﻿Page 1 
LAW no. 129 of June 15, 2018 for amending and supplementing the Law 
no. 102/2005 on the establishment, organization and functioning of the Authority 
National Supervisors for the Processing of Personal Data, 
as well as for the abrogation of Law no. 677/2001 for protection 
persons regarding the processing of personal data and 
free movement of this data 
The Romanian Parliament adopts this law. 
Article I 
Law no. 102/2005 on the establishment, organization and functioning of the Authority 
National Office for the Supervision of Personal Data Processing, published 
in the Official Gazette of Romania, Part I, no. 391 of May 9, 2005, as amended 
and subsequent additions, are amended and supplemented as follows: 
1. In Article 1, paragraph 3 is amended to read as follows: 
"(3) The tasks of the National Supervisory Authority are mainly 
regulated by Regulation (EU) 2016/679 of the European Parliament and of the 
Council of 27 April 2016 on the protection of individuals with regard to 
regarding the processing of personal data and regarding the free movement of 
these data and repealing Directive 95/46 / EC (General Regulation 
on data protection), published in the Official Journal of the European Union, L series, 
no. 119 of 4 May 2016, hereinafter referred to as the General Regulation on 
data protection, and through national legislation transposing Directive (EU) 
2016/680 of the European Parliament and of the Council of 27 April 2016 on 
protection of individuals with regard to the processing of personal data 
by the competent authorities for the purpose of prevention, detection, investigation or 
criminal prosecution of crimes or execution of sentences and on release 
circulation of these data and repealing Framework Decision 2008/977 / JHA a 
Council, published in the Official Journal of the European Union series L no. 119 of 4 
May 2016. " 
2. In Article 1, paragraph (3) insert a new paragraph (3 January ), with 
the following content: 
"(3 1 ) For the fulfillment of its attributions it shall be ensured to the National Authority of 
supervision, at an appropriate level, of human, technical and financial resources, 
headquarters and infrastructure. " 
3. In Article 2, paragraph 3 is amended to read as follows: 
"3. The national supervisory authority may not be subject to any mandate 
imperative or representative, no direct or indirect external influences or 
any instruction or disposition from an external party in the performance 
tasks and the exercise of its powers. " 
4. In Article 3, paragraphs 5 and 7 are amended to read as follows: 
"(5) In the exercise of his attributions the president of the National Authority of 
supervision issues binding decisions and instructions to the authorities and 
public institutions, legal persons governed by private law and any other bodies, 
as well as for natural persons whose activity falls under the legislation 
Page 2 
on the protection of individuals with regard to the processing of data with 
personal, hereinafter referred to as entities . 
............................. 
(7) In exercising the legal attributions of the National Supervisory Authority, 
the entities provided in par. (5) are obliged to provide the requested support and to 
communicate or, where appropriate, make available information, documents or 
the documents they hold, in accordance with the law. " 
5. In Article 5, paragraph 2 is amended to read as follows: 
"(2) The annual report shall be sent to the Romanian Senate, to the Chamber of Deputies, 
The Government of Romania, the European Commission and the European Committee for Protection 
data. The annual report shall be published no later than 30 days from the date 
transmission to the Romanian Senate. " 
6. In Article 6, paragraph 2 is amended to read as follows: 
"(2) May be appointed as President or Vice - President of the Authority 
national person of supervision any person with Romanian citizenship, graduate of 
a legal higher education institution, in accordance with the law. The President and 
the vice-president are politically independent persons with solid competence 
professional, including in the field of personal data protection, o 
at least 10 years of experience in the specialty, a good reputation and enjoying 
a high civic probity. " 
7. Article 9 is amended to read as follows: 
"Art. 9 
(1) The mandate of the president, respectively of the vice - president of the National Authority of 
supervision shall cease prematurely in the event of resignation, revocation of 
function, incompatibility with other public or private functions, impossibility to 
perform the duties of more than 90 days, established by medical examination of 
specialty, in case of ex officio retirement or in case of death. 
