October 2026

GDPR applies to any entity that processes personal data, regardless of size: there is no minimum threshold of employees or turnover below which the obligations stop applying, and no general exemption for small companies.

In a recent article published by termene.ro and authored by journalist Amelia Turp, Adela Nuță explained why smaller companies cannot rely on their size to avoid compliance, and which areas tend to create the most exposure in practice.

From a data privacy perspective, several elements require particular attention:

• the very limited scope of the only derogation available to companies with fewer than 250 employees, which concerns the record of processing activities;
• the broad notion of “controller”, which can also cover individuals acting outside purely personal or household activities;
• the strict conditions applicable to video surveillance of employees;
• the use of AI tools in the workplace, at the intersection of GDPR and the EU AI Act; and
• the need for clear data processing agreements with service providers.

As Adela highlights, the derogation for smaller companies does not apply to routine processing, such as that concerning employees or clients, nor to processing involving sensitive data. Simplification proposals are under discussion at EU level (the so-called Omnibus packages), but they are not yet in force, therefore companies must comply with the Regulation as it currently stands.

Video surveillance deserves particular attention. Under Law no. 190/2018, monitoring employees is allowed only under strict conditions: a well-justified legitimate interest, prior, complete and explicit information of employees, consultation with the union or employee representatives, and proof that less intrusive measures were not effective. In practice, this is one of the most frequent sources of sanctions for smaller companies.

The analysis also looks at how the Romanian authority (ANSPDCP) handles investigations. The maximum fines set by GDPR are ceilings rather than usual amounts, but even a fine in the tens of thousands of euros can be existential for a small business. Just as important is how the company manages the investigation: a late or incomplete reply, or an ignored corrective measure, can turn a minor non-conformity into a costly one.

Two further practical points that should be viewed as immediate discussion points:

• AI tools at work. When employees enter client or colleague data into tools such as ChatGPT, Copilot or similar instruments, this is a processing of personal data subject to GDPR. A lengthy policy is not necessarily required; three clear written rules, acknowledged by each employee, cover most practical risks: what data is never entered into public AI tools, which tools are approved, and who to report suspected misuse to. The stakes rise when AI is used for candidate selection or employee evaluation, which are classified as high-risk uses, and some uses (such as inferring employees’ emotions at work) are already prohibited.
• Processors. Delegating a processing activity to a supplier does not delegate responsibility. A company can be held liable for processing carried out on its behalf, which is why a clear data processing agreement, with precise instructions, is a document with real weight in any inspection.

The core message emerging from the analysis is a practical one:

data protection compliance is not a matter of company size, but of how personal data is handled in practice, on daily basis, and it should be documented accordingly.

This article provides general information only and should not be construed as formal legal advice. For assistance with specific legal matters or tailored guidance, please contact and consult with a qualified legal advisor.

Read the full article, in Romanian, on termene.ro – available HERE.

Details about our Data Privacy and Personal Data Processing practice are available HERE.