ANSPDCP Romania: CNP Detection and GDPR Checks
Updated for 2026
Romania's data body is ANSPDCP. Its 2024 assessment found that 78% of PII tools fail to detect the Cod Numeric Personal (CNP). Most skip the checksum step. That gap creates real compliance risk. Romania processes EU data for many Western clients. The exposure is wide.
Romania's Most Data-Rich National ID
The CNP is a 13-digit national identifier. Each digit group holds personal data:
- Digit 1: Gender and century code. Male born 1900–1999 = 1. Female born 1900–1999 = 2. Male born 2000+ = 5. Female born 2000+ = 6. Male foreign resident = 7. Female foreign resident = 8. Other resident = 9.
- Digits 2–3: Last two digits of birth year.
- Digits 4–5: Birth month (01–12).
- Digits 6–7: Birth day (01–31).
- Digits 8–9: County code. Covers 41 counties and Bucharest's six sectors (codes 01–52).
- Digits 10–12: Birth order within that day and county.
- Digit 13: Check digit.
Digit 1 alone reveals biological sex. Under GDPR Article 9, that makes this number a special-category data item. It needs stronger protection than ordinary personal data.
How the check digit works: Take the first 12 digits. Multiply each by its weight (2, 7, 9, 1, 4, 6, 3, 5, 8, 2, 7, 9). Add the results. Divide by 11 and take the remainder. A remainder of 10 gives check digit 1. A remainder of 11 means the code is not valid. Any other remainder is the check digit.
Tools that skip this test have two failure modes. First, any 13-digit string gets flagged as a match (false positives). Second, a corrupted number passes the pattern check but holds bad data. That data needs review and gets missed (false negatives).
NER Problems in Romanian-Language Documents
Finding identifiers is only part of the work. Romanian text adds more detection hurdles.
Diacritics: Romanian uses ș, ț, ă, â, and î. Tools trained on other languages often miss names with these letters. Old documents in Latin-2 encoding add more failures.
Address formats: Street types use short forms — Str., Bd., Al., Cal. City and commune names follow local rules. Parsers built for French or German addresses do poorly here.
Name inflection: Names change form by grammatical case in Romanian. The same person's name looks different in different parts of a sentence. NER models must handle this to link names across a document.
See our APAC PII detection guide for how language gaps affect detection across non-Western scripts.
How ANSPDCP Cases Develop
ANSPDCP cases show three patterns.
BPO breach cases: Shared files hold employee ID numbers and EU customer data with no encryption. Poor logs mean the firm cannot tell which records were accessed. That extends the probe and raises the fine.
Healthcare exposure: Patient files — the national ID, health card ID, and diagnosis — reach the wrong person. The PII tool had no support for this format. The data left without masking.
Cross-border transfer failures: An outsourcing firm sends identifier-linked records to a non-EEA party. No Transfer Impact Assessment. No Standard Contractual Clauses. The Article 9 status of the data turns a routine gap into a more serious violation.
Three Controls for ANSPDCP Compliance
These three form the minimum technical baseline:
- CNP detection with modulo-11 validation — pattern matching alone is not enough.
- Diacritic-aware NER — cover ș, ț, ă, â, and î in both UTF-8 and Latin-2 sources.
- ID card detection — the national card appears alongside the CNP in many document types.
For a wider view of how national IDs create GDPR risk, see our EU national tax ID detection guide.
When This Approach Has Limits
Adding modulo-11 validation and diacritic-aware NER is the right baseline for catching the CNP — that part of the approach is sound. But limits remain worth stating plainly.
Detection accuracy bounds the result. A CNP is only protected if the system first recognized it as a CNP. Checksum validation reduces false positives, but it cannot recover a number the pattern stage never surfaced — corrupted OCR output, numbers split across line breaks, or values embedded in narrative Romanian text. The residual false-negative rate sets a ceiling on what any downstream masking can achieve. Treat reported accuracy as a starting point and verify it against your own document corpus, not against vendor benchmarks drawn from cleaner inputs.
The CNP format and Romanian text need configuration and held-out testing. The 50-plus county codes, the gender-and-century leading digit, and the modulo-11 weights all have to be configured correctly, and Romanian names inflected by grammatical case and written with ș, ț, ă, â, and î must be tested on data you set aside in advance. Diacritics in Latin-2 sources behave differently from UTF-8. A pipeline tuned for German or English will under-detect here until it is measured against held-out Romanian documents, not assumed to generalize.
The tool supports compliance but does not constitute it. Because Digit 1 alone reveals biological sex, the CNP carries Article 9 weight, and that raises the stakes for the whole posture — not just the detector. ANSPDCP audits transfer mechanisms, retention, access logs, and human review together. A high CNP detection rate does not answer for an absent Transfer Impact Assessment or missing Standard Contractual Clauses. Detection is one technical measure under Article 32; the controller still owns accountability for everything around it.