(2) The dismissal of the president, respectively of the vice-president of the Authority 
national oversight is done by the full Senate as a result of the violation 
serious breaches of the provisions of this law, if it no longer meets the conditions required by 
law for appointment or in case of serious misconduct in the performance of duties. 
(3) Resignation, incompatibility, fulfillment of retirement conditions for 
age limit provided by law, impossibility to perform his function 
the death is ascertained by the Permanent Bureau of the Senate, in maximum 15 days of 
upon the occurrence of the cause that determines the termination of the mandate. 
(4) The period of fulfilling the function of president and vice-president of the Authority 
national supervisory authority is seniority in law. " 
8. Article 10 is amended to read as follows: 
"Art. 10 
1. The Chairperson of the National Supervisory Authority shall mainly 
the following attributions: 
a) organizes and coordinates the activity of the National Supervisory Authority; 
b) ensures the monitoring of the application of the General Regulation on protection 
data; 
Page 3 
c) ensures the monitoring of the application of the national legislation transposing the Directive 
(EU) 2016/680 of the European Parliament and of the Council on protection 
natural persons regarding the processing of personal data by 
competent authorities for the purpose of prevention, detection, investigation or prosecution 
criminal offenses or the execution of sentences and on the free movement of 
these dates and repealing Council Framework Decision 2008/977 / JHA ; 
d) ensures the monitoring of the application and other legal provisions regarding the processing 
personal data and the free movement of such data; 
e) may make proposals regarding the initiation of draft normative acts or 
modification of the normative acts in force in fields related to data processing 
personal; is requested, in order to issue opinions, on behalf of 
National Supervisory Authority, when drafting documents 
norms regarding the protection of the rights and freedoms of persons, regarding 
processing of personal data; 
f) receives and pursues the settlement, in accordance with the law, of petitions and requests 
addressed to the National Supervisory Authority and decides on them; 
g) employs, in accordance with the law, the staff of the National Supervisory Authority 
and exercises the right of administrative and disciplinary authority over them; 
h) exercises the function of main authorizing officer; 
i) ensures the cooperation with similar institutions from abroad and the representation in 
within the European Data Protection Board, provided in art. 68 of 
General Data Protection Regulation; 
j) fulfills other attributions provided by the present law, by the normative acts 
which regulates the activity of personal data processing and 
free movement of such data and the Regulation on the organization and functioning of 
National Supervisory Authority. 
(2) Within the National Supervisory Authority it is organized and operates 
the President 's Office, and his staff shall be employed in 
the conditions of the law. " 
9. In Article 12, paragraph 1 is amended to read as follows: 
"Article 12 
(1) The President of the National Supervisory Authority shall exercise his / her duties as 
ex officio or on-demand control. " 
10. Article 13 is repealed. 
11. After Article 14, two new chapters are introduced, Chapter III 1 , comprising 
Articles 14 1 -14 8 , and Chapter III 2 , comprising Articles 14 9 -14 11 , with the following 
contents: 
"CHAPTER III 1 : Exercising the powers of control and resolution of complaints 
SECTION 1: Control activity 
Article 14 1 
1. The national supervisory authority shall carry out investigations in cases and 
the conditions laid down in its competence, by the staff empowered for that purpose, 
by law, by the chairman of the National Supervisory Authority, appointed 
further control personnel. 
Page 4 
(2) Control staff have the right to carry out investigations, including unannounced, 
to request and obtain from the operator and the person authorized by the operator, 
as well as, as appropriate, from their representative, on the spot and / or in 
the deadline, any information and documents, regardless of the storage medium, 
to pick up copies from them, to have access to any of the operator's premises 
and the person authorized by the operator, as well as to have access to and verify anything 
equipment, means or data storage medium, necessary for the deployment 
investigation, in accordance with the law. 
(3) In the situation where the control personnel is prevented in any way in 
exercising the attributions provided in par. (2), National Authority of 
supervision may request judicial authorization by conclusion by 
the president of the Bucharest Court of Appeal or by a judge delegated by him. 
