Romanian Post sanctioned for losing the personal data of social assistance beneficiaries

The National Supervisory Authority for Personal Data Processing imposed a fine of 5,000 EUR on the national postal operator, following the conclusion of an investigation carried out in May 2026. The matter was initially reported by the General Directorate of Social Assistance in Constanța.

The incident involved several postal items that failed to reach their intended recipients, resulting in the compromise of personal information security. These items contained highly sensitive data relating to social services beneficiaries, including information about their financial circumstances, tax obligations, and other private aspects of their lives.

The investigation revealed that the postal operator had not implemented adequate measures to protect personal data during the distribution process. The supervisory authority identified deficiencies in access controls over personal information and in the security procedures applicable to staff handling correspondence.

The compromised data included names, addresses, financial situation details, personal histories, and social inquiry reports belonging to a large number of assisted individuals. This information is considered highly sensitive, and its loss may significantly affect the privacy and dignity of those concerned.

As a result of the sanction, the company is required to review and update all technical and organisational data protection measures. This includes reassessing working procedures and implementing new protocols to prevent the accidental loss, destruction, or deterioration of personal information during the postal distribution process.