The National Supervisory Authority for Personal Data Processing of Romania (ANSPDCP) has published its activity report for the year 2025, summarizing its control, advisory, and international activities.

In 2025, the authority handled 12,297 complaints, reports, and security incident notifications, leading to 488 investigations. These resulted in 105 fines totaling 2,565,020 lei (equivalent to €511,400), as well as 145 warnings and 182 corrective measures. The reported incidents mainly concerned loss of confidentiality, unauthorized access to data, including online, and non-compliance with data protection principles by design and by default. Complaints mostly related to violations of data subject rights, disclosure of data to third parties, receipt of unsolicited commercial messages, and use of video surveillance systems.

On the advisory front, ANSPDCP issued 934 opinions on the interpretation of the GDPR and gave 84 opinions on legislative projects under Article 57, paragraph 1, point c) of the GDPR. The authority faced 55 new legal actions, of which 35 challenged its sanction reports, representing about 33% of the fines imposed. Regarding international transfers, it analyzed 35 requests for approval of binding corporate rules (BCR), acted as co-examiner for 7 others, and participated in drafting European Data Protection Board (EDPB) opinions on 6 sets of rules.