Romania

S.P.E.E.H. HIDROELECTRICA SA

5,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2025-10-20.

Rank · Sector

#147

of 185 in Transportation and Energy

Rank · Romania

#101

of 302

Rank · All fines

#1,964

of 3,275

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2025-10-20
Controller / Processor: S.P.E.E.H. HIDROELECTRICA SA
Sector: Transportation and Energy
Quoted Articles: Art. 32 (1) b), d), (4) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Romanian DPA has imposed a fine of EUR 5,000 on S.P.E.E.H. HIDROELECTRICA SA. A technical error in the controller's computer systems was exploited by attackers to cause a cyber incident.

Open original source Links to the regulator's original publication or another source.