ANSPDCP (Romania) - Fine against GEROCOSSEN S.R.L.
Romania's ANSPDCP fines cosmetics retailer GEROCOSSEN S.R.L. €5,000 for GDPR violations after a cyberattack.
Run ANSPDCP?
Get an email when a reviewed story names ANSPDCP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Romanian Data Protection Authority (ANSPDCP) has fined GEROCOSSEN S.R.L., a cosmetics retailer, RON 26,236.50 (approximately €5,000) for failing to implement adequate security measures. This penalty follows a cyberattack that compromised the company's IT infrastructure, leading to a personal data breach. The authority found that GEROCOSSEN SRL infringed Article 32 of the GDPR by not ensuring appropriate technical and organizational measures to protect personal data.
The lesson from this incident
Full lessonGEROCOSSEN S.R.L. failed to implement adequate technical and organizational security measures as required by GDPR Article 32, leaving its IT infrastructure vulnerable to a cyberattack that resulted in a personal data breach. This case illustrates that GDPR compliance is not merely a documentation exercise — it demands active, demonstrable security controls proportionate to the risks of processing personal data. Regulators increasingly hold organizations accountable not just for breaches themselves, but for the absence of preventive security practices that could have reduced the likelihood or impact of an attack. Even smaller retailers handling customer data must treat data protection as a core operational responsibility, not an afterthought.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.