ANSPDCP (Romania) - 20.02.2026
| ANSPDCP - 20.02.2026 | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 83(5)(e) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | 20.02.2026 |
| Fine: | 10,190 RON |
| Parties: | SC Hayat Dent SRL |
| National Case Number/Name: | 20.02.2026 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | ANSPDCP (in RO) |
| Initial Contributor: | dt |
The DPA fined a dental clinic RON 10,190 (€2,000) for failing to cooperate during an investigation following a data breach. The data breach involved an ex-employee copying the clinic’s patient database in order to set up appointments at a different clinic.
English Summary
Facts
SC Hayat Dent SRL, a dental clinic (the controller), notified the Romanian DPA (ANSPDCP) that a former employee copied the contact details and medical records of all the clinic’s patients and later on contacted them to set up new appointments at a different clinic.
The DPA launched an investigation into the incident.
Holding
Initially, the DPA issued a warning to the controller for failing to provide the requested information and an order to allow access to the DPA to all the personal data and information requested.
However, the controller failed to comply with the order.
Therefore, the DPA fined the controller RON 10,190 (€2,000) for violating Article 83(5)(e) GDPR and ordered once again the controller to provide access to the requested information, as well as to respond to all of the DPA’s inquiries.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
20.02.2026 Sanction for violation of the GDPR The National Supervisory Authority for Personal Data Processing completed an investigation in February 2026 at the operator SC Hayat Dent SRL and found a violation of the provisions of art. 83 paragraph (5) letter e) of Regulation (EU) no. 2016/679. As such, the operator was sanctioned with a fine in the amount of 10,190 lei (the equivalent of 2,000 euros). The investigation was initiated following a complaint received from the administrator of the company in question, reporting that a former employee of the operator copied the contact details and medical files of all the company's patients, who were subsequently contacted for rescheduling at a new clinic. During the investigation, the operator did not respond to all the information requested, repeatedly, by the National Supervisory Authority for the Processing of Personal Data. In a first stage, since the operator did not provide the information requested by our institution, it was sanctioned with a warning. At the same time, a corrective measure was ordered, consisting of the National Supervisory Authority's access to the personal data and all the requested information. Since the operator SC Hayat Dent SRL did not carry out the previously ordered measure within the deadline established by the authority, the investigation continued. Given that the operator did not provide proof of the fulfillment of the corrective measure, the National Supervisory Authority for the Processing of Personal Data sanctioned SC Hayat Dent SRL with a fine for violating the provisions of art. 83 par. (5) let. e) of Regulation (EU) no. 2016/679. At the same time, the operator was ordered to take the corrective measure of allowing the National Supervisory Authority for Personal Data Processing access to personal data and all information necessary to perform its tasks and to provide, in a timely manner, all the information that the supervisory authority requested through its addresses, necessary for resolving the issues notified. Legal and Communication Department A.N.S.P.D.C.P.
