Fines

What a fine is

A fine is the pecuniary sanction that the National Centre for Personal Data Protection imposes on the controller when it finds an infringement of the Law art. 86(1). The money is paid into the state budget art. 86(2). The Centre may impose it in addition to, or instead of, its other corrective measures art. 60(2)(i).

The ceilings

The Law sets two levels of fines. Both are maximums, not fixed amounts.

• Up to 1,000,000 lei or, in the case of an enterprise, up to 1% of the total turnover achieved in the year preceding the imposition of the sanction, whichever is higher art. 88(1). This level covers, among other things, the obligations of the controller and the processor in art. 8, 11, 25–39, 42 and 43, including data protection by design, contracts, records, security, breach notification, impact assessment and the data protection officer art. 88(1)(a).
• Up to 2,000,000 lei or, in the case of an enterprise, up to 2% of total turnover, whichever is higher art. 88(2). This level covers the principles and the conditions for consent art. 88(2)(a), the rights of data subjects art. 88(2)(b), transfers to other states art. 88(2)(c), the obligations in Chapter VI on specific processing situations art. 88(2)(d), and non-compliance with the Centre’s corrective measures or failure to provide access art. 88(2)(e).

An infringement of a corrective measure issued by the Centre is also punishable by a fine of up to 2,000,000 lei or, for an enterprise, of up to 2% of total turnover, whichever is higher art. 88(3). Total turnover has the meaning given in Competition Law No. 183/2012 art. 4; if no turnover was recorded in the preceding year, the last year in which the enterprise achieved turnover is taken into account art. 88(5). The sanctions also apply to public authorities and institutions art. 88(4).

How a fine is set

The Centre ensures that each fine is effective, proportionate and dissuasive art. 87(1). In deciding whether to impose a fine and on its amount, the circumstances laid down in the Law are taken into account in each case, including the nature, gravity and duration of the infringement, the number of people affected, action taken to mitigate the damage, the technical and organisational measures implemented, previous infringements and the degree of cooperation with the Centre art. 87(2). The way the infringement became known to the Centre also matters, in particular whether it was notified art. 87(2)(h).

In the case of a minor infringement, or where a fine would constitute a disproportionate burden on a natural person, a warning may be issued instead of a fine art. 87(2).

Fines may be imposed only if it is established that the controller committed the infringement intentionally or negligently art. 87(3). Where several provisions are infringed for the same or linked processing operations, the total amount may not exceed the amount specified for the gravest infringement art. 87(4).

Phasing in

The Law provides a transition period for the amount of fines. From the entry into force of the Law, of the final amount of the pecuniary sanction set by the Centre, the following applies art. 90(4):

• from the first year – 10% of the amount of the fine set art. 90(4)(a);
• from the second year – 40% of the amount of the fine set art. 90(4)(b);
• from the third year – 100% of the amount of the fine set art. 90(4)(c).

Counting the years from the Law’s entry into force on 23 August 2026 art. 89(1), the 10% rate applies until 22 August 2027, the 40% rate until 22 August 2028 and the 100% rate after that date.

The phasing in concerns only the amount of fines; the obligations of the Law apply from its entry into force art. 89(1).

Paying the fine

The period for voluntary payment of the fine is at least two months from the communication of the decision art. 85(2). Decisions that are not complied with are subject to compulsory enforcement art. 85(3).