The National Supervisory Authority for Personal Data Processing completed, in 2025, an investigation at the controller PREMIER RESTAURANTS ROMANIA SRL and found a violation of the provisions of Article 32 paragraph (1) letter b) and paragraph (2) in conjunction with Article 28 paragraph (1) of Regulation (EU) 2016/679.

As such, the controller was sanctioned with a fine in the amount of 40,736 lei (equivalent to 8,000 euros).

The investigation was initiated following the transmission by the controller PREMIER RESTAURANTS ROMANIA S.R.L of a notification of a personal data breach, in accordance with the provisions of Article 33 of Regulation (EU) 2016/679.

During the investigation, it was found that, following a cyberattack on the computer application owned by the controller, personal data were accessed.

At the same time, during the investigation, it was found that the controller did not implement adequate technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing, generated in particular by unauthorized access to the processed personal data, including the ability to ensure the confidentiality, integrity, availability and continued resilience of the processing systems and services.

Also, the controller did not ensure that it only uses data processors who offer sufficient guarantees for the implementation of appropriate technical and organizational measures, in accordance with the provisions of Article 28 paragraph (1) of Regulation (EU) 679/2016.

This situation led to unauthorized access to personal data belonging to a significant number of data subjects (employees of the controller), such as: name, surname, date of birth, e-mail address, position.

Thus, the controller was sanctioned with a misdemeanor fine, for violating the provisions of Article 32 paragraph (1) letter b) and paragraph (2) in conjunction with Article 28 paragraph (1) of Regulation (EU) 679/2016.

The controller paid the misdemeanor fine imposed by ANSPDCP

Legal and Communication Department

A.N.S.P.D.C.P