A copy of the judicial authorization must be communicated to the previously controlled entity 
from the beginning of the investigation. 
(4) The application for authorization shall be judged in the council chamber, without summoning the parties. 
The judge shall rule on the application for authorization within a maximum of 48 days 
hours from the date of registration of the application. The conclusion is motivated and communicated 
The national supervisory authority and the controlled entity within a maximum of 
48 hours after pronunciation. 
(5) If the investigation is to be conducted, including simultaneously, in May 
many premises owned by the controlled entity, the National Authority for 
supervision will introduce a single request, the court ruling by a 
conclusion in which the spaces in which it is to take place will be indicated 
investigation. 
(6) The application for authorization must contain all the information likely to 
justify the investigation, and the notified judge is required to verify whether the request 
is grounded. 
(7) The conclusion provided in par. (3) may be appealed to the High Court 
Court of Cassation and Justice, within 72 hours from its communication 
according to par. (4). The appeal is not suspensive of execution. 
(8) In all cases, the investigation may not begin before 8.00 am and may not 
continue after 18.00 and must be performed in the presence of the person to whom 
carry out the investigation or his representative. The investigation can continue as well 
after 18.00 only with the written consent of the person to whom it is performed 
or his representative. 
(9) The identification and storage of objects, as well as the sealing are done 
according to the provisions of Law no. 135/2010 on the Code of Procedure 
criminal law, with subsequent amendments and completions. 
(10) The national supervisory authority may order the performance of 
expertise and hearing of persons whose statements are considered relevant and 
necessary to carry out the investigation. 
(11) In the control activity, the National Supervisory Authority may 
orders the application of corrective measures provided in art. 58 para. (2) of 
General Data Protection Regulation, including sanctions 
Page 5 
may make recommendations and refer other authorities 
competent authorities, as appropriate. 
(12) In the case of joint operations carried out on the territory of Romania where 
staff appointed by another supervisory authority from a 
Member State of the European Union, it shall carry out its tasks within the limits 
power of attorney issued by the President of the National Supervisory Authority. 
Article 14 2 
(1) The main sanctions for minor offenses applied by the National Authority 
of supervision, according to art. 58 para. (2) lit. b) and i) of the General Regulation 
on data protection, are reprimand and fine. The application of the fine is made in 
the conditions of art. 83 of the General Data Protection Regulation. 
(2) Where there is a possibility that through the processing operations that 
an operator or a person authorized by the operator intends to 
carry out, in breach of applicable law, the National Authority for 
supervision issues a warning, according to art. 58 para. (2) lit. a) of the Regulation 
general data protection law. 
(3) Depending on the circumstances of each case, the measures provided in par. (1) and (2) 
may be applied separately or in conjunction with other corrective measures provided for in 
art. 58 para. (2) of the General Regulation on data protection and art. 14 3 
para. (5) and (6) of this law. 
(4) The sanctions provided in par. (1) may be applied within 3 years from the date 
committing the act. In the case of infringements lasting over time or consisting of 
committing, based on the same resolution, at different time intervals, several 
actions or inactions, each of which has the same content 
contraventions, the prescription starts to run from the date of finding or from the date 
cessation of the last act or fact committed, if this moment occurs previously 
finding. 
(5) The limitation period provided in par. (4) is interrupted by performing 
any procedural document in the case under investigation, without exceeding 4 years from the date 
committing the act. The interruption has effects on all participants in 
committing that violation. 
(6) The fines provided in par. (1), established in euro at art. 83 para. (4) - (6) din 
The general regulation on data protection is applied and paid in lei, at 
the official exchange rate of the National Bank of Romania from the date of application. 
Article 14 3 
1. In the case of processing falling within the control competence of the Authority 
national surveillance authorities, with the exception of cross-border ones, the finding 
facts and the application of the measures provided in art. 14 2 para. (1) and (2) are made by 
minutes of finding / sanctioning concluded by the control staff. 
