Fine against GEROCOSSEN S.R.L.
Gerocossen SRL (the controller) suffered a cyberattack that affected its IT infrastructure.
Status Not cited by any decision here yet
Holding
The DPA found that the controller infringed Article 32(1)(b) GDPR and Article 32(2) GDPR by failing to implement adequate technical and organisational measures in order to ensure the confidentiality and integrity of its processing systems and services. In particular, the DPA considered that the controller had failed to adopt security measures appropriate to protect personal data processed through its IT infrastructure. In addition, as a corrective measure pursuant to Article 58(2)(d) GDPR, the DPA ordered the controller to implement access monitoring and logging systems within the IT infrastructure used for personal data processing. The authority further required the controller to retain access logs for at least 30 days and to introduce backup procedures for those logs. Finally, the Romanian DPA fined the controller €5,000 (RON 26,236.50).
From GDPRhub’s case note — a summary of the decision, not its own words. Read it in the text ↓
As a result, unauthorised parties gained access to personal data relating to some data subjects, including identification and contact details. The controller notified the breach to the DPA.
Full text 2 findings
Machine translation of the decision, via GDPRhub — not the official text. Read the original
August 28, 2026 Penalty for GDPR Violation In July 2026, the National Supervisory Authority for Personal Data Processing concluded an investigation into the data controller GEROCOSSEN S.R.L. and found a violation of the provisions of Article 32(1)(b) and (2) of Regulation (EU) 2016/679. As a result, the data controller was fined 26,236.50 lei, equivalent to 5,000 euros. The investigation was initiated following the submission by the data controller, GEROCOSSEN S.R.L., of a notification of a personal data breach, in accordance with the provisions of Article 33 of Regulation (EU) 2016/679. The data breach occurred as a result of a cyberattack on the controller’s IT infrastructure, a situation that led to the unauthorized disclosure of or unauthorized access to personal data belonging to data subjects (identification data, contact information). During the investigation, it was found that the controller had not implemented adequate technical and organizational measures to ensure a level of security appropriate to the risk posed by the processing, including the ability to ensure the confidentiality and integrity of processing systems and services, thereby violating the provisions of Article 32(1)(b) and (2) of Regulation (EU) 2016/679.
At the same time, pursuant to Article 58(2)(d) of the Regulation, the controller was ordered to implement corrective measures to establish monitoring/logging of access to the IT infrastructure used for the processing of personal data, including a retention period for access logs of at least 30 days, as well as the implementation of a backup process for these logs. Legal and Communications Directorate A.N.S.P.D.C.P