Romania

Unicredit Bank SA

12,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2026-05-29.

Rank · Sector

#191

of 322 in Finance, Insurance and Consulting

Rank · Romania

#35

of 283

Rank · All fines

#1,289

of 3,042

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2026-05-29
Controller / Processor: Unicredit Bank SA
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 32 (1) b), (2), (4) GDPR, Art. 33 (1) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Romanian DPA has imposed a fine of EUR 12,000 on Unicredit Bank SA. The controller sent notifications to customers via mobile messaging, online banking and email. Due to an error in processing a file, these notifications included the personal data of other customers, including information about mortgages or insurance policies. The controller also failed to notify the DPA within the 72-hour deadline.

Open original source Links to the regulator's original publication or another source.