Registering Your DPO with ANSPDCP: When, How and What to Submit

Many controllers stop halfway: they appoint a DPO, sign a contract or an internal decision, and consider the obligation ticked off. In reality, designation is only the first step. The GDPR explicitly requires that, after the appointment, the officer's contact details reach two places: the public and the supervisory authority.

Let's look at exactly what the law says, what you submit, and how it's done in Romania.

The legal basis: Art. 37(7) GDPR and Law 190/2018

The obligation comes straight from Article 37(7) of the GDPR. The text sets out two things that go together: the controller or processor publishes the contact details of the data protection officer and communicates them to the supervisory authority.

In Romania, the supervisory authority is ANSPDCP — the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal). At national level, the GDPR framework is supplemented by Law no. 190/2018, the national implementing law. In other words: the core rule sits in the GDPR, while the national, institutional context is handled by ANSPDCP and Law 190/2018.

Worth remembering: this obligation applies to anyone who has designated a DPO — whether because they were required to (Art. 37(1)) or because they appointed one voluntarily. Once you have a DPO, the publish-and-communicate rule kicks in.

What you actually submit

This is where confusion often arises. The GDPR talks about the officer's contact details, not the public exposure of their full identity.

• To the public (for example, in the privacy notice on your website), a working contact channel is enough: a dedicated email and, possibly, a phone number. Many organisations use a role address such as [email protected], which stays valid even if the person changes.
• To ANSPDCP you communicate the details needed to identify the DPO and the controller — the contact details through which the authority can actually reach the officer, together with the data that identifies the organisation.

The distinction matters in practice: publishing on the website serves data subjects, while communicating to the authority serves the institutional relationship. They are not the same thing and one does not replace the other — both must be done.

How it's done in Romania, step by step

The communication to ANSPDCP is made through the authority's official channel. The ANSPDCP website (dataprotection.ro) provides the dedicated form and the electronic means for notifying the contact details of the data protection officer.

In practical terms, the steps generally look like this:

• Prepare the controller's data (name, tax identification, registered office, contact person) and the DPO's contact details.
• Access the dedicated form on the authority's website and complete the required fields.
• Submit the form through the electronic means indicated by the authority and keep proof of submission in your compliance file.

A note of caution: always work with the current form and instructions on the authority's website, because the procedure and the fields may be updated over time. Don't rely on old screenshots or on instructions copied from other sources.

When the communication must be made

The rule is simple: without undue delay after designating the DPO. The GDPR does not fix an exact number of days, but the logic is one of promptness — once you have an officer, the authority and the public must know who to contact.

And, very importantly, the communication is not a one-time task. You must update the details whenever:

• the person or firm holding the DPO role changes;
• the email address, phone or other contact details change;
• the relevant controller data that was initially communicated changes.

Why it matters and common mistakes

In practice, we see the same handful of slip-ups, year after year:

• DPO appointed, but never notified to the authority. The internal decision exists, the contract exists, but the step of communicating to ANSPDCP was forgotten. Technically, you are non-compliant with Art. 37(7).
• The contact details don't appear on the website or in the privacy notice. Publishing is a separate obligation from communicating; its absence leaves data subjects without a clear channel.
• Out-of-date details. The DPO email forwards to someone who has left the company, and messages get lost. That can turn a simple request into a problem.
• Treating it as a one-time task. A notification made once, back in 2018, and forgotten since no longer reflects the reality of the organisation.

If you first want to understand the role itself — what a DPO is and what its tasks are — or if you're considering the option of an outsourced DPO, you'll find the full context there. Registering with ANSPDCP is, in fact, the final piece that makes the role visible to the outside world.

The link to breach notification

The DPO's contact details are not an administrative formality: they are the channel through which the authority and data subjects reach the organisation when something goes wrong. In a security incident, ANSPDCP will look at who the officer is and how they can be contacted.

That's why correctly registering the DPO and your incident-handling process go hand in hand. If you want to see the other side of the relationship with the authority, read about breach notification to ANSPDCP — when you do it, how, and what to expect. A DPO who is easy to reach and a well-kept incident register are the two things that make the difference in the first hours of a breach.

In conclusion

Designating a DPO is the visible step; communicating their contact details to ANSPDCP and publishing them for the public are the steps that actually have effect. Treat them as an ongoing obligation, not a checkbox: communicate promptly, publish on the website, update on every change, and keep proof. That's how you avoid the surprisingly common situation of having an officer on paper whom no one on the outside can find.

Frequently asked questions