INTRA/RORomania

What the record establishes for Romania, measure by measure, and what each source requires of the measure it governs.

Binding: 19
Recommended: 0
Reported: 0
Measures touched: 19 of 110
Sources cited: 4

Control	Source	What it establishes	Prerequisite or recommendation
19Mandatory
AW001/RO Workforce awareness on insider riskMandatory	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, the entity ensures professional training of all personnel to a sufficient level of knowledge and skills, and basic cyber hygiene and training are among the measures.
AW002/RO Transparency notice on what is observedMandatory	Legea nr. 190/2018, articolul 5Parlamentul României · read 5 Oct 2026Legea nr. 361/2022 privind protecția avertizorilor în interes public, articolele 7, 9, 10, și 36Parlamentul României · read 5 Oct 2026	That monitoring by electronic communications or video surveillance at the workplace on the employer’s legitimate interest is lawful only on five cumulative conditions, among them prior consultation of the union or the employee representatives, prior complete and explicit information of the employees, proof that less intrusive means have failed, and a retention of no more than 30 days.	Before monitoring by electronic communications or video surveillance, the employer gives the employees prior information that is mandatory, complete, and explicit. The designated person and the means of internal reporting are brought to every employee’s knowledge by display on the website and at the premises.
AW003/RO Role-specific trainingMandatory	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, the members of the management bodies follow accredited professional training sufficient to identify risks and assess the risk management practices and their impact on the services.
CP001/RO Disciplinary action on monitoring evidenceMandatory	Sancțiune pentru încălcarea RGPD, ROUMASPORT SRLANSPDCP · read 5 Oct 2026	That accessing the workplace video surveillance system and processing the images of employees for their disciplinary investigation breached the principles of lawfulness and purpose and the conditions of lawfulness, read with article 5 of Law 190/2018, and drew a fine of 24,887 lei (5,000 EUR) and a corrective measure on the use of video monitoring in disciplinary investigations.	A disciplinary investigation that relies on images from the workplace video surveillance system processes personal data, and on the facts the processing was unlawful; the corrective measure requires compliance of video monitoring especially where disciplinary investigations are conducted.
DP004/RO Access control and least privilegeMandatory	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, the measures include access control policies and asset management.
DP012/RO Retention and disposal of program recordsMandatory	Legea nr. 190/2018, articolul 5Parlamentul României · read 5 Oct 2026Legea nr. 361/2022 privind protecția avertizorilor în interes public, articolele 7, 9, 10, și 36Parlamentul României · read 5 Oct 2026	That monitoring by electronic communications or video surveillance at the workplace on the employer’s legitimate interest is lawful only on five cumulative conditions, among them prior consultation of the union or the employee representatives, prior complete and explicit information of the employees, proof that less intrusive means have failed, and a retention of no more than 30 days.	Data from workplace monitoring by electronic communications or video surveillance are kept no longer than 30 days, save where the law expressly provides otherwise or a case is duly justified. Reports received through the internal channel are entered in an electronic register and kept for 5 years, then destroyed whatever the medium.
GV001/RO Program charter and mandateMandatory	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, the management bodies approve the cybersecurity risk management measures, supervise their implementation, and are responsible for breaches; they designate, where applicable, the persons responsible for the security of networks and information systems, who in essential entities other than public administration and small enterprises hold managerial authority.
GV007/RO Lawful basis registerMandatory	Legea nr. 190/2018, articolul 5Parlamentul României · read 5 Oct 2026	That monitoring by electronic communications or video surveillance at the workplace on the employer’s legitimate interest is lawful only on five cumulative conditions, among them prior consultation of the union or the employee representatives, prior complete and explicit information of the employees, proof that less intrusive means have failed, and a retention of no more than 30 days.	Monitoring by means of electronic communications or video surveillance at the workplace on the employer’s legitimate interest is permitted only where the interest is duly justified and prevails over the rights of the persons concerned, the employees have received prior, mandatory, complete, and explicit information, the union or the employee representatives have been consulted before the system is introduced, less intrusive forms have previously proven ineffective, and retention is proportionate and no longer than 30 days save where the law provides otherwise or a case is duly justified.
GV010/RO Worker representative engagementMandatory	Legea nr. 190/2018, articolul 5Parlamentul României · read 5 Oct 2026	That monitoring by electronic communications or video surveillance at the workplace on the employer’s legitimate interest is lawful only on five cumulative conditions, among them prior consultation of the union or the employee representatives, prior complete and explicit information of the employees, proof that less intrusive means have failed, and a retention of no more than 30 days.	The employer consults the union or, where there is none, the employee representatives before introducing a monitoring system by electronic communications or video surveillance; the article states the consultation as a condition of lawfulness and does not state what it has to produce.