(2) By exception from the provisions of par. (1), if the amount of the fine 
exceeds the equivalent in lei of the amount of 300,000 euros, the fine is applied 
by decision of the President of the National Supervisory Authority, who shall 
basis the report of the finding and the report of the control staff. 
Page 6 
(3) In the case of cross-border processing which falls within the competence of the Authority 
national supervisory authorities as the lead supervisory authority, 
the ascertainment of the facts is made through a report concluded by the control staff, 
and the application of the measures provided in art. 14 2 para. (1) and (2), by decision of 
the President of the National Supervisory Authority, which is based on the 
statement of findings and report of control staff. 
(4) The provisions of par. (3) shall apply accordingly if 
the supervisory authority of a Member State of the European Union refused 
the proposal to act as the lead supervisory authority, 
submitted by the National Supervisory Authority. 
(5) The application of corrective measures consisting in the obligation of the operator or a 
the person empowered by the operator to comply with the requests of the person concerned by 
exercise of rights, to ensure the compliance of processing operations with 
the applicable legal provisions, obliging the operator to inform the data subject 
regarding a personal data breach can be committed 
through the report of finding / sanctioning concluded by the control staff 
or by decision of the Chairperson of the National Supervisory Authority. 
(6) Application of corrective measures consisting, where appropriate, in temporary limitation 
or definitively, the prohibition on processing, rectifying or deleting data with 
personal character, restriction of processing, notification of these actions 
recipients to whom personal data have been disclosed, withdrawal 
a certification or obliging the certification body to withdraw a certification 
issued or not issue a certification if the certification requirements 
are not or are no longer met, the suspension of data flows to a 
recipient from a third country or to an international organization is disposed of 
only by decision of the President of the National Supervisory Authority. 
(7) The decision must contain the following elements: data 
identification number of the National Supervisory Authority and the name 
representative legal of its, data of identification of 
the operator / person authorized by the operator, the personal numerical code, after 
the description of the facts and circumstances which may be taken into account in the case 
individualization of the measure, indication of the legal basis according to which it is established and 
sanction the deed, the corrective measures applied, the term and the method of payment 
of the fine, as the case may be, the term for exercising the appeal and the court 
competence. 
Article 14 4 
(1) Against the minutes of finding / sanctioning and / or the decision of 
application of corrective measures, as appropriate, by the operator or the authorized person 
of the operator may file an appeal to the administrative litigation section a 
the competent court, within 15 days from the handing over, respectively from 
communication. The decision resolving the appeal can only be challenged 
with appeal. The appeal is judged by the competent court of appeal. In all cases, 
the competent courts are those in Romania. 
Page 7 
(2) The minutes of finding / sanctioning or the decision of the president of the Authority 
uncontested national surveillance within 15 days from the date 
handing over, respectively communication, constitutes an enforceable title without any other 
formality. The introduction of the appeal provided in par. (1) suspend payment only 
fine, pending a final court decision. 
(3) The term for payment of the fine is 15 days from the date of delivery, respectively 
on the date of communication of the minutes of finding / sanctioning or of the decision 
the President of the National Supervisory Authority. 
Article 14 5 
1. The national supervisory authority may order the publication by 
operator or the person empowered by the operator of any corrective action 
applied, with their bearing the related costs. 
(2) In case of non-compliance with the ordered measures or in case of tacit or express refusal 
to provide all information and documents required in the procedure 
of investigation or in case of refusal to submit to investigation, the Authority 
The national supervisory authority may, by decision, impose a fine 
comminators of up to 3,000 lei for each day of delay, calculated from 
the date set by the decision. 
(3) The decision provided in par. (2) constitutes an enforceable title without any other 
formality. An appeal may be lodged against this decision under the conditions 
art. 14 4 para. (1). 
