--- title: Fines on Data Subject Access Request increase description: The Romanian Data Protection Authority (ANSPDCP) has fined Untold SRL approximately €15,000 (74,611.50 RON) for GDPR violations. image: https://eyd.tech/hubfs/GDPR%20Fine%20Subject%20Data%20Access%20Request.png --- [Skip to content](https://eyd.tech/en/news-updates/fines-on-data-subject-access-request-increase-as-untold-srl-is-fined-15000-for-its-violation#main-content) [![logo_white_480-3](https://eyd.tech/hs-fs/hubfs/logo_white_480-3.png?width=60&height=48&name=logo_white_480-3.png "logo_white_480-3")](https://eyd.tech/no/?hsLang=en) - [Home](https://eyd.tech/home) - Services Show submenu for Services - [Subject Access Requests](https://eyd.tech/subjectaccessrequest) - [Consent Management](https://eyd.tech/consent) - [Privacy Maturity analysis](https://eyd.tech/maturityanalysis) - About us Show submenu for About us - [Get in touch](https://eyd.tech/getintouch) - [The board](https://eyd.tech/board) - [News](https://eyd.tech/no/news-updates) - [Podcast](https://eyd.tech/podcast) - [FAQ](https://eyd.tech/faq) - Log in Show submenu for Log in - [Company](https://company.eyd.tech/auth/login) - [Personal](https://me.eyd.tech/auth/login) Open main navigation Close main navigation - [Home](https://eyd.tech/home) - Services Show submenu for Services - [Subject Access Requests](https://eyd.tech/subjectaccessrequest) - [Consent Management](https://eyd.tech/consent) - [Privacy Maturity analysis](https://eyd.tech/maturityanalysis) - About us Show submenu for About us - [Get in touch](https://eyd.tech/getintouch) - [The board](https://eyd.tech/board) - [News](https://eyd.tech/no/news-updates) - [Podcast](https://eyd.tech/podcast) - [FAQ](https://eyd.tech/faq) - Log in Show submenu for Log in - [Company](https://company.eyd.tech/auth/login) - [Personal](https://me.eyd.tech/auth/login) [Get started](https://eyd.tech/no/kom-i-gang?hsLang=en) --- [All posts](https://eyd.tech/en/news-updates/all) March 10, 2025 # Fines on Data Subject Access Request increase ![Picture of EYD privacy](https://app.hubspot.com/settings/avatar/adfca0c37ac106ac130d5671ddf5bda2) By  [EYD privacy](https://eyd.tech/en/news-updates/author/eyd-privacy)  ·  2 minute read The Romanian Data Protection Authority (ANSPDCP) has fined Untold SRL approximately €15,000 (74,611.50 RON) for GDPR violations. The fine was issued due to Untold SRL’s failure to comply with data subject rights, specifically: - **Article 12(3) GDPR**: Failure to respond to data subject requests within the required timeframe. Article 12(3) GDPR: This article mandates that organizations must respond to data subject requests within a specified timeframe. Untold SRL failed to meet this requirement, thereby neglecting the obligation to provide timely responses to individuals seeking access to their personal data or other related actions. - **Article 12(4) GDPR**: Failure to provide information on actions taken in response to data subject requests. Article 12(4) GDPR: According to this provision, organizations are required to inform data subjects about the actions taken in response to their requests. Untold SRL did not fulfill this obligation, leaving data subjects uninformed about the status or outcome of their requests, which is a clear breach of transparency principles. - **Article 17(1) GDPR**: Failure to erase personal data upon request. Article 17(1) GDPR: This article grants data subjects the right to have their personal data erased upon request, often referred to as the "right to be forgotten." Untold SRL failed to comply with this request, thereby infringing upon the data subject's right to have their personal information removed from the company's records. This case underscores the critical importance of adhering to GDPR requirements, particularly in handling data subject requests promptly and transparently. Organizations must ensure robust processes are in place to manage these requests effectively to avoid substantial penalties. ### Facts The data subject filed an access request with the controller. Moreover, they also requested the controller to delete their personal data pursuant to [Article 17(1)(b) GDPR](https://www.gdprhub.eu/index.php?title=Article_17_GDPR#1b). However, the controller never replied to these requests. Therefore, the data subject filed a complaint with the DPA, noting that they had previously provided the controller with their e-mail address, telephone number, full name and postal address. ### Holding First, the DPA noted that the controller has never replied to the data subject's access request. Therefore, it found a violation of [Article 15 GDPR](https://www.gdprhub.eu/index.php?title=Article_15_GDPR) in combination with [Article 12(3)](https://www.gdprhub.eu/index.php?title=Article_12_GDPR#3) and [12(4) GDPR](https://www.gdprhub.eu/index.php?title=Article_12_GDPR#4). Moreover, the DPA held that the controller violated [Article 17(1) GDPR](https://www.gdprhub.eu/index.php?title=Article_17_GDPR#1) in combination with [Article 12(3)](https://www.gdprhub.eu/index.php?title=Article_12_GDPR#3) and [12(4) GDPR](https://www.gdprhub.eu/index.php?title=Article_12_GDPR#4) since the controller did not act on the erasure request filed by the data subject. On these grounds, the DPA issued a fine of RON 74,611.50 (€15,000) and ordered the controller to: - provide the data subject with a written reply, therefore acting on their access request; - adopt the necessary measures to ensure it is able to promptly act on data subjects' access requests. [Find more information about this fine on GDPR hub.](https://www.gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_Untold_SRL) ### Stay on top of Data Subject Access Request In order for your company can void unnecessary fines for violating Subject Access Request, make sure that:  - Build trust with clients and customers and make sure they are well informed in your use and management of their data - Provide users with a customer facing dashboard to easily view and manage their data - Have a secure service to verify data subjects identity and send request that also allows your company to simply manage and securely respond to any requests submitted.  