# S.C. Hayat Medical & Dental S.R.L.: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
- Date: 2026-10-28
- Original: https://www.enforcementtracker.com/ETid-3403
- Canonical: https://overview.legal/posts/607213
- Topics: Supervision, Personal Data, Supervisory Authorities, Transparency, Health Data

## Summary

The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined S.C. Hayat Medical & Dental S.R.L. €5,000 for processing personal data without a sufficient legal basis. The investigation found the healthcare provider violated GDPR Articles 5(1)(a) and 6(1) concerning the lawfulness, fairness, and transparency of data processing. The authority exercised its investigative powers under Article 58(1)(a) and (e) to issue the sanction.

## Full text

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined S.C. Hayat Medical & Dental S.R.L. €5,000 on 2026-10-28 for: Insufficient legal basis for data processing.
GDPR Articles: Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 58 (1) a), e) GDPR
Sector: Health Care
Country: Romania
Source: https://www.dataprotection.ro/?page=Comunicat_Presa_28_10_2026

## Cited law provisions (9)

### GDPR — gdpr-art-5-par-1-en

Personal data shall be:

### GDPR — gdpr-art-5-par-1-pnt-a-en

processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

### GDPR — gdpr-art-6-par-1-en

Processing shall be lawful only if and to the extent that at least one of the following applies:

### GDPR — gdpr-art-58-par-1-en

Each supervisory authority shall have all of the following investigative powers:

### GDPR — gdpr-art-58-par-1-pnt-a-en

to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks;

### GDPR — gdpr-art-58-par-1-pnt-e-en

to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

### GDPR — gdpr-art-5-en

Principles relating to processing of personal data

### GDPR — gdpr-art-6-en

Lawfulness of processing

### GDPR — gdpr-art-58-en

Powers

---
Generated by overview.legal · https://overview.legal/posts/607213 · 2026-11-14