Romania

Națională Poșta Română

5,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2026-06-12.

Rank · Sector

#143

of 176 in Transportation and Energy

Rank · Romania

#100

of 292

Rank · All fines

#1,900

of 3,127

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2026-06-12
Controller / Processor: Națională Poșta Română
Sector: Transportation and Energy
Quoted Articles: Art. 32 (1) b), (2), (4) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Romanian DPA has imposed a fine of EUR 5,000 on the Națională Poșta Română. The controller suffered a data breach which resulted in postal items beeing destroyed, which caried personal data. The data breach resulted due to the fact, that the controller failed to ensure that its employees only processed the data they had to process in the context of their tasks.

Open original source Links to the regulator's original publication or another source.