ANSPDCP Romania: GDPR Risks in BPO
Romania's privacy authority is stepping up GDPR enforcement. The Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) covers one of the EU's fastest-growing outsourcing sectors.
Bucharest, Cluj-Napoca, and Iași all process EU citizen records from Germany, France, the UK, and the Netherlands. ANSPDCP issued €1.8 million in GDPR fines from 2022 to 2024. BPO and outsourcing firms were in most of those cases.
BPO Exposure: Four Core Risk Areas
High-volume personal records. Call centers handle billing disputes. They process names, addresses, account numbers, and payment history. IT support teams access customer systems. Those systems hold personal information.
EU citizen records processed abroad. Affected people are often German, French, Dutch, or British. When a breach occurs, they go to their home regulator. That adds BfDI, CNIL, ICO, or AP NL exposure on top of ANSPDCP's own. For more on cross-border cases, see our BFDI Germany GDPR guide.
Weak subprocessor chains. ANSPDCP found 45% of local firms lack valid Data Processing Agreements with their subprocessors. Each DPA must list the technical steps the subprocessor will take.
Access revocation gaps. BPO has high staff turnover. ANSPDCP finds former staff with active access weeks after leaving. This shows up in case after case.
The CNP: Romania's Key Identifier
The Cod Numeric Personal (CNP) is a 13-digit national ID number. It stores key personal facts:
- Digit 1: Gender and birth century (1=male 1900–1999, 2=female 1900–1999, 5=male 2000+, 6=female 2000+, 7=male foreign resident, 8=female foreign resident)
- Digits 2–7: Birth date (YYMMDD)
- Digits 8–9: County of birth code
- Digits 10–12: Sequential number
- Digit 13: Check digit (weighted modulus 11)
The CNP stores gender, birth date, birth region, and residency status. This makes it far richer than most EU IDs. ANSPDCP has placed CNP close to special-category status.
The detection gap. ANSPDCP's 2024 review found that 78% of PII tools at outsourcing firms fail to detect CNP. Most lack checksum checks. CNP numbers in customer records and employee files go unnoticed. Records sent to parent firms may contain live citizen details. Post-breach reviews reveal CNP in files labeled "anonymized."
Enforcement Focus: 2024–2025
Call center audio. ANSPDCP has targeted recordings with no retention plan or access controls. Keeping audio "indefinitely for compliance" with no deletion schedule violates GDPR.
Healthcare outsourcing. Firms that process medical records, claims, or prescription files face the highest risk. Health records are Article 9 special category. They need explicit legal basis, a DPIA, and strong technical controls.
Access logging. ANSPDCP audits find weak logs. Firms cannot show which records were accessed, by whom, or when. Logs must be full enough to scope a breach after it happens.
Language: A Hidden Gap
Local documents contain identifiers that generic tools miss.
Cartea de identitate (CI). This is the national ID card. It has its own number format. Scanned copies in onboarding files need specific detection logic.
Language-specific NER. Support tickets and customer messages need NLP built for this language. English-trained tools perform poorly here.
Address formats. Terms like Strada, Bulevardul, and Numărul are unique to this market. Models trained on English or German often miss them.
For steps to meet ANSPDCP's standard, see our guide on anonymization consistency for GDPR audits.
What BPO Firms Need
Four things cover ANSPDCP's technical standard:
- CNP detection with checksum validation
- Cartea de identitate and passport detection
- Language-specific NER
- Subprocessor agreements with named technical steps