2 of Law 50/2024 rewrites Article 11(3) of the e-commerce Law 365/2002 to provide that service providers are not liable for information transmitted, stored or accessed through them, under the conditions in Articles 4 to 6 and 8 of Regulation (EU) 2022/2065. Article 52 point 3 repeals Articles 12 to 15 of Law 365/2002.
Article 52 point 1 adds Article 5(3) to Law 365/2002, which requires the service provider to keep the information it makes available under Article 5(1) up to date and usable by public authorities for receiving communications. Article 52 point 4 amends Article 17(1) of Law 365/2002 to make the Authority for the Digitalization of Romania competent to supervise and control compliance by service providers with that Law.
Article 17(5) as amended lets control staff ask providers of information society services for the data and information they need, stating the legal basis and purpose, and set deadlines for them, under the sanction the law provides.
Article 14(1) of Law 50/2024 designates the National Authority for Management and Regulation in Communications (Autoritatea Națională pentru Administrare și Reglementare în Comunicații, ANCOM) as the digital services coordinator under Article 49(2) of Regulation (EU) 2022/2065. Article 18(1) makes ANCOM competent to supervise and ensure compliance with the Regulation by providers of intermediary services from Romania.
Article 5(1) requires a provider of intermediary services from Romania, other than a public authority, to send ANCOM within 45 days of starting to offer services a notice that includes its identification data and its single point of contact under Articles 11 and 12 of the Regulation. Article 5(3) requires the provider to notify ANCOM of any change in those details within 10 days.
Article 8(1) and (2) require an order to act against illegal content to meet at least the conditions in Article 9(2) of the Regulation and to be sent electronically to the contact point the provider designated under Article 11. Article 28(1) allows ANCOM to inspect premises only in exceptional cases, on its own decision and a judicial authorization given by the President of the Bucharest Court of Appeal or a delegated judge.
Article 32(1) points 5 and 6 make it a contravention for a provider not to designate single points of contact for authorities and for recipients, or not to publish the information needed to identify and reach them, as Articles 11 and 12 of the Regulation require.
Article 32(1) points 1 to 4 make it a contravention for a provider not to tell the issuing authority, no later than 10 days after receipt, how it acted on an order under Article 9(1) or 10(1) of the Regulation, or not to tell the affected recipient. Article 33(2) and (3) make it a contravention, fined RON 5,000 to RON 30,000, for a provider from Romania not to send ANCOM the notice required by Article 5(1) in the time and format ANCOM sets.
Article 34(1)(a) fines the contraventions in points 1 to 53 of Article 32(1) from RON 5,000 up to a maximum of 6 percent of the provider's worldwide annual turnover in the previous financial year. Article 34(1)(b) fines the contravention in point 54, supplying incorrect information or obstructing an inspection, from RON 5,000 up to a maximum of 1 percent of the annual income or worldwide annual turnover.
Article 44(1) lets ANCOM impose administrative fines of up to 5 percent of average daily worldwide turnover or income for each day, without combining them with another sanction for the same act. Article 53(1) brought Articles 32, 33 and 52 into force 30 days after the Law's publication in the Monitorul Oficial.
Product and AI liability law1 instrument, 1 in force
Research summary (124 words)
Law 240 of on the liability of producers for damage caused by defective products is Romania's product liability act and its transposition of Directive 85/374/EEC in force today. The Act defines a product as any movable good, even where it is incorporated in another movable or immovable good, and treats electricity as a product. Directive (EU) 2024/2853 repeals Directive 85/374/EEC with effect from .
Directive (EU) 2024/2853 requires Member States to bring into force the measures necessary to comply with it by . No bill or ordinance transposing Directive (EU) 2024/2853 has been located as of . The Ordonanța de urgență nr. 155/2024, which sets the Romanian cybersecurity baseline, is recorded in the security topic.
Article 1 governs the legal relations between producers and persons injured by defective products put into circulation, civil liability for the damage they generate, and the right of action for repairing it. The Act was published in the Monitorul Oficial, Part I, number 552 of . Article 17(1) brings the Act into force 30 days after its publication in the Monitorul Oficial. Article 17(1) brings Article 2(1)(a)(4), Article 2(1)(c)(3) and Article 14 into force on .
