Romania Law No. 190/2018 on Data Protection Measures (GDPR Implementation)
Romania's Law No. 190/2018 on measures for implementing EU Regulation 2016/679 (GDPR) supplements the GDPR with national provisions. The National Supervisory Authority for Personal Data Processing (ANSPDCP - Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal) oversees enforcement. The law includes provisions for the age of digital consent (16 years), processing of national identification numbers (CNP), genetic and biometric data, research derogations, and sector-specific rules for health and employment data.
Romania Law No. 190/2018 on Data Protection Measures (GDPR Implementation) is a compliance framework from Romania with 13 domains and 28 controls. The largest domains are National Derogations and Special Categories (6 controls), Accountability and Governance (4 controls), Supervision, Enforcement and Cooperation (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (13)
Accountability
| Code | Title |
|---|---|
| ROMANIA-4 | DPIA, Privacy by Design, Accountability |
Accountability and Governance
| Code | Title |
|---|---|
| RO-LAW190-006 | Designation and Notification of the Data Protection Officer |
| RO-LAW190-011 | Records of Processing Activities |
| RO-LAW190-013 | Data Protection Impact Assessments |
| RO-LAW190-020 | Codes of Conduct and Certification |
Breach and Enforcement
| Code | Title |
|---|---|
| ROMANIA-8 | Breach Notification, Enforcement |
Cross-Border
| Code | Title |
|---|---|
| ROMANIA-6 | International Transfer |
Data Subject Rights and Consent
| Code | Title |
|---|---|
| RO-LAW190-010 | Data Subject Rights Handling |
| RO-LAW190-015 | Children's Consent for Information Society Services |
Governance
| Code | Title |
|---|---|
| ROMANIA-7 | DPO, ANSPDCP Cooperation, Training |
High-Risk Processing
| Code | Title |
|---|---|
| ROMANIA-3 | Special Categories, Children, Employee Monitoring |
Individual Rights
| Code | Title |
|---|---|
| ROMANIA-2 | Data Subject Rights |
National Derogations and Special Categories
| Code | Title |
|---|---|
| RO-LAW190-001 | Lawful Basis for Processing Genetic, Biometric and Health Data |
| RO-LAW190-002 | Processing of National Identification Numbers (CNP) |
| RO-LAW190-003 | Processing of Personal Data by Political Parties and Non Profits |
| RO-LAW190-004 | Processing of Personal Data for Journalistic, Academic, Artistic or Literary Expression |
| RO-LAW190-005 | Workplace Monitoring of Employees |
| RO-LAW190-019 | Records Relating to Criminal Convictions and Offences |
Scope and Lawful Basis
| Code | Title |
|---|---|
| ROMANIA-1 | GDPR Implementation, Scope, Lawful Basis (Romania) |
Security and Processor
| Code | Title |
|---|---|
| ROMANIA-5 | Security of Processing and Processor Agreements |
Supervision, Enforcement and Cooperation
| Code | Title |
|---|---|
| RO-LAW190-007 | Compliance with the National Supervisory Authority (ANSPDCP) |
| RO-LAW190-008 | Public Authorities and Corrective Measures |
| RO-LAW190-009 | Administrative Fines and Sanctions |
| RO-LAW190-018 | Cross Border Cooperation and One Stop Shop |
Transfers, Breach and Electronic Communications
| Code | Title |
|---|---|
| RO-LAW190-012 | International Data Transfers |
| RO-LAW190-014 | Personal Data Breach Notification |
| RO-LAW190-016 | Direct Marketing and Electronic Communications |
| RO-LAW190-017 | Cookies and Online Tracking |
What is Romania Law No. 190/2018 on Data Protection Measures (GDPR Implementation) and who does it apply to?
Romania Law No. 190/2018 on Data Protection Measures (GDPR Implementation) is a compliance framework from Romania with 13 domains and 28 controls. Romania's Law No. 190/2018 on measures for implementing EU Regulation 2016/679 (GDPR) supplements the GDPR with national provisions. The National Supervisory Authority for Personal Data Processing (ANSPDCP - Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal) oversees enforcement. The law includes provisions for the age of digital consent (16 years), processing of national identification numbers (CNP), genetic and biometric data, research derogations, and sector-specific rules for health and employment data. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Romania Law No. 190/2018 on Data Protection Measures (GDPR Implementation) actually require?
Romania Law No. 190/2018 on Data Protection Measures (GDPR Implementation) has 28 controls organised across 13 domains. The largest domains are National Derogations and Special Categories (6 controls), Accountability and Governance (4 controls), Supervision, Enforcement and Cooperation (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Romania Law No. 190/2018 on Data Protection Measures (GDPR Implementation) do I already cover?
Romania Law No. 190/2018 on Data Protection Measures (GDPR Implementation) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Romania Law No. 190/2018 on Data Protection Measures (GDPR Implementation)?
Start your Romania Law No. 190/2018 on Data Protection Measures (GDPR Implementation) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Romania Law No. 190/2018 on Data Protection Measures (GDPR Implementation) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 28 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required