Romania: ING Bank reportedly fined €5,000 under GDPR

According to Federprivacy, citing a communication dated 4 November 2026 from Romania’s personal data protection authority (ANSPDCP), ING Bank NV Amsterdam – Bucharest Branch received a fine of 26,735 Romanian lei, reported as equivalent to €5,000. The investigation, completed in October, reportedly began following a personal data breach notification submitted by the bank under Article 33 of the GDPR.

Federprivacy reports that, according to the authority’s findings, an employee accessed numerous customers’ banking data without reasons connected to their duties. The information included identifiers, account balances, monthly income and financial transactions. The account attributes the access to inadequately configured permission profiles and insufficient restrictions. The infringement concerned Article 32 of the GDPR: system confidentiality, periodic testing of security measures and processing by staff in accordance with the controller’s instructions.

Also according to Federprivacy, alongside the fine the bank must strengthen checks on compliance with internal procedures, particularly the assignment and use of access permissions, and train staff on the risks of unauthorised access. The decision has not been consulted directly: the amount, reasoning and corrective measures are therefore reported on the basis of the journalistic account.