The text was republished under Article V(k) of Title III of Law 363/2007. The Act states that it transposes Directive 85/374/EEC as amended by Directive 1999/34/EC. Article 2(1)(a)(1) counts as producer the manufacturer of the finished product, of a raw material or of a component part. Article 2(1)(a)(2) also counts as producer anyone who presents itself as producer by putting its name, trade mark or another distinguishing sign on the product.
Article 2(1)(a)(4) also counts as producer any person who imports a product from the European Union for sale, rental, purchase or another form of disposal in the course of its own commercial activity. Article 2(1)(a)(5) treats every supplier as the producer where the producer cannot be identified, unless the supplier gives the injured consumer, within a reasonable time, the identity of the producer or of the person who supplied the product.
Article 2(1)(b) defines a product as any movable good, even where it is incorporated in another movable or immovable good, and treats electricity as a product. Article 2(1)(c)(1) covers damage caused by death or by injury to the bodily integrity or health of a person.
Article 2(1)(c)(3) also covers damage to or destruction of a thing other than the defective product, where the thing is normally meant for private use or consumption, the injured person used it for personal use or consumption, and its value exceeds the lei equivalent of EUR 500.
Article 2(1)(d) makes a product defective if it does not offer the safety a person is entitled to expect, taking account of all the circumstances, including the presentation of the product, its foreseeable uses and the date it was put into circulation. Article 2(2) provides that a product is not defective only because a similar improved product was later put into circulation. Article 2(3) leaves in place the legal provisions on moral damages.
Article 3 makes the producer liable for present and future damage caused by the defect of its product. Article 4 does not limit the producer's liability where the damage results from both the defect and the act or omission of a third person. Article 5 makes several persons who are liable for the same damage jointly and severally liable. Article 6 requires the injured person to prove the damage, the defect and the causal link between them.
Article 7(1)(a) exonerates the producer who proves that it was not the one who put the product into circulation. Article 7(1)(b) also exonerates the producer who proves that the defect did not exist when the product was put into circulation or arose later from causes not attributable to the producer.
Article 7(1)(c) also exonerates the producer who proves that the product was not made for sale or any other form of distribution for an economic purpose and was not made or distributed in the course of its professional activity. Article 7(1)(d) also exonerates the producer who proves that the defect is due to compliance with mandatory conditions imposed by regulations of the competent authorities.
Article 7(1)(e) keeps the development-risk defense: the producer is exonerated where the state of scientific and technical knowledge when the product was put into circulation did not allow the defect to be detected. Article 7(1)(f) also exonerates the producer where the defect is due to the consumer's failure to follow the instructions for use supplied with the product, shown by a specialist technical expert report.
Article 7(2) exonerates the producer of a component who proves that the defect is attributable to the faulty design of the assembly it was fitted into or to the instructions of the producer of the consumer product. Article 8 lets the competent court limit or remove the producer's liability where the damage is caused both by the defect and by the fault of the injured person.
Article 9(1) leaves the injured person free to claim damages under contractual or tort liability or another special liability regime. Article 10 makes any contractual clause limiting or excluding the producer's liability absolutely null. Article 11 sets a three-year limitation period, running from the day the claimant knew or should have known of the damage, the defect and the identity of the producer.
Article 11 also bars an action brought more than 10 years after the producer put the product into circulation. Article 15 disapplies the Act to damage generated by products put into circulation before it entered into force, and to damage resulting from nuclear accidents.
Legea audiovizualului nr. 504/2002, as amended by Legea 190/2022, requires providers of audiovisual media services under Romania's jurisdiction, covering both television and radio broadcasters and on-demand services, to make programs that could impair minors' physical, mental, or moral development available only in a way that ensures minors will not normally hear or see them, through measures such as scheduling, age-verification tools, or other technical measures, and bars the commercial processing of minors' personal data collected in doing so.
