Untold SRL, a Romanian consumer-focused company, has escaped a substantial financial penalty after the country’s data protection regulator chose to issue a warning rather than impose a fine in a GDPR enforcement matter.
The National Authority for the Supervision of Personal Data Processing (ANSPDCP) recently published an updated list of court cases and enforcement actions related to General Data Protection Regulation violations. While the compilation revealed that numerous Romanian firms faced financial sanctions, Untold SRL emerged as one of the operators that benefited from a more lenient approach by the authority.
Warning Instead of Fine
Rather than levying the potential €15,000 penalty that could have been assessed, the ANSPDCP determined that a formal warning would be the appropriate response in this instance. This decision represents a notable outcome in an increasingly stringent enforcement landscape, where data protection authorities across Europe have escalated their approach to GDPR compliance violations.
The distinction between a fine and a warning carries significant implications for companies navigating data protection obligations. While both represent formal enforcement measures, a warning serves as an official notice of non-compliance without the immediate financial burden of a monetary penalty. For Untold SRL, this outcome provides breathing room to address compliance gaps and implement corrective measures.
Broader Enforcement Patterns
The ANSPDCP’s decision reflects a tiered enforcement strategy that some European data protection authorities employ when addressing violations. Such approaches typically consider factors including the nature and severity of the breach, the company’s previous compliance history, the promptness of remedial actions, and the cooperation demonstrated throughout the investigation process.
Romania has increasingly drawn attention within the European data protection community for its enforcement activities. The ANSPDCP’s publication of comprehensive case lists demonstrates transparency in regulatory operations and provides valuable insights into how the authority prioritizes different categories of violations and determines appropriate sanctions.
Context for European Startups
For startups and smaller companies operating across the European Union, the treatment of Untold SRL’s case underscores an important principle: GDPR compliance remains non-negotiable, yet enforcement authorities retain discretion in determining proportionate responses. This reality suggests that companies demonstrating responsiveness to regulatory concerns and taking corrective action may find themselves subject to less severe penalties than the regulatory frameworks technically allow.
The outcome also reflects the ongoing maturation of GDPR enforcement practices since the regulation’s implementation in 2018. While early enforcement actions often resulted in high-profile fines and dramatic headlines, authorities have developed more nuanced approaches that balance deterrence with the practical realities facing businesses of varying sizes and sophistication levels.
As European startups continue to scale operations and expand across jurisdictions, understanding how different national authorities calibrate their enforcement responses remains strategically important. The Untold SRL case exemplifies how proactive engagement with regulators and demonstrated commitment to remediation can influence outcomes in data protection matters.