Article 14 6 
(1) The procedure for carrying out investigations by the control staff of 
The national supervisory authority, in the exercise of its legal attributions, shall 
regulated by the decision of the President of the National Supervisory Authority, 
published in the Official Gazette of Romania, Part I. 
(2) Insofar as this law does not provide otherwise, the finding and application 
contravention sanctions are carried out in compliance with the Government Ordinance 
no. 2/2001 regarding the legal regime of contraventions, approved with modifications and 
completions by Law no. 180/2002 , with subsequent amendments and completions. 
SECTION 2: Complaints resolution activity 
Article 14 7 
(1) Any data subject who considers that the processing of his data of character 
personally violates the legal provisions in force has the right to file a complaint to 
National supervisory authority, in particular where his residence 
his place of work or the alleged infringement is or, as the case may be, has 
place on the territory of Romania. The complaint may also be lodged by the means 
electronic communication. 
(2) The complaint shall be submitted in person or through a representative, with the annex 
power of attorney issued under the law by a lawyer or notary power of attorney, after 
case. The complaint may also be lodged by the agent of the data subject who is 
husband or relative up to and including the second degree. 
(3) If the complaint is lodged through a body, 
an organization, an association or a non-profit foundation 
Page 8 
they must prove that they were legally constituted, with a status that provides 
objectives of public interest, and that they are active in the field of protection of rights and 
the freedoms of data subjects with regard to the protection of their personal data 
personal. In this case, the power of attorney shall be attached to the complaint or 
notarial power of attorney, as the case may be, according to par. (2), from which the limits should result 
the mandate given by the data subject. 
Article 14 8 
(1) The procedure for solving the complaints is regulated by decision a 
the President of the National Supervisory Authority, published in the Official Gazette 
of Romania, Part I. 
2. The national supervisory authority shall inform the data subject 
to the admissibility of the complaint, within maximum 45 days from the registration. Into the 
if it is found that the information in the complaint or the documents submitted 
are incomplete or insufficient, the National Supervisory Authority requests 
the data subject to complete the complaint in order to be considered 
admissible for an investigation. A new term of no more than 45 
days have elapsed from the date of completion of the complaint. 
3. The national supervisory authority shall inform the data subject 
with the evolution or with the result of the investigation undertaken within 3 months from 
the date on which it was communicated that the complaint is admissible according to par. (2). 
The information will also include the appeal against the National Authority for 
supervision. 
(4) If it is necessary to carry out a more thorough investigation or 
coordination with other supervisory authorities in accordance with art. 57 para. 
(1) lit. f) of the General Regulation on data protection, the Authority 
The national surveillance authority shall inform the data subject of developments 
investigation, every 3 months, until its completion. The result of the investigation 
shall be notified to the data subject within a maximum of 45 days from 
its completion. 
(5) Within the complaint resolution procedure, investigations shall be carried out 
in accordance with the provisions of art. 14 1 -14 6 . 
(6) In case of non-compliance with the provisions of par. (2) - (4), the data subject may 
the address of the administrative litigation section of the competent court, after 
following the preliminary procedure provided by the Law on litigation 
administrative no. 554/2004 , with subsequent amendments and completions. appeal 
is judged by the competent court of appeal. In all cases, the competent courts 
are those from Romania. 
CHAPTER III 2 : Legal remedies 
Article 14 9 
(1) If, following the exercise of its legal attributions, the National Authority of 
supervision considers that any of the rights of the persons have been violated 
guaranteed by legal regulations in the field of data protection 
may refer the matter to the competent court, in accordance with the law. Target person 
acquires the right to be a plaintiff, to be cited in it 
Page 9 
quality. If the data subject appropriates the action, the quality ceases 
active procedural requirements of the National Supervisory Authority. If the person concerned 
does not take over the action brought by the National Supervisory Authority, 
the court annuls the request according to the Code of Civil Procedure. 
(2) Actions and requests, including those for the exercise of ordinary remedies 
or extraordinary, formulated by the National Supervisory Authority, are 
exempted from the payment of judicial stamp duties. 
