The protection of personal data has become a central element in the relationship between organisations, clients, and partners. GDPR is not just a set of legal obligations, but a framework that directly contributes to information security and to building trust in how an organisation conducts its activities.
The implementation of GDPR requirements involves understanding data flows, clarifying internal responsibilities, and applying appropriate technical and organisational measures. Through this process, organisations reduce the risks of non-compliance, limit exposure to security incidents, and ensure better control over how personal data is collected, used, and stored.
A coherent approach to GDPR compliance sends a clear message of responsibility and professionalism, demonstrating that data protection is integrated into operational processes and organisational culture, rather than treated as a purely formal requirement.
Core elements of GDPR compliance
- Record of processing activities (Art. 30) – what data is processed, for what purpose, on what legal basis, how long it is kept and to whom it is disclosed.
- Lawful bases for processing (Art. 6) – each processing activity relies on a valid basis: performance of a contract, a legal obligation, legitimate interest or consent.
- Informing data subjects (Art. 13–14) – clear privacy notices for employees, customers, candidates and website visitors.
- Exercise of rights (Art. 15–22) – procedures for access, rectification, erasure, restriction, portability and objection, with a response within one month.
- Contracts with processors (Art. 28) – IT, payroll, accounting, cloud or marketing service providers.
- Security measures (Art. 32) – access control, encryption, backups and staff training.
- Personal data breach management (Art. 33–34) – notification to the Romanian supervisory authority (ANSPDCP) within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals.
- Data protection impact assessment (Art. 35) – mandatory for high-risk processing, such as systematic monitoring of a publicly accessible area on a large scale.
When a Data Protection Officer is required
Article 37 requires the appointment of a Data Protection Officer (DPO) for public authorities and for organisations whose core activities involve regular and systematic monitoring of individuals on a large scale or large-scale processing of special categories of data. For other organisations the appointment is optional, but internal data protection responsibilities must be clearly assigned.
The link with ISO/IEC 27001 and ISO/IEC 27701
GDPR defines what must be protected and what rights data subjects have, while ISO standards provide the management framework through which these requirements are applied and demonstrated. ISO/IEC 27001 covers information security through risk assessment, controls and internal audit, and ISO/IEC 27701 adds specific requirements for managing personally identifiable information. Certification does not replace legal obligations, but it provides structured evidence of compliance for customers, partners and authorities.
Common mistakes
- Template documents adopted without tailoring them to the organisation's actual processing.
- No records of consent or data retention periods.
- Suppliers processing data without a signed data processing agreement.
- Untrained staff who do not recognise a security incident or an access request.
- Compliance treated as a one-off project, without periodic review.