🇷🇴Law No. 190/2018 Implementing the GDPR

← Back to laws in Romania

Law No. 190/2018 Implementing the GDPR

Romania applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

The Law implements GDPR opening clauses in Romania and adds safeguards for health, genetic, biometric, identifier and employee data, expression, research, DPO designation and public-body enforcement.

National additions and variations

• Article 3 restricts genetic, biometric and health-data profiling or automated decisions to explicit consent or an express statutory basis with safeguards and prohibits incompatible third-party reuse of public-health data.
• Article 4 requires additional security, minimisation, DPO, retention and training safeguards when national identifiers are processed on legitimate interests.
• Article 5 permits workplace electronic monitoring or video surveillance on legitimate interests only after justification, full notice, consultation and consideration of less intrusive means; retention is normally capped at 30 days.
• Articles 7 and 8 define expression, research and archiving derogations and require necessity plus Article 89 safeguards.
• Articles 13 and 14 apply a warning and remedial-plan process to public authorities and bodies, with a remediation period of up to 90 days before the specified fine route.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.