(3) The provisions of par. (2) shall also apply to the data subject who appropriates the action 
formulated by the National Supervisory Authority under the conditions of par. (1). 
Article 14 10 
(1) Challenging the documents issued by the National Supervisory Authority in 
the activity of control and settlement of complaints is performed according to art. 14 4 
and 14 8 . 
(2) Administrative acts issued by the National Supervisory Authority in 
exercising the legal attributions, other than those provided in par. (1), may be 
contested at the administrative contentious section of the competent court. 
(3) The provisions of the present law are completed with the provisions of Law no. 554/2004 , 
with subsequent amendments and completions, insofar as this law does not 
disposes differently. 
Article 14 11 
(1) Without prejudice to the possibility to address a complaint to the Authority 
national supervisory authorities, data subjects have the right to apply to the court 
competent authorities for the protection of the rights guaranteed by the applicable law, which 
have been violated. 
(2) If an application has been filed in court with the same object and having 
the same parties, the National Supervisory Authority may order the suspension 
and / or the filing of the complaint, as appropriate. 
(3) Any person who has suffered damage as a result of data processing with 
personal act, performed illegally, may be addressed to the court competent for 
repair it. 
(4) The competent court is the one at the headquarters of the operator or of the person 
authorized by the operator or from the habitual residence of the data subject. 
The application is exempt from stamp duty. " 
12. In Article 15, paragraphs 1 and 2 are amended to read as follows: 
"Article 15 
(1) The organization and functioning regulation, together with the structure 
organizational structure of the Authority, shall be drawn up by the National Authority of 
supervision and is approved by the Permanent Bureau of the Senate. 
(2) The maximum number of positions, excluding dignitaries, is 85. The list of positions and 
the structure of the posts by compartments shall be approved by the President of the Authority 
national surveillance authorities. " 
13. In Article 15, paragraphs 3 and 4 are repealed. 
14. In Article 16, paragraph 3 is amended to read as follows: 
Page 10 
"(3) Appointment, employment, promotion, amendment and termination of employment relationships 
service and, where appropriate, work of the staff of the National Authority for 
supervision shall be made by decision of its president, in accordance with the law. " 
15. In Article 16, two new paragraphs are inserted after paragraph 3 
(3 1 ) and (3 2 ), with the following content: 
"(3 1 ) The activity carried out by the specialized personnel with legal studies in 
within the National Supervisory Authority is seniority in the specialty 
graduated studies. 
(3 2 ) Management and execution personnel other than the legal one from 
within the National Supervisory Authority shall have seniority in 
specialty of graduate studies. " 
Article II 
(1) The Government makes available to the National Authority for Processing Supervision 
Personal Data, in accordance with the law, the location necessary for the actual exercise 
and corresponding to his duties. 
(2) To the extent that the headquarters provided in par. (1), Authority 
National Office for the Supervision of Personal Data Processing may 
proceed, in accordance with the law, to rent or purchase a premises on 
the free real estate market, within the limits of the funds approved for this purpose. 
Article III 
For the proper fulfillment of the legal attributions, the National Authority of 
Supervision of Personal Data Processing has: 
a) two cars for driving the National Supervisory Authority a 
Personal Data Processing: president and vice president; 
b) two cars for the common car park; 
c) 6 cars for specific activities, respectively for insurance 
competences and tasks of monitoring and control of the National Authority of 
Supervision of the Processing of Personal Data, in accordance with 
the tasks assigned to the Member State by the General Protection Regulation 
data, by derogation from the provisions of art. 5 para. (3) of the Government Ordinance 
no. 80/2001 regarding the establishment of some expenditure norms for the authorities 
public administration and public institutions, approved with amendments by Law no. 
247/2002 , with subsequent amendments and completions; 
d) a monthly fuel consumption of 500 l / car; no overruns are considered at 
fuel consumption regulated on the vehicle consumption which, at the level of the year, 
falls within the standard fuel limit in relation to the number of 
approved vehicles. 