Romania has no social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code distinct from the EU's Digital Services Act and Audiovisual Media Services Directive framework.
Article 42^7 requires video-sharing platform providers to take appropriate measures to protect minors from programs, user-generated videos and audiovisual commercial communications that may impair their physical, mental or moral development, especially programs containing pornography or gratuitous violence.
Article 42^8(7) requires the providers to adopt access-control measures for the protection of minors, including systems that verify the age of platform users with respect to content that may impair minors' development. Article 42^8(7) also lists parental control systems managed by end users for that content.
Personal data of minors collected or generated through the age-verification and parental control systems may not be processed for commercial purposes such as direct marketing, profiling and behavior-based advertising. Video-sharing platform providers established in Romania are considered to be under Romanian jurisdiction.
Under Article 91, a provider that breaches Article 42^8 receives a summons from the Council setting conditions and deadlines for compliance, and one that does not comply in time or breaches the provisions again is fined 5,000 to 100,000 lei. Legea 190/2022 added these provisions as Chapter III^6, and the consolidated text dates the addition to .
Legea audiovizualului nr. 504 din 11 iulie 2002 art. 39, astfel cum a fost modificat prin Legea nr. 190 din 28 iunie 2022, în forma consolidatăLegea audiovizualului nr. 504/2002, official consolidated text on legislatie.just.ro (Portal Legislativ), Internet Archive capture
The Audiovisual Law (Legea audiovizualului 504/2002) was adopted and remains in force, amended repeatedly since. Legea 190/2022 of , published in the Monitorul Oficial, issue 651 of , replaced art. 39 with its present text and repealed art. 39^1. The consolidated text dates both changes to .
Under art. 39(1), audiovisual media services provided by providers under Romania's jurisdiction that could impair minors' physical, mental or moral development may be made available only in a way that ensures minors will not normally hear or see them.
The measures may include selecting the broadcast time, age-verification tools or other technical measures, and must be proportionate to the potential harm of the program, with the most harmful content, such as unjustified violence and pornography, subject to the strictest measures. The law's definition of an audiovisual media service includes television and radio program services and on-demand audiovisual media services, so the duty covers on-demand providers as well as broadcasters.
Art. 39(2) prohibits the commercial processing of minors' personal data collected or otherwise generated by providers in applying art. 39(1), for purposes such as direct marketing, profiling and behaviorally targeted advertising.
Art. 39(3) requires providers to give the public sufficient information about content that may impair minors' development, using a system that describes the potentially harmful nature of the content, which providers may set up through co-regulation or self-regulation under art. 6^1.
A breach of art. 39 is a contravention, and art. 90(1)(g) names art. 39 among the provisions fined 10,000 to 200,000 lei. Art. 91(1) separately names art. 39(1), for which the Consiliul Național al Audiovizualului (CNA) first issues a notice setting conditions and terms for compliance, and a fine of 5,000 to 100,000 lei applies only if the provider does not comply in that time or violates the provisions again.
Romania transposed the EU Digital Single Market Copyright Directive's press-publisher neighbouring right through Legea nr. 69/2022, inserting art. 94^1 into Legea nr. 8/1996 privind dreptul de autor. A press publisher holds an exclusive right to authorize or prohibit an information-society service provider's online reproduction and making-available of its press publications, exempting hyperlinks, reporting of simple facts, and individual words or extracts of up to 120 characters.
The same 2022 act separately inserted a general text-and-data-mining exception, subject to a rights holder's machine-readable opt-out. Romania has no compelled platform-to-publisher bargaining regime comparable to Australia's News Media Bargaining Code or Canada's Online News Act, and no hot-news or misappropriation doctrine distinct from the press-publisher right.
Legea nr. 69/2022 art. I pct. 21, inserting art. 94^1 into Legea nr. 8/1996 privind dreptul de autor și drepturile conexe, republicată (Monitorul Oficial nr. 321 din 1 aprilie 2022), transposing Directive (EU) 2019/790 art. 15Legea nr. 69/2022 pentru modificarea și completarea Legii nr. 8/1996, official consolidated text on legislatie.just.ro
Law 69/2022, adopted and published in the Official Gazette (Monitorul Oficial) number 321 of , inserted this right.
