Since 2025, cybersecurity is no longer only a technical matter. For many Romanian companies it has become a legal duty with a regulator, deadlines and fines, and for everyone else GDPR has long required adequate technical measures.
OUG 155/2024 applies to entities in essential sectors, such as energy, transport, banking, health, water, digital infrastructure, IT service management and public administration, and in important sectors, such as postal services, waste, chemicals, food, medical devices, digital providers and research. Classification depends on sector and size, with exceptions for some providers. Entities register with DNSC, name a contact person, carry out a risk assessment and apply the minimum measures.
A significant incident, one that seriously disrupts a service or causes major damage, goes to DNSC in three steps: an early warning within 24 hours of detection, a notification within 72 hours assessing severity, and a final report one month later, or after handling if the incident is still ongoing. Management approves and supervises the measures and answers for non-compliance. The most serious breaches are fined up to 10 million euros or 2 % of worldwide annual turnover for essential entities, and 7 million or 1.4 % for important ones, whichever is higher; other offences carry lower fixed caps.
An online shop, a clinic or a SaaS company with ten employees usually falls outside OUG 155/2024, but it processes personal data, so GDPR applies. Article 32 asks for measures appropriate to the risk and names encryption, the ability to restore data and regular testing. Article 33 requires notifying ANSPDCP within 72 hours of learning about a breach, and Article 34 requires informing individuals when the risk is high. The controls in this guide are exactly what you will be asked to demonstrate.
| Aspect | NIS2 (OUG 155/2024, Law 124/2025) | GDPR (EU Regulation 2016/679) |
|---|---|---|
| Who it applies to | Essential and important entities in the listed sectors, depending on size | Any company that processes personal data |
| Authority | DNSC | ANSPDCP |
| Core duty | Registration, risk assessment, minimum measures, training | Technical and organisational measures appropriate to the risk (Article 32) |
| Incident notification | 24 h early warning, 72 h notification, final report one month later | 72 h to ANSPDCP (Article 33), individuals when the risk is high (Article 34) |
| Liability | Management, personally | The controller and, where relevant, the processor |
| Maximum fines | Most serious breaches: 10 million euros or 2 % of worldwide turnover (essential), 7 million or 1.4 % (important), whichever is higher; other offences have fixed caps | 20 million euros or 4 % of worldwide turnover, whichever is higher |
The company administers servers for fifty customers, which places it in the IT service management sector. It registered with DNSC, appointed a security lead, completed the risk assessment and wrote a procedure for the 24-hour notification.
Healthcare is an essential sector under NIS2, but a small clinic is below the size threshold. It stays under GDPR for patient data: it documented the Article 32 measures, tested a backup restore and rehearsed the ANSPDCP notification procedure.
Check two things: whether your main activity falls in a sector listed in the annexes of OUG 155/2024, and whether the company reaches medium-enterprise size under Law 346/2004, which Article 8 refers to: 50 to 249 employees and annual net turnover of up to 50 million euros. Some categories, such as central public administration, apply regardless of size.
No. The provider answers for its own infrastructure and, under GDPR, acts as your processor under a contract. Registration with DNSC, the measures on your servers, the notifications and management training remain yours.
Under NIS2, failing to notify is a separate offence that can be fined on its own, and DNSC can order measures and run inspections. Under GDPR, ANSPDCP has fined late or incomplete notification regardless of how serious the breach was. Notifying on time, even with partial information, is the better position.
A production server starts getting attacked within minutes of receiving a public IP address, however small the project is. This guide ranks the controls by impact, from SSH access to incident response, with the Romanian rules that apply along the way. Every topic has its own page with a short answer, examples and ready-to-use configuration.