Article IV 
After the entry into force of the provisions of this law, the Regulation of 
organization and functioning of the National Authority for Processing Supervision 
Personal Data will be in accordance with its provisions. 
Article V 
(1) On May 25, 2018, Law no. 677/2001 for protection 
persons regarding the processing of personal and free data 
Page 11 
circulation of these data, published in the Official Gazette of Romania, Part I, no. 
790 of December 12, 2001, as subsequently amended and supplemented. 
(2) All references to Law no. 677/2001 , with the modifications and completions 
subsequently, the normative acts are interpreted as references to the Regulation 
general data protection law and its implementing legislation. 
Article VI 
1. The provisions of the General Data Protection Regulation shall apply 
complaints and notifications submitted and registered with the National Authority of 
Supervision of the Processing of Personal Data starting with the date 
its application, as well as those submitted before May 25, 2018 and in progress 
solution. Investigations carried out to resolve them and 
ex officio investigations, started before May 25, 2018 and not completed at 
this time, they are subject to the provisions of the same regulation. 
(2) Finding the facts and applying corrective measures, including sanctions 
contraventions, after May 25, 2018, is made in accordance with 
the provisions of the General Regulation on data protection and with those of 
the legal provisions for its implementation, of Law no. 102/2005 
on the establishment, organization and functioning of the National Authority of 
Supervision of the Processing of Personal Data, with the modifications and 
subsequent completions, as well as those brought by this law. 
(3) Where the General Data Protection Regulation and the provisions 
its implementing rules provide for a more severe sanction, 
the contravention committed before May 25, 2018 will be sanctioned accordingly 
the provisions of the normative acts in force at the date of its commission. In situations in 
which, according to the General Data Protection Regulation 
its implementation, the act is no longer considered 
contravention, it is no longer sanctioned, even if it has been committed before 
dated May 25, 2018. 
Article VII 
The lawsuits pending on May 25, 2018 remain subject to the law 
applicable on the date of their commencement. 
Article VIII 
(1) This law creates the institutional framework necessary for the application in Romania in 
main of the provisions of art. 51-55, art. 57-59, art. 62, 68, 77, 79, 80 and of art. 
82-84 of Regulation (EU) 2016/679 of the European Parliament and of the 
Council on the protection of individuals with regard to processing 
personal data and on the free movement of such data and 
repeal of Directive 95/46 / EC . 
(2) This law enters into force 5 days from the date of publication in the Official Gazette 
of Romania, Part I, except for the provisions of art. I points 1 and 6-11, art. VI and VII, 
which enters into force on May 25, 2018. 
Article IX 
Law no. 102/2005 on the establishment, organization and functioning of the Authority 
National Office for the Supervision of Personal Data Processing, published 
Page 12 
in the Official Gazette of Romania, Part I, no. 391 of May 9, 2005, as amended 
and subsequent additions, as well as changes and additions made by 
this law shall be republished in the Official Gazette of Romania, Part I, 
the texts are re-numbered. 
* 
This law transposes the provisions of art. 41 of Directive (EU) 2016/680 a 
European Parliament and of the Council of 27 April 2016 on protection 
natural persons regarding the processing of personal data by 
competent authorities for the purpose of prevention, detection, investigation or prosecution 
criminal offenses or the execution of sentences and on the free movement of 
these dates and repealing Council Framework Decision 2008/977 / JHA , 
published in the Official Journal of the European Union, L series, no. 119 of May 4, 2016. 
- **** - 
This law was adopted by the Romanian Parliament, in compliance with 
the provisions of art. 75 and of art. 76 para. (1) of the Romanian Constitution , 
republished. 
p. THE PRESIDENT OF THE CHAMBER OF DEPUTIES, 
PETRU-GABRIEL VLASE 
p. THE PRESIDENT OF THE SENATE, 
ADRIAN ŢUŢUIANU 
Published in the Official Gazette number 503 of June 19, 2018