Romania software delivery: GDPR enforcement, RO e-Factura, accessibility and language

OutsourcingVN is operated by Netbase JSC, and this guide is written by a supplier that would welcome your project. It separates what Romanian and EU law actually require from what Netbase can evidence about its own practice, with the official sources named throughout for your own legal and tax advisers to verify. The guides index covers other markets, and the market index shows which question each one answers first.

Contents

• Who enforces data protection for a Romania-facing product?
• What can Netbase evidence for a Romanian brief?
• Which requirement sits with which decision owner?
• Which steps come before a Romania-facing launch?
• Worked scenario: a Romanian retailer requires an RO e-Factura invoice
• What has Netbase built that is relevant to a Romanian brief?
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first release

Who enforces data protection for a Romania-facing product?

GDPR applies directly across the European Union, and Romania's national supervisory authority is the National Supervisory Authority for the Processing of Personal Data (ANSPDCP), an autonomous central public authority with general competence over personal data protection. A controller must have a lawful basis for each use of personal data, honour access, correction, erasure and other subject-rights requests, and notify ANSPDCP of a qualifying breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it. ANSPDCP investigates complaints, cooperates with the European Data Protection Board, and can issue a reprimand or an administrative fine for a confirmed infringement.

None of that changes because the development team sits outside Romania. What changes is who signs the processing agreement, who is named controller or processor, and who answers ANSPDCP's questions if a Romanian user complains. A buyer should settle those three roles before discovery starts, not after a defect surfaces.

What can Netbase evidence for a Romanian brief?

Procurement, security and data protection reviewers tend to ask for the same four statements. These are the ones Netbase can give.

• Compliance practices. Netbase's compliance practices are GDPR alignment for data privacy in Europe, HIPAA-aligned methodologies for healthcare data handling, and CCPA compliance for clients with U.S. customer bases. Deciding how GDPR and Romania's own implementing rules apply to your product, and who holds the data protection officer role, remains your organisation's task.
• Security practices. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. A data processing agreement naming ANSPDCP as the competent authority sits on top of this baseline for a Romania-facing system.
• Information security management. Netbase JSC holds ISO 27001 certification for information security management. The certification describes a company-level management system rather than any specific client product or hosting arrangement, so it never stands in for a security review of a Romania-facing deployment.
• Markets, language and hours. Netbase serves clients in the United States, Europe and Asia-Pacific, and most projects come from clients outside Vietnam. Delivery communication is in English, with Romanian copy review owned by a reviewer the buyer names where interfaces or contracts need Romanian copy. The Hanoi head office runs Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7), which overlaps the early part of a Romanian working day.

Which requirement sits with which decision owner?

A Romanian brief spreads the decision across five separate owners, and a proposal that blurs them tends to promise more than any one team can actually check once the contract is signed.

Ask for this table filled in, not just a general compliance statement, before shortlisting a supplier.

Worked scenario: a Romanian retailer requires an RO e-Factura invoice

A SaaS vendor bills a Romanian retail chain monthly for a subscription, and the retailer asks for every invoice through RO e-Factura.

A proposal that cannot describe step 4, specifically what happens when the platform rejects a submitted invoice, has not yet scoped Romanian e-invoicing for this product.

What has Netbase built that is relevant to a Romanian brief?

The closest published evidence for a Romania-facing brief is European commerce and product engineering work. For Rebelo AG, a printer in Portugal, Netbase set up a 3D preview in the online designer for boxes and other multi-sided products, live in about three and a half months; the Rebelo AG 3D product preview record has the detail. The four-country web-to-print record covers online design-tool work for print businesses. Separately, Netbase JSC's Clutch profile carries client reviews from businesses in Romania, Spain, Sweden, France, Denmark, the Netherlands and Belgium, published between October 2020 and June 2021. One of them is from Romania: Daniel Popescu, Owner, Digital Art Studio (Romania), reviewing "Web App for Printing Service Provider" on Clutch, 2021-01-21, rated 5.0, wrote: "They had nice and good solutions for all of our requests."

Which questions should you ask a supplier?

• Who signs the data processing agreement, and who is named controller? Expect a clear answer before contract, not during a breach.
• What exactly does your security and compliance statement cover? A precise answer says what it does not cover as well as what it does.
• Can you show a structured invoice your platform has actually submitted to RO e-Factura? Ask for the file, not just a claim that the connection exists.
• How do you test against EN 301 549? Ask for real assistive-technology testing, not a tool report alone.
• Who owns the Romanian copy, and how does a change reach production? Translation drift is easiest to catch before launch, not after.
• What happens in your build when an RO e-Factura submission is rejected? A vague answer here usually means the path has not been tested.

What usually goes wrong?

• Compliance copied from a company page straight into a proposal. Signal: no one has actually tested this product's data flows, access rules or breach-response plan. Owner: the data protection officer, who should ask for product-specific evidence rather than a restated policy.
• RO e-Factura treated as a reporting feature added at the end. Signal: the five-calendar-day submission window is missed because invoicing was bolted on late. Owner: the finance systems owner, scoping the connection at discovery.
• Accessibility testing left until the week before release. Signal: a defect backlog surfaces only once the launch date is already fixed. Owner: the product owner, who should schedule assistive-technology testing alongside each sprint.
• Romanian copy translated once and never re-tested. Signal: error messages and generated documents drift out of Romanian after the first release. Owner: the localisation owner.

How this guide is sourced and where it stops

This guide draws on ANSPDCP's own description of its role, the European Commission's eInvoicing country sheet for Romania, the National Bank of Romania's description of its payment-system oversight, the European Commission's Your Europe business page on GDPR, and the European Commission's own pages on the Web Accessibility Directive and the European Accessibility Act, all checked on 2026-10-17, together with company statements and review evidence approved in the OutsourcingVN claim register. It is written for product, procurement and operations leads scoping a Romania-facing brief. It does not decide which accessibility duty or data protection role fits your organisation; your own advisers make that call.

Plan the first release

Bring your GDPR role split, your accessibility scope, your RO e-Factura connection and your Romanian-language boundary. The data security and compliance guide lists the contract questions behind the data protection row, and the time zone and collaboration guide covers how overlap and handoff are agreed for a European working day. For neighbouring markets, the Denmark guide covers MitID sign-in and NemHandel e-invoicing under the same EU law base, the Germany guide covers works-council consultation and German e-invoicing formats, and the Netherlands guide covers Peppol e-invoicing and Dutch payment habits; if you are also weighing where the engineering team itself should sit, Vietnam vs Poland for software outsourcing compares that sourcing decision directly, and the web-to-print platforms solution scopes design-tool work in detail.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your Romania-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions

Sources

• National Supervisory Authority for the Processing of Personal Data (ANSPDCP), Frequently Asked Questions
• European Commission, Romania eInvoicing Country Sheet 2026
• National Bank of Romania (BNR), Payment Systems
• European Commission, Your Europe: data protection (GDPR) for business
• European Commission, Web accessibility
• European Commission, The EU becomes more accessible for all
• Netbase JSC's Clutch profile