GDPR Sanctions: Lessons from a Romanian Retail Case

Some of the most instructive lessons in data protection come not from doctrine, but from the decision-making practice of the supervisory authority. In May 2026, the National Supervisory Authority for Personal Data Processing (ANSPDCP) closed an investigation into a major electronics and home-appliance retailer and found infringements of several GDPR provisions. The consequences: three separate fines and a set of mandatory corrective measures.

The case warrants a close reading, because it reflects a risk to which any organisation operating an app, an online store or a customer database is exposed.

The facts

The investigation was triggered by a complaint lodged with the authority. The checks established that, owing to a technical vulnerability in the operator's mobile app — at the level of the account validation process — one user was able to access another data subject's personal data.

The exposed data included names, invoices and delivery addresses. This was not a sophisticated external attack, but a weakness in the operator's own system — the category of risk that most often remains undetected until an external complaint is made.

The infringements found

The authority found three distinct failures, each sanctioned separately.

• Absence of adequate security measures (Art. 32). The operator had not implemented sufficient technical and organisational measures to ensure a level of security appropriate to the risk, which made unauthorised access to customer data possible.
• Failure to notify the authority (Art. 33). The operator omitted to notify ANSPDCP of the personal data breach, even though notification is mandatory, as a rule within 72 hours of becoming aware of it.
• Failure to inform the data subject (Art. 34). The operator did not communicate the breach to the person whose data had been exposed, even though, where the incident poses a high risk to the rights and freedoms of the individual, informing them is mandatory.

The fines, in figures

ANSPDCP imposed three administrative fines, amounting to over 52,000 lei (approximately 10,000 euros):

• 36,461 lei (about 7,000 euros) — for the absence of adequate technical and organisational measures (Art. 32);
• 10,417 lei (about 2,000 euros) — for failure to notify the authority (Art. 33);
• 5,208 lei (about 1,000 euros) — for failure to inform the data subject (Art. 34).

The structure of the penalty is notable: although the fine for the security deficiency was the largest, the two fines relating to the notification obligations together added a further 3,000 euros or so. In other words, a significant part of the penalty was imposed not because a breach occurred, but because of the failure to notify it properly.

The corrective measures ordered

Beyond the fines, the authority ordered the operator, under Art. 58 GDPR, to take a series of mandatory corrective measures:

• reviewing the validation and authentication mechanisms for user accounts;
• periodic vulnerability testing of the app;
• adopting internal procedures for handling security incidents and for assessing the notification obligations under Art. 33 and 34;
• regular training for the staff involved in handling incidents and requests from data subjects;
• sending a written reply to the person who lodged the complaint.

Conclusions and practical lessons

The relevance of the decision lies not in the scale of an attack, but in the mundane nature of the deficiencies that produced it — situations that can arise in any organisation. A few practical conclusions:

• Security is not the concern of complex systems alone. A single poorly designed function — account validation — was enough to expose a person's data. Apps must be tested periodically, not merely launched.
• The response weighs as much as prevention. Part of the penalty was imposed for subsequent inaction. Having and following a notification procedure considerably reduces the exposure. The correct approach is set out in the article on notifying a breach to ANSPDCP.
• Data subjects have rights that cannot be ignored. Where the exposure of data poses a high risk, informing the data subject is an obligation, not an option.
• Procedures and training are not formalities. The authority imposed them expressly as corrective measures. The cost of implementing them in advance is invariably lower than that incurred under a sanction.

In essence, the case confirms a recurring pattern in ANSPDCP's practice: the most costly consequences stem not from bad faith, but from the absence of a few simple rules — set down in procedures and applied consistently.

Frequently asked questions