ANSPDCP (Romania) - Fine against GEROCOSSEN S.R.L.

ANSPDCP - Fine against GEROCOSSEN S.R.L.
Authority:	ANSPDCP (Romania)
Jurisdiction:	Romania
Relevant Law:	Article 32(1)(b) GDPR Article 32(2) GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:
Published:	28.08.2026
Fine:	26236.50 RON
Parties:	GEROCOSSEN S.R.L.
National Case Number/Name:	Fine against GEROCOSSEN S.R.L.
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Romanian
Original Source:	ANSPDCP (in RO)
Initial Contributor:	cerasela

The Romanian DPA imposed a RON 26,236.50 (€5,000) fine on a cosmetics retailer for infringing Article 32 GDPR by failing to implement adequate security measures, after a cyberattack affecting its IT infrastructure led to a personal data breach.

English Summary

Facts

Gerocossen SRL (the controller) suffered a cyberattack that affected its IT infrastructure. As a result, unauthorised parties gained access to personal data relating to some data subjects, including identification and contact details.

Holding

The DPA found that the controller infringed Article 32(1)(b) GDPR and Article 32(2) GDPR by failing to implement adequate technical and organisational measures in order to ensure the confidentiality and integrity of its processing systems and services.

In particular, the DPA considered that the controller had failed to adopt security measures appropriate to protect personal data processed through its IT infrastructure.

In addition, as a corrective measure pursuant to Article 58(2)(d) GDPR, the DPA ordered the controller to implement access monitoring and logging systems within the IT infrastructure used for personal data processing. The authority further required the controller to retain access logs for at least 30 days and to introduce backup procedures for those logs.

Finally, the Romanian DPA fined the controller €5,000 (RON 26,236.50).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.

August 28, 2026

Penalty for GDPR Violation

 

In July 2026, the National Supervisory Authority for Personal Data Processing concluded an investigation into the data controller GEROCOSSEN  S.R.L. and found a violation of the provisions of Article 32(1)(b) and (2) of Regulation (EU) 2016/679.

As a result, the data controller was fined 26,236.50 lei, equivalent to 5,000 euros.

The investigation was initiated following the submission by the data controller, GEROCOSSEN S.R.L., of a notification of a personal data breach, in accordance with the provisions of Article 33 of Regulation (EU) 2016/679.

The data breach occurred as a result of a cyberattack on the controller’s IT infrastructure, a situation that led to the unauthorized disclosure of or unauthorized access to personal data belonging to data subjects (identification data, contact information).

During the investigation, it was found that the controller had not implemented adequate technical and organizational measures to ensure a level of security appropriate to the risk posed by the processing, including the ability to ensure the confidentiality and integrity of processing systems and services, thereby violating the provisions of Article 32(1)(b) and (2) of Regulation (EU) 2016/679.

At the same time, pursuant to Article 58(2)(d) of the Regulation, the controller was ordered to implement corrective measures to establish monitoring/logging of access to the IT infrastructure used for the processing of personal data, including a retention period for access logs of at least 30 days, as well as the implementation of a backup process for these logs.

 

Legal and Communications Directorate

A.N.S.P.D.C.P