GDPR compliance for companies and institutions in Constanta
GDPR is not solved with a cookie banner. It is solved when you know what data you have, why you have it, who sees it, and what you do when something goes wrong.
Surveillance cameras without information, CVs kept for years, customer lists sent on WhatsApp, contracts with IT suppliers without any processing clause: this is what it looks like GDPR in most companies in Constanta. Not out of malice, but because no one put things on paper.
GreenSoft does GDPR compliance from end to end: we inventory data and processing, write the register, policies and information, set up contracts with suppliers, check technical measures (access, backup, encryption, video surveillance) and train employees. In the end, you have a file that you can show at an ANSPDCP inspection and, more importantly, a company that actually complies with the rules.
Our advantage: we are also the ones who install the cameras, access control and network. The technical measures required by the GDPR do not remain recommendations in a report, we implement them.
What does the service include?
- GDPR audit: what data do you process, why, for how long, with whom do you share it?
- Register of processing activities and impact assessments (DPIA), where applicable
- Policies, procedures, information for employees, customers and video surveillance
- Contracts and processing agreements with suppliers (IT, accounting, marketing)
- Technical measures: access, backup, encryption, retention; staff training
Why GreenSoft
GDPR has a legal side and a technical side, and the two are usually at odds between different vendors. At GreenSoft, the ISO/IEC 27001 certified team covers both documentation and implementation: the same people who write the video surveillance policy are the ones who set the retention on the NVR.
How the project is progressing
- Interview with management and inventory of data flows
- Analysis of gaps with respect to GDPR and prioritized action plan
- Drafting documentation and implementing technical measures
- Employee training, file handover and review schedule
For which types of sites
- Clinics and medical offices
- hotels and guesthouses
- accounting and law firms
- stores and e-commerce
- private schools and kindergartens
- public institutions
Tell us what type of activity you have and how many employees; you will receive a GDPR compliance proposal with an offer within 3-5 business days.
Where we work
We cover the entire county of Constanta: Constanta municipality, Mamaia, Năvodari, Ovidiu, Agigea, Eforie, Techirghiol, Mangalia, Medgidia and Cernavodă, including the port perimeter, based on the work license in the Port of Constanta. For larger works, we travel throughout Dobrogea.
Useful resources
- Video surveillance and GDPR in 2026: the rules for businesses
- The 3-2-1 backup rule, applied in practice
Frequently asked questions
My company is small. Do I really need GDPR?
Yes, GDPR applies to any company that processes personal data: employees, customers, room visitors. The only difference is the volume of documentation: for a small company, a short and applied set is enough.
What does a non-compliant company risk?
Fines from ANSPDCP, which in Romania have been applied even to small companies, but also the loss of a corporate client or a public contract that requires proof of compliance. The most common reason for sanction is video surveillance without correct information.
How long does it take?
For a company with one location, a few weeks from interview to submission of the file, depending on how quickly we receive the information.
Do you also do DPIA for cameras?
Yes. For video surveillance, employee monitoring or medical data, the impact assessment is part of the package.
What happens after the surrender?
GDPR is a process, not a file. You can continue with an annual review or an outsourced DPO who keeps compliance up to date.
Shall we discuss your project?
Free initial technical consultation and quote within 3–5 business days.