A press publisher holds the exclusive patrimonial right to authorize or prohibit an information-society service provider's online use of its press publications, through reproduction (direct or indirect, temporary or permanent, in whole or in part) and through making them available to the public so that they can be accessed individually at a place and time chosen by the public, per art. 94^1(1).
The right does not apply to private or non-commercial use by individual users, to hyperlinks or reporting of simple facts, or to the use of individual words or extracts of up to 120 characters that does not undermine the right's effectiveness or substitute for the publication, per art. 94^1(2).
It does not override the rights of authors or other rights holders whose works are incorporated into a press publication, per art. 94^1(3), and it expires two years after 1 January of the year following the publication's own publication date, per art. 94^1(5).
An author whose work is incorporated in a press publication is entitled to an appropriate share of the publisher's revenue from this right, per art. 94^1(6), and where an author has transferred a right or granted a licence to a press publisher, that transfer or licence itself entitles the publisher to a share of the compensation for a use of the work made under a copyright exception, per art. 94^2.
The right in Article 94^1(1) does not apply to a press publication first published before , per Article IV(3) of the amending act.
No current case law for Romania communications law
No current case law for Romania content moderation law
No current case law for Romania product and AI liability law
No current case law for Romania digital accessibility law
No current case law for Romania age gating law
No current case law for Romania reuse law
Reporting clocks that run here22 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Romania comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Report to the national cybersecurity-incident-response team, without undue delay, any incident with a significant impact on the provision of your services, through the Platforma națională pentru raportarea incidentelor de securitate cibernetică (PNRISC).
Report to the national cybersecurity-incident-response team any information that lets it establish a cross-border impact of the incident, without undue delay and in any event within 6 hours of becoming aware of that information (Article 15(3)).
Submit an early warning within 24 hours of becoming aware of a significant incident, stating whether it is suspected unlawful, malicious, or cross-border in impact; follow with a fuller incident report within 72 hours giving an initial severity and impact assessment and any known indicators of compromise; submit an interim report if the computer security incident response team (CSIRT) requests one; and submit a final report within one month of the 72-hour report, or a progress report followed by a final report if the incident is still ongoing at that point.
If you are a trust service provider, report an incident affecting your trust services within a flat 24 hours of becoming aware of it, rather than on the graduated clock.
Notify ANSPDCP without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Romania, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
If you provide publicly available electronic communications services, notify the ANSPDCP without delay of a personal data security breach (Law 506/2004 Article 3, paragraph 6).
Notify the subscriber or other person without delay where the breach could affect their personal data or private life, unless you have shown the ANSPDCP, to its satisfaction, that adequate technological protection measures were applied to the data concerned (Article 3, paragraphs 7 and 8).
The law of the European Union, which applies in Romania
Share relevant information related to a reportable cyber-attack with your computer security incident response teams (CSIRTs) and your competent authority without undue delay and no later than four hours of becoming aware that the incident is reportable; a cyber-attack is reportable when you assess its criticality as ranging from high to critical on the classification scale methodology under Article 37(8) (Article 38(3) and (4)).
Provide your computer security incident response teams (CSIRTs) without undue delay with any information related to a reportable cyber threat that may have a cross-border effect (Article 38(6)).
Report a major ICT-related incident to the competent authority your sector's Union law designates under Article 46, the European Central Bank through your national supervisor if you are a credit institution classified as significant, using the templates referred to in Article 20, and submit an initial notification as early as possible and in any case within four hours of classifying the incident as major, and no later than 24 hours from becoming aware of it.
Where classification as major comes later than that, submit the initial notification within four hours of the classification instead.
Submit an intermediate report within 72 hours of the initial notification, and submit an updated intermediate report without undue delay and in any case when you have recovered regular activities.
Submit a final report no later than one month after the intermediate report, or your latest updated one, once you know the root cause and the actual impact figures.
