News · GDPRhub EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

ANSPDCP (Romania) - Fine against GEROCOSSEN S.R.L.

The Romanian DPA imposed a RON 26,236.50 (€5,000) fine on a cosmetics retailer for infringing Article 32 GDPR by failing to implement adequate security measures, after a cyberattack affecting its IT infrastructure led to a personal data breach. English Summary. Facts. The controller suffered a cyberattack that affected its IT infrastructure. As a result, unauthorised parties gained access to personal data relating to some data subjects, including identification and contact details. Holding. The

Identification Law Enforcement Personal Data Security Data Breaches Right of Access Supervisory Authorities Notification Obligation
Sep 3, 2026 Source

How it connects

Related across sources

Enforcement HDPA (Greece) - 14/2026 HDPA (Greece) Enforcement ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026 ANSPDCP (Romania) Guidance EDPB Annual Report 2025 EDPB Literature If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Computer law & security review Guidance EDPB Annual Report 2024 EDPB Guidance EDPB Annual Report 2023 EDPB

Full text

The Romanian DPA imposed a RON 26,236.50 (€5,000) fine on a cosmetics retailer for infringing Article 32 GDPR by failing to implement adequate security measures, after a cyberattack affecting its IT infrastructure led to a personal data breach. English Summary. Facts. The controller suffered a cyberattack that affected its IT infrastructure. As a result, unauthorised parties gained access to personal data relating to some data subjects, including identification and contact details. Holding. The DPA found that the controller infringed Article 32 GDPR#1b and Article 32 GDPR#2 by failing to implement adequate technical and organisational measures in order to ensure the confidentiality and integrity of its processing systems and services. In particular, the DPA considered that the controller had failed to adopt security measures appropriate to protect personal data processed through its IT infrastructure. In addition, as a corrective measure pursuant to Article 58 GDPR#2d, the DPA ordered

Original document at the source gdprhub.eu
Related documents