ANSPDCP Romania: CNP Detection and GDPR Checks
Updated for 2026
Romania's data body is ANSPDCP. Its 2024 assessment found that 78% of PII tools fail to detect the Cod Numeric Personal (CNP). Most skip the checksum step. That gap creates real compliance risk. Romania processes EU data for many Western clients. The exposure is wide.
Romania's Most Data-Rich National ID
The CNP is a 13-digit national identifier. Each digit group holds personal data:
- Digit 1: Gender and century code. Male born 1900–1999 = 1. Female born 1900–1999 = 2. Male born 2000+ = 5. Female born 2000+ = 6. Male foreign resident = 7. Female foreign resident = 8. Other resident = 9.
- Digits 2–3: Last two digits of birth year.
- Digits 4–5: Birth month (01–12).
- Digits 6–7: Birth day (01–31).
- Digits 8–9: County code. Covers 41 counties and Bucharest's six sectors (codes 01–52).
- Digits 10–12: Birth order within that day and county.
- Digit 13: Check digit.
Digit 1 alone reveals biological sex. Under GDPR Article 9, that makes this number a special-category data item. It needs stronger protection than ordinary personal data.
How the check digit works: Take the first 12 digits. Multiply each by its weight (2, 7, 9, 1, 4, 6, 3, 5, 8, 2, 7, 9). Add the results. Divide by 11 and take the remainder. A remainder of 10 gives check digit 1. A remainder of 11 means the code is not valid. Any other remainder is the check digit.
Tools that skip this test have two failure modes. First, any 13-digit string gets flagged as a match (false positives). Second, a corrupted number passes the pattern check but holds bad data. That data needs review and gets missed (false negatives).
NER Problems in Romanian-Language Documents
Finding identifiers is only part of the work. Romanian text adds more detection hurdles.
Diacritics: Romanian uses ș, ț, ă, â, and î. Tools trained on other languages often miss names with these letters. Old documents in Latin-2 encoding add more failures.
Address formats: Street types use short forms — Str., Bd., Al., Cal. City and commune names follow local rules. Parsers built for French or German addresses do poorly here.
Name inflection: Names change form by grammatical case in Romanian. The same person's name looks different in different parts of a sentence. NER models must handle this to link names across a document.
See our APAC PII detection guide for how language gaps affect detection across non-Western scripts.
How ANSPDCP Cases Develop
ANSPDCP cases show three patterns.
BPO breach cases: Shared files hold employee ID numbers and EU customer data with no encryption. Poor logs mean the firm cannot tell which records were accessed. That extends the probe and raises the fine.
Healthcare exposure: Patient files — the national ID, health card ID, and diagnosis — reach the wrong person. The PII tool had no support for this format. The data left without masking.
Cross-border transfer failures: An outsourcing firm sends identifier-linked records to a non-EEA party. No Transfer Impact Assessment. No Standard Contractual Clauses. The Article 9 status of the data turns a routine gap into a more serious violation.
Three Controls for ANSPDCP Compliance
These three form the minimum technical baseline:
- CNP detection with modulo-11 validation — pattern matching alone is not enough.
- Diacritic-aware NER — cover ș, ț, ă, â, and î in both UTF-8 and Latin-2 sources.
- ID card detection — the national card appears alongside the CNP in many document types.
For a wider view of how national IDs create GDPR risk, see our EU national tax ID detection guide.