ANSPDCP (Romania) - 18.06.2026
Romania's DPA fines Altex Romania for data breach and notification failures.
The Romanian Data Protection Authority (ANSPDCP) has fined electronics retailer Altex România S.R.L. a total of RON 52,086 (€10,000) for multiple GDPR violations. The company failed to implement adequate security measures, resulting in a data breach where a customer accessed a third party's personal data. Additionally, Altex Romania did not notify the DPA or the affected individual about the breach as required by GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Altex România S.R.L.?
Get an email when a new story names Altex România S.R.L., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAltex România failed to implement adequate technical and organisational measures to prevent unauthorised access to customer personal data, allowing one customer to view another's information — a classic access control failure. Compounding the breach itself, the company did not notify the Romanian DPA (ANSPDCP) or the affected individual within the mandatory GDPR timeframes, demonstrating a broken incident response process. These dual failures — preventable exposure and inadequate breach response — highlight how organisations must treat data protection as an operational discipline, not just a compliance checkbox. GDPR Articles 25, 32, 33, and 34 each impose concrete obligations that Altex visibly failed to meet, resulting in reputational and financial penalties.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.