The activity report for the year 2024 is publicly available on the website of the National Supervisory Authority for Personal Data Processing under section “General information/Public interest information/Annual reports”.

The annual report contains a synthetic presentation of the authority’s activity, being structured in accordance with the main competences, in the following chapters: Chapter I - General presentation, Chapter II - Advisory, consultation, representation in court and public information activity, Chapter III - Monitoring and control activity, Chapter IV - Activities in the field of foreign affairs and Chapter V - Economic management of the authority.

The content of this Report includes statistical benchmarks highlighted within each chapter, including comparative graphs with previous years, such as: the number of investigations carried out in total or differentiated (ex officio, respectively based on complaints), the number of complaints, intimations and notifications regarding security incidents, fines applied, the amount of fines, reprimands, corrective measures, the number of standpoints issued, opinions issued, subpoenas, press releases, the number of requests for approval of binding corporate rules (BCRs).

Also, the Activity Report for 2024 contains the presentation of significant cases from the investigations carried out and relevant points of view issued, which reflects the complexity of the activity carried out, in relation to the tasks of our institution.

Regarding the monitoring and control activity, in 2024 the authority received a total of 5354 complaints, intimations and notifications regarding security incidents, based on which 476 investigations were carried out.

As a result of the investigations, 83 fines were applied in a total amount of 1,855,907 lei. Also, 161 reprimands were applied and 180 corrective measures were ordered.

At the same time, we specify that, during 2024, 882 requests were addressed to the national supervisory authority to issue views on various aspects relating to the interpretation and application of Regulation (EU) 679/2016, by controllers and their processors, from the public and private sectors, by other entities, as well as by individuals.

Our institution also issued opinions on a number of 99 draft legal acts elaborated by public institutions and authorities that involved various aspects regarding the processing of personal data, pursuant to Article 57 paragraph (1) letter c) of Regulation (EU) 2016/679.

Regarding the activity of representation before the courts, the National Supervisory Authority for Personal Data Processing managed in 2024 a number of 173 files pending before the courts at various procedural stages.

In this context, the Activity Report for 2024 contains the presentation of several actions that were finally finalized, in 2024, in a favorable manner for our institution.

Regarding international transfers of personal data, the national supervisory authority received and assessed requests for approval of BCRs submitted by 40 multinational companies.

The activity report for 2024 was submitted to the competent institutions, in accordance with the applicable legal provisions.

Legal and Communication Department

A.N.S.P.D.C.P