Following an investigation, the National Supervisory Authority for Personal Data Processing (ANSPDCP) imposed a fine of RON 637,262.50 (EUR 125,000), as a result of serious shortcomings in the protection of personal data.
What happened
The investigation was triggered after the notification of a security incident caused by a cyberattack on an application managed through an external supplier.
As a result of this incident:
- The data of a very large number of individuals was accessed and disclosed without authorisation
- Sensitive data was compromised, such as:
- Personal numeric code (CNP)
- Home address
- Identity card details
- Driving licence number
- Email address
- Phone numbers
- Professional information and internal identifiers
The impact was major, both due to the volume of the data and its nature.
Which GDPR provisions were breached
The authority found the breach of several essential obligations:
Art. 32 – Security of processing
Adequate technical and organisational measures had not been implemented to:
- Ensure the confidentiality of the data
- Prevent unauthorised access
- Periodically test and evaluate the systems
- Guarantee the security of processing on an ongoing basis
Art. 28 – The relationship with processors
The controller did not ensure that the supplier:
- Provides sufficient guarantees regarding data security
- Complies with GDPR requirements
- Implements appropriate technical measures
Why the sanction was imposed
The fine reflects the cumulative severity of the situation:
- A very large number of individuals affected
- The exposure of sensitive data
- The lack of any real preventive measures
- The lack of effective control over suppliers
- A high risk to the rights and freedoms of the data subjects
It was not only the cyberattack that was sanctioned, but the way it was made possible.
How companies can avoid such sanctions
To prevent similar situations, organisations must adopt a proactive approach:
Implementing appropriate security measures
- Adapting the level of security to the real risks
- Protecting data according to its sensitivity and volume
Periodic testing and evaluation
- Regular security audits
- Penetration tests
- Continuous monitoring of vulnerabilities
Supplier management
- Vetting suppliers before collaboration
- Concluding clear contractual agreements
- Constantly monitoring their compliance
Integrating the "privacy by design" principle
- Including protection measures from the development stage
- Avoiding the later retrofitting of security solutions
Controlling access to data
- Access limited only to authorised personnel
- Implementing secure authentication mechanisms
- Monitoring access and activities
Incident response plan
- Clear procedures for handling incidents
- A rapid reaction to limit the impact
- Well-defined responsibilities
Top management must understand that the lack of adequate security measures attracts significant sanctions, even when the incident is caused by an external attack.
And do not forget: the protection of personal data must be treated as an operational and strategic priority, not merely as a formal obligation.
Frequently asked questions
Why did a security breach lead to a GDPR fine?
Because ANSPDCP did not sanction the cyberattack itself, but the fact that the controller made it possible. The investigation showed that there were no real preventive measures and no effective control over the external supplier managing the application. In other words, the responsibility lies with the controller who failed to protect the data, not only with the attacker.
Which Art. 32 GDPR security measures were missing?
The controller had not implemented adequate technical and organisational measures to: ensure the confidentiality of the data, prevent unauthorised access, periodically test and evaluate the systems, and guarantee the security of processing on an ongoing basis. In addition, the authority also found a breach of Art. 28, because the controller did not ensure that the supplier provided sufficient guarantees regarding data security.
How is the amount of the fine determined?
The fine of RON 637,262.50 (EUR 125,000) reflects the cumulative severity of the situation: the very large number of individuals affected, the exposure of sensitive data, the lack of any real preventive measures, the lack of effective control over suppliers, and the high risk to the rights and freedoms of the data subjects. The greater the impact and the fault, the higher the sanction.
How can a company prevent such a sanction?
Through a proactive approach: security measures adapted to the real risks, periodic testing and evaluation (audits, penetration tests, vulnerability monitoring), rigorous supplier management, integrating the privacy by design principle, controlling access to data and a clear incident response plan. Top management must treat data protection as an operational and strategic priority, not as a formal obligation.
Want to avoid a breach that turns into a fine?
We assess the security of your processing and the relationship with your suppliers, so the risk of a sanction drops.