If you cannot meet one of those deadlines, tell the competent authority without undue delay and before the deadline lapses, explaining why. A deadline falling on a weekend or bank holiday moves to noon of the next working day, unless you are a credit institution, a central counterparty, a trading venue operator, or an entity your Member State has designated essential or important under the NIS2 Directive, none of which get that extension for an initial notification or intermediate report.
Your competent authority may also decide, and notify you, that the extension does not apply to you if you are a financial entity that is significant or has a systemic character for the financial sector at national or Union level.
Notifying a significant cyber threat under Article 19(2) is voluntary, only where you judge it relevant to the financial system, service users, or your clients. Where a major ICT-related incident affects your clients' financial interests, tell them without undue delay as soon as you become aware of it, describing the incident and the mitigation measures you took, and, for a significant cyber threat, tell a potentially affected client of protection measures it could take, where applicable.
If you provide a publicly available electronic communications service, notify every personal data breach to the competent national authority (Article 2(1)), no later than 24 hours after its detection, where feasible, with the information set out in Annex I; detection is deemed to have taken place when you have acquired sufficient awareness that a security incident has occurred that led to personal data being compromised (Article 2(2)).
Where all the information in Annex I is not available and further investigation is required, you may make an initial notification no later than 24 hours after detection containing the information in Section 1 of Annex I, and you must then make a second notification as soon as possible and at the latest within three days following the initial notification, containing the information in Section 2 of Annex I (Article 2(3)).
If you cannot provide all the information within the three-day period, notify as much as you have within it, submit to the competent national authority a reasoned justification for the late notification of the remaining information, and notify the remaining information as soon as possible (Article 2(3)).
Notify the subscriber or individual without undue delay after detection of the breach, whether or not you have yet notified the competent national authority (Article 3(3)).
If you have a direct contractual relationship with the end user and, despite reasonable efforts, cannot identify within the timeframe all the individuals likely to be adversely affected, you may notify them through advertisements in major national or regional media in the relevant Member States within that timeframe, containing the Annex II information where necessary in a condensed form, and you must continue all reasonable efforts to identify and notify them as soon as possible (Article 3(7)).
If you are contracted to deliver part of the electronic communications service without a direct contractual relationship with subscribers, immediately inform the contracting provider in the case of a personal data breach (Article 5).
Notify the computer security incident response team (CSIRT) designated as coordinator for your main establishment and ENISA, through the single reporting platform, of any actively exploited vulnerability you become aware of in your product: an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure becomes available, the notification and the final report each unless the relevant information has already been provided.
Notify the same recipients of any severe incident affecting the security of your product on the same 24-hour early warning and 72-hour incident notification clock, followed by a final report within one month of the incident notification; the incident notification and the final report each apply unless the relevant information has already been provided. For either an exploited vulnerability or a severe incident, give the computer security incident response team (CSIRT) an intermediate report on relevant status updates if it asks for one.
Make each notification without undue delay and in any case no later than 24 hours after you become aware of the security breach or disruption (Article 19a(1), point (b)).
Notify your computer security incident response team (CSIRT), or the competent authority where applicable, of any incident with a significant impact on the provision of your services: an early warning within 24 hours of becoming aware, an incident notification within 72 hours of becoming aware (24 hours if you are a trust service provider), an intermediate report on relevant status updates if your CSIRT or competent authority asks for one, and a final report no later than one month after the incident notification, or, for an incident still ongoing at that point, a progress report then and a final report within one month of its handling.
Where appropriate, notify, without undue delay, the recipients of your services who a significant incident is likely to adversely affect, and communicate to recipients potentially affected by a significant cyber threat any measures or remedies they can take.
If you are a law enforcement deployer using a high-risk AI system for post-remote biometric identification in a targeted search for a suspected or convicted person, request authorisation from a judicial authority or a binding, judicially reviewable administrative authority, in advance or without undue delay and no later than 48 hours, unless you are using the system only for the initial identification of a potential suspect on objective and verifiable facts directly linked to the offence.
Report a serious incident not later than 15 days after you become aware of it, or immediately once you establish a causal link between your AI system and the incident, or the reasonable likelihood of one, whichever is sooner.