Need help? Check out our Data Subject Access Request Solution for more information about how our service may support your business or send us a request to talk: [hello@eyd.tech](mailto:hello@eyd.tech)  Share: [facebook-f icon](http://www.facebook.com/share.php?u=https://eyd.tech/en/news-updates/fines-on-data-subject-access-request-increase-as-untold-srl-is-fined-15000-for-its-violation) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://eyd.tech/en/news-updates/fines-on-data-subject-access-request-increase-as-untold-srl-is-fined-15000-for-its-violation) [twitter icon](https://twitter.com/intent/tweet?url=https://eyd.tech/en/news-updates/fines-on-data-subject-access-request-increase-as-untold-srl-is-fined-15000-for-its-violation) [pinterest-p icon](http://pinterest.com/pin/create/link/?url=https://eyd.tech/en/news-updates/fines-on-data-subject-access-request-increase-as-untold-srl-is-fined-15000-for-its-violation) [envelope icon](mailto:?body=https://eyd.tech/en/news-updates/fines-on-data-subject-access-request-increase-as-untold-srl-is-fined-15000-for-its-violation) ## Related posts [![](https://eyd.tech/hubfs/Blog%20postings/GDPR%20Fine%20Subject%20Data%20Access%20Request-1.png)](https://eyd.tech/en/news-updates/compensation-to-a-data-subject-for-faling-to-respond-to-a-subject-data-access-request?hsLang=en) [Subject Access Requests](https://eyd.tech/en/news-updates/tag/subject-access-requests) ### [Compensation to a Data subject](https://eyd.tech/en/news-updates/compensation-to-a-data-subject-for-faling-to-respond-to-a-subject-data-access-request?hsLang=en) [![](https://eyd.tech/hubfs/AdobeStock_856935814_linkedin.png)](https://eyd.tech/en/news-updates/understanding-subject-access-requests-dsar-best-practices-and-penalties?hsLang=en) [Privacy](https://eyd.tech/en/news-updates/tag/privacy) ### [Understanding Subject Access Requests (DSAR): Best Practices and Penalties](https://eyd.tech/en/news-updates/understanding-subject-access-requests-dsar-best-practices-and-penalties?hsLang=en) [![](https://eyd.tech/hubfs/my%20data%20award%202025-1.png)](https://eyd.tech/en/news-updates/eyd-tildelt-prisen-mydata-award-for-technology-2025?hsLang=en) [News](https://eyd.tech/en/news-updates/tag/news) ### [EYD acknolwedged with the MyData Award 2025!](https://eyd.tech/en/news-updates/eyd-tildelt-prisen-mydata-award-for-technology-2025?hsLang=en) [![logo_white_480](https://eyd.tech/hs-fs/hubfs/logo_white_480.png?width=70&height=57&name=logo_white_480.png "logo_white_480")](https://eyd.tech/no/?hsLang=en) Privacy made simple. [facebook-f icon](https://www.facebook.com/eyd) [linkedin-in icon](https://www.linkedin.com/company/eyd-company/) [instagram icon](https://www.instagram.com/eyd_tech/) **Insight**   [Privacy Policy](https://eyd.tech/no/personvernerkl%C3%A6ring?hsLang=en) [Privacy Policy EYD's Services](https://eyd.tech/no/personvernerkl%C3%A6ring-eyd?hsLang=en) [Data Processor Agreement](https://eyd.tech/no/databehandleravtale?hsLang=en) [Terms and Conditions](https://eyd.tech/no/vilkar?hsLang=en) [Home](https://eyd.tech/home?hsLang=en)   [The team](https://eyd.tech/no/om-oss?hsLang=en) [The board](https://eyd.tech/no/styret?hsLang=en) [FAQ](https://eyd.tech/no/faq?hsLang=en)   [Get in touch](https://eyd.tech/getintouchwithus?hsLang=en) [hello@eyd.tech](mailto:hello@eyd.tech) Jonsvannsveien 140 7050 Trondheim Norway © 2023 EYD AS ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "EYD privacy", "url" : "https://eyd.tech/en/news-updates/author/eyd-privacy" }, "dateModified" : "2025-03-10T10:34:31.976Z", "datePublished" : "2024-11-05T13:13:27.000Z", "headline" : "Fines on Data Subject Access Request increase", "image" : [ "https://eyd.tech/hubfs/GDPR%20Fine%20Subject%20Data%20Access%20Request.png" ], "mainEntityOfPage" : { "@id" : "https://eyd.tech/en/news-updates/fines-on-data-subject-access-request-increase-as-untold-srl-is-fined-15000-for-its-violation", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://eyd.tech/hubfs/logo_white_480.png" }, "name" : "EYD" } } ``` ```json { "@context" : "http://schema.org", "@type" : "Article", "author" : { "@type" : "Person", "name" : [ "EYD privacy" ], "url" : "https://eyd.tech/en/news-updates/author/eyd-privacy" }, "datePublished" : "2024-11-05T13:13:27+0000", "description" : "The Romanian Data Protection Authority (ANSPDCP) has fined Untold SRL approximately €15,000 (74,611.50 RON) for GDPR violations. ", "headline" : "Fines on Data Subject Access Request increase", "image" : "https://eyd.tech/hubfs/GDPR%20Fine%20Subject%20Data%20Access%20Request.png", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://eyd.tech/hubfs/logo_white_480.png" }, "name" : "EYD" }, "url" : "https://eyd.tech/en/news-updates/fines-on-data-subject-access-request-increase-as-untold-srl-is-fined-15000-for-its-violation" } ```