Romania chapter in Thomson Reuters’ Data Localization Laws: Overview

13.04.2021 – Authors: Roxana Ionescu, Madalina Bucur, Daniel Stancescu, Madalina Panca, Ramona Stefan and Lucian Barbu

A Q&A providing a high-level summary of the key data localization requirements in Romania. It identifies applicable laws, sector-specific requirements, exceptions, and cross-border data transfer requirements.

1. What are the key data localization laws in the jurisdiction?

The key localization laws in Romania are summarized below:

Law No. 207/2015 Regarding the Fiscal Procedure Code (July 23, 2015)(in Romanian):
- Article 109 requires covered organizations to store tax and accounting records, in hard copy or electronic format, in Romania at the registered or secondary office of the taxpayer’s domicile.
Labor Code (January 24, 2003) (in Romanian):
- Articles 16(4) and 119(1) require organizations to store certain employment records at the work site.
- Article 7 of Government Decision No. 905/2017 (December 14, 2017) (in Romanian) requires employers to store personnel files of employees at its headquarters or secondary office, and Article 81-82 of the Methodological Norms on Health and Safety (October 11, 2006) (in Romanian) requires employers to keep health and safety files within the company.
Emergency Ordinance No. 77/2009 on the Organization and Operation of Gambling (June 24, 2009) (in Romanian) and other gambling laws:
- Several laws impose local server requirements on gambling organizers in Romania, including Article 15(1)(B)(iii) of Emergency Ordinance No. 77/2009, which applies to organizers of remote gambling activities.

2. What do the data localization laws cover?

Article 109 of Law No. 207/2015 Regarding the Fiscal Procedure Code (July 23, 2015) (in Romanian) applies to tax and accounting records.

Article 16(4) and Article 119(1) of the Labor Code (January 24, 2003) (in Romanian), Government Decision No. 905/2017 (December 14, 2017) (in Romanian), and Methodological Norms on Health and Safety (October 11, 2006) (in Romanian) apply to employment records, including, for example:

Employment agreements;
Timekeeping records;
Personnel files;
Health and safety records.

Emergency Ordinance No. 77/2009 on the Organization and Operation of Gambling (June 24, 2009) (in Romanian) imposes mirror server requirements on remote gambling operators and requires them to make computer systems accessible in Romania. These servers contain embedded data relating to:

Simultaneous gambling sessions;
Player participation fees;
Pay-outs to players.

(Article 15(1)(B)(iii).)

3. To which sectors, individuals, and entities do the data localization laws in the jurisdiction apply?

Article 109 of Law No. 207/2015 Regarding the Fiscal Procedure Code (July 23, 2015) applies to all organizations subject to Romania’s tax and accounting laws.

The localization requirement under Emergency Ordinance No. 77/2009 on the Organization and Operation of Gambling applies to licensed remote gambling operators in Romania (Article 15(1) (B)(iii)). Remote gambling operators include individuals who organize games of chance using only a communication system such as the internet or other transmission systems (Article 1 ^ 3(1) and (3)).

4. What are the main exemptions from the application of the data localization laws?

Article 109 of Law No. 207/2015 Regarding the Fiscal Procedure Code (July 23, 2015) permits organizations to entrust an authorized company to provide archiving services. The law does not specify whether the company providing archiving services must be located in Romania. However, in practice, the companies authorized to provide archiving services are typically located in Romania. To obtain further clarity on whether a company outside of Romania may provide archiving services, organizations should contact the office of the National Archives.

5. Do the data localization laws allow for cross-border transfers after storing the data in your jurisdiction? If yes, what are the requirements for transferring data outside your jurisdiction?

The data localization laws do not specifically address cross-border transfers after storing data in the jurisdiction. Organizations should work with local counsel to determine whether each law permits cross-border transfers and under what conditions.

This article appeared in the Thomson Reuters’ Data Localization Laws: Overview and was published by Thomson Reuters Data Privacy Advisor.

Articles