Report immediately, and not later than 2 days after becoming aware of it, a widespread infringement or a serious incident causing a serious and irreversible disruption to the management or operation of critical infrastructure.
Report a serious incident involving the death of a person not later than 10 days after becoming aware of it, and immediately once you establish, or suspect, a causal link between your AI system and the incident.
If you are a deployer of a high-risk AI system and identify a serious incident, Article 26(5) requires you to immediately inform first the provider, then the importer or distributor, and the relevant market surveillance authority; if you cannot reach the provider, report the incident yourself under the same rules that bind a provider. This does not require you to disclose sensitive operational data if you are a law enforcement authority.
After reporting a serious incident, without delay investigate it, including a risk assessment and corrective action, and cooperate with the competent authorities; do not alter the AI system in a way that could affect the investigation before telling the authorities.
Let a subject, or the subject's legally designated representative, withdraw from the testing at any time by revoking informed consent, without detriment and without having to provide any justification, and on request delete the subject's personal data immediately and permanently; the withdrawal does not affect the activities already carried out (Article 60(5)).
Report any serious incident identified in the course of the testing to the national market surveillance authority in accordance with Article 73, which requires the report immediately after a causal link, or the reasonable likelihood of one, is established and in any event not later than 15 days after you become aware of the incident, not later than two days for a widespread infringement or a serious and irreversible disruption of the management or operation of critical infrastructure, and not later than 10 days after you become aware of it where a person has died (Article 60(7)).
Submit a notification as soon as you know of the condition, and a report as soon as possible and not exceeding 72 hours from the time you know of it unless exceptional circumstances prevent this, in the form your competent authority defines (point IS.D.OR.230(c), points (1) and (2)).
Submit a notification as soon as you know of the condition, and a report as soon as possible and not exceeding 72 hours from the time you know of it unless exceptional circumstances prevent this, in the form your competent authority defines (point IS.I.OR.230(c), points (1) and (2)).
Make the report immediately after you have established a causal link between the EHR system and the serious incident or the reasonable likelihood of such a link and, in any event, not later than three days after you become aware of the serious incident (Article 44(7)).
Where the system presents a risk to the health or safety, or to fundamental rights, of persons within the meaning of Article 79(1) and you become aware of that risk, immediately investigate the causes, in collaboration with the reporting deployer where applicable, and inform the market surveillance authorities competent for the system and, where applicable, the notified body that issued its certificate under Article 44, in particular of the nature of the non-compliance and of any relevant corrective action taken.
Terminate the mandate if you consider or have reason to consider that the provider is acting contrary to its obligations under the Regulation, and immediately inform the relevant market surveillance authority and, where applicable, the relevant notified body of the termination and the reasons for it (Article 22(4)).
Where such a system presents a risk within the meaning of Article 79(1), immediately inform the provider or importer and the authorities competent for the system, giving details, in particular, of the non-compliance and of any corrective actions taken (Article 24(4)).
Where you have reason to consider that using the system per its instructions may present a risk to health, safety or fundamental rights, inform the provider or distributor and the relevant market surveillance authority without undue delay, and suspend use of the system.
Where you have identified a serious incident, immediately inform first the provider, then the importer or distributor and the relevant market surveillance authorities; if you cannot reach the provider, report the incident yourself as Article 73 requires of a provider.
Keep track of, document, and report to the AI Office, and as appropriate to national competent authorities, without undue delay, relevant information about serious incidents involving your model and any corrective measures you have taken or plan to take. The Regulation states no fixed number of days for this report and no explicit moment its clock starts from, only that it must be made without undue delay.
If you provide a publicly available electronic communications service and a personal data breach occurs, notify the breach to the competent national authority without undue delay (Article 4(3)).
Where the breach is likely to adversely affect the personal data or privacy of a subscriber or individual, also notify that subscriber or individual of the breach without undue delay (Article 4(3)).
Transmit the report to the certification body or the national cybersecurity certification authority, in accordance with Article 56(8) of Regulation (EU) 2019/881, without undue delay (Article 35(4)).
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
