Skip to main content
In forceNIS2

NIS2 in Romania

Romania transposed NIS2 through amendments to its cybersecurity legislation. DNSC acts as the central supervisory authority.

Transposition law
OUG nr. 155/2024, completată prin Legea nr. 52/2025 și Legea nr. 124/2025
In force since
1 January 2025
Competent authority
National Cyber Security Directorate (DNSC)
Max fine (Essential)
RON 50 million (~€10 million) or 2% of global annual turnover
Max fine (Important)
RON 35 million (~€7 million) or 1.4% of global annual turnover
Law adopted
1 December 2024

Key Deadlines

Law in force
17 October 2024

Competent Authority

National Cyber Security Directorate (DNSC)
Lead competent authority and national CSIRT
https://dnsc.ro β†—

DNSC supervises critical operators through periodic compliance reviews, emphasizing localized threat sharing and rapid remediation.

Registration Process

Submit registry declarations via dnsc.ro using designated administrative templates.

πŸ“Š Quick Test

Find out if your company is in scope

Does your organisation fall under Annex I (Essential) or Annex II (Important) entities?

Check NIS2 Scope β†’

Key Requirements

  • 1Formal registration in the DNSC national database
  • 2Symmetric incident declarations to DNSC within 24 hours
  • 3Mandatory backup systems and offline recovery procedures

National Additions

β˜…Romania mandates security clearances for operations managers handling critical telemetry data

FAQ: NIS2 in Romania

What is the primary incident portal in Romania?
Incident declarations are routed through the DNSC alert platform at dnsc.ro.

Ready to assess your NIS2 compliance?

Use our free tools to check your NIS2 scope and run a gap assessment.

🎯 Scope CheckerπŸ“Š Gap Assessment

Currency and sources

The legal details on this page were last checked on 25 July 2026. Some details rest on a single secondary source and are not verified against the national authority or official journal. Confirm with the competent authority before relying on them for a compliance decision.