GV013/RO Periodic program reviewMandatory	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, an annual self-assessment of the maturity of the risk management measures, assumed by management, goes to the DNSC and, where applicable, to the sectoral authority; essential entities send a remediation plan within 30 days of it.
IR001/RO Insider incident playbooksMandatory	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, incident handling is among the measures, and the comprehensive approach includes logging and traceability of all activities.
IR006/RO Notification to a supervisory authorityMandatory	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, a significant incident, one causing or able to cause serious operational disruption or financial loss, or considerable damage to others, is reported to the national CSIRT in an early warning within 24 hours, a notification within 72 hours, and a final report within one month of the notification.
IV001/RO Internal reporting channelMandatory	Legea nr. 361/2022 privind protecția avertizorilor în interes public, articolele 7, 9, 10, și 36Parlamentul României · read 5 Oct 2026	That a private legal person with at least 50 employees, and a public one at any size, identifies or sets up internal reporting channels and procedures for follow-up, that those of 50 to 249 may share resources and were reached on 17 December 2023, that the procedure holds confidentiality of the reporter and of any third party named, acknowledgement within 7 calendar days, a designated impartial and independent person, department, or third party, feedback within 3 months, and that reports are kept in a register for 5 years and then destroyed.	A private legal person with at least 50 employees, and a public body at any size, identifies or sets up internal reporting channels and procedures for follow-up; those of 50 to 249 may share resources and were reached on 17 December 2023; the procedure protects the confidentiality of the reporter and of any third party named and bars unauthorized staff, acknowledges receipt within 7 calendar days, designates an impartial and independent person, department, or third party, gives feedback within 3 months, and the designated person and the means of reporting are displayed on the website and at the premises, with at least one means accessible at any moment.
IV008/RO Use of records held for other purposesMandatory	Sancțiune pentru încălcarea RGPD, ROUMASPORT SRLANSPDCP · read 5 Oct 2026	That accessing the workplace video surveillance system and processing the images of employees for their disciplinary investigation breached the principles of lawfulness and purpose and the conditions of lawfulness, read with article 5 of Law 190/2018, and drew a fine of 24,887 lei (5,000 EUR) and a corrective measure on the use of video monitoring in disciplinary investigations.	Images from a workplace video surveillance system used for the disciplinary investigation of employees were, on the facts, processed in breach of the principles of lawfulness and purpose; the release does not say on what conditions such a use would stand.
MD002/RO Log collection and centralizationMandatory	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, the comprehensive approach the measures have to hold includes the logging and traceability of all activities in the networks and information systems.
MD006/RO Electronic mail and collaboration monitoringMandatory	Legea nr. 190/2018, articolul 5Parlamentul României · read 5 Oct 2026	That monitoring by electronic communications or video surveillance at the workplace on the employer’s legitimate interest is lawful only on five cumulative conditions, among them prior consultation of the union or the employee representatives, prior complete and explicit information of the employees, proof that less intrusive means have failed, and a retention of no more than 30 days.	Monitoring by means of electronic communications at the workplace rests on the five conditions of article 5: justified prevailing interest, prior complete and explicit information, consultation of the union or representatives, prior failure of less intrusive means, and retention within 30 days.
MD007/RO Retention of communications metadataMandatory	Legea nr. 190/2018, articolul 5Parlamentul României · read 5 Oct 2026	That monitoring by electronic communications or video surveillance at the workplace on the employer’s legitimate interest is lawful only on five cumulative conditions, among them prior consultation of the union or the employee representatives, prior complete and explicit information of the employees, proof that less intrusive means have failed, and a retention of no more than 30 days.	Personal data from monitoring by means of electronic communications are kept for a period proportionate to the purpose and no longer than 30 days, save express legal provision or a duly justified case.
MD014/RO Video surveillance of the workplaceMandatory	Legea nr. 190/2018, articolul 5Parlamentul României · read 5 Oct 2026Sancțiune pentru încălcarea RGPD, ROUMASPORT SRLANSPDCP · read 5 Oct 2026	That monitoring by electronic communications or video surveillance at the workplace on the employer’s legitimate interest is lawful only on five cumulative conditions, among them prior consultation of the union or the employee representatives, prior complete and explicit information of the employees, proof that less intrusive means have failed, and a retention of no more than 30 days.	Video surveillance at the workplace on the employer’s legitimate interest rests on the five conditions of article 5, the 30-day retention among them. Accessing the workplace video surveillance system and processing the images of employees, including for their disciplinary investigation, breached articles 5(1)(a), 5(1)(b), and 6(1) of the Regulation read with article 5 of Law 190/2018; the fine was 24,887 lei (5,000 EUR), with a corrective measure on video monitoring in disciplinary investigations.
PS001/RO Pre-employment screeningMandatory	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, the measures include human resources security, access control policies, and asset management, without the ordinance saying what human resources security holds.