The new requirement is stated in an ordinance approved by the Government Tuesday to amend Law 506/2004 regarding personal data processing in the electronic communications sector.
According to the Government, the data protection authority will issue recommendations regarding good practices, will conduct audits and will determine the situations when personal data operators must notify security breach.
In June last year, the Government approved a bill which requires telecom operators to store, for six months, certain data on calls, text messages and e-mails, that can be provided to judicial or national security authorities.
The bill was based on Directive 2006/24/EC on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, adopted in March 2006.
The directive requires electronic communication services suppliers to create databases and store this information for 6-24 months, subject to certain conditions provided by the directive.