Useful guides on building security

Legal obligations

Legal obligations of a company or building

In short: any company or institution that occupies a space has legal obligations in three areas: physical security, fire protection and the safety of installations. What applies depends on the type of building, floor area, number of people and activity. The most common ones are listed below.

1. Physical security (Law 333/2003, Government Decision 301/2012)

• Physical security risk assessment, carried out by an assessor listed in the Romanian Police register and reviewed at least every 3 years, after an incident, or after changes to the building or the activity.
• Measures resulting from the assessment: guarding, alarm systems, video surveillance, access control.
• Police approval of alarm system designs for certain sites (banks, petrol stations, currency exchanges, jewellers, gaming halls and others).
• Guarding is provided by certified officers, through licensed companies or through in-house guarding organised in accordance with the law.
• Systems are designed, installed and maintained only by IGPR-licensed companies.

2. Fire protection (Law 307/2006)

• Fire safety approval and permit for the categories of buildings set out by law (Government Decision 571/2016).
• Detection, alarm and, where applicable, suppression systems, in line with the P118 standard, depending on the building's use and size.
• Maintenance contract for detection and suppression systems, with periodic checks recorded in a logbook.
• Fire extinguishers and hydrants checked periodically by authorised companies.
• Emergency lighting and signage for escape routes, kept in working order.
• Fire protection organisation: staff training, evacuation plans, a designated person or fire safety technician.

3. Electrical installations

• PRAM testing (earthing, insulation resistance, continuity), usually annually, with measurement reports issued by an ANRE-authorised company.
• Lightning protection system checked periodically, where one exists.
• Panels and installations maintained by licensed electricians.

4. Video surveillance, alarms and personal data (GDPR, Law 190/2018)

• Information signs at the entrance to filmed areas.
• Limited retention period for footage and restricted access.
• Employees informed in advance, with the rules included in the internal regulations.
• For alarm systems: user data, access codes, event logs and data sent to the dispatch centre are processed in line with GDPR, with restricted access and a limited retention period.

5. Information security

• Technical and organisational measures for data protection (GDPR).
• For operators of essential services and entities covered by the NIS2 directive: cyber security measures and incident reporting.

Sources: Law 333/2003; Government Decision 301/2012; Law 307/2006; Government Decision 571/2016; P118 standard; Regulation (EU) 2016/679; Law 190/2018. Informational material, not legal advice. The exact obligations depend on the building category and activity; check the version in force on legislatie.just.ro.

Legal obligations

Physical security risk assessment

In short: almost every company or institution that holds goods or valuables must have a physical security risk assessment. It is the basis for deciding the right guarding measures and security systems.

Who must carry it out

Law 333/2003 on the guarding of sites, goods and valuables and the protection of persons applies to ministries and public institutions, autonomous public companies, national companies, businesses and any other organisations that hold goods or valuables, in any capacity. The implementing rules are set out in Government Decision 301/2012.

What it contains

The assessment identifies the site's vulnerabilities and risks and proposes protective measures: guarding, alarm systems, video surveillance, access control. It is carried out by physical security risk assessors listed in the national register kept by the Romanian Police.

When it must be redone

Alarm systems

For certain types of sites (for example banks, petrol stations, currency exchanges, jewellery shops, gaming halls), alarm system designs must be approved by the police. Systems may only be designed, installed and maintained by licensed companies.

Sources: Law 333/2003; Government Decision 301/2012; Ministry of Internal Affairs Instructions no. 9/2013. Informational material, not legal advice. Check the version in force on legislatie.just.ro.

Fire

Fire detection system maintenance

In short: if you have a fire detection and alarm system, the maintenance contract is not optional. It must be signed immediately after the system is commissioned, even if the building is not yet in use.

Where the obligation comes from

Law 307/2006 on fire protection requires building managers to ensure that fire protection equipment is checked and maintained. The P118/3-2015 standard details how detection, signalling and warning systems must be maintained.

Who can do it

The system installer or another company authorised for such work. The maintenance company's contact details must be displayed in plain view, next to the control and signalling equipment.

What gets checked and how often

All checks are recorded in a logbook, which IGSU inspectors ask to see during inspections. Missing maintenance is subject to fines.

Sources: Law 307/2006; P118/3-2015 standard. Informational material, not legal advice.

Video surveillance

CCTV cameras and GDPR

Video surveillance means processing personal data, so it falls under GDPR. The basic rules are simple:

1. Inform people

Put up visible signs at the entrance to the filmed area, with a camera icon and the controller's details (who is filming and how they can be contacted).

2. Film only what is necessary

Cameras cover entrances, the perimeter and areas with valuable goods. Spaces where people expect privacy are not filmed: toilets, changing rooms, rest areas.

3. Do not film public areas or the neighbours

Point cameras at your own property and avoid the street, pavement or neighbours' yards, beyond what is strictly necessary.

4. Keep footage only as long as needed

Set a limited retention period and automatic deletion. Footage related to an incident may be kept longer, for as long as the investigation lasts.

5. Restrict access

Only designated people can view recordings, using personal passwords, and access can be audited afterwards.

6. Employees must be informed

If you film at the workplace, employees must be informed in advance and the rules included in the internal regulations.

Sources: Regulation (EU) 2016/679 (GDPR); Law 190/2018; guidance from ANSPDCP and the European Data Protection Board. Informational material, not legal advice.

Checklist

Monthly system check

Professional servicing is carried out periodically by an authorised company. Between services, a few simple checks show early on if something isn't working.

Video surveillance

• All cameras have a clear image, day and night
• Recording is running and yesterday's footage can be viewed
• Storage is not full, time and date are correct

Intrusion alarm

• A test alarm reaches the dispatch centre
• No zone is bypassed without a reason
• Wireless sensor batteries show no warning
• Former employees' codes have been deleted

Access control

• Lost cards and those of leavers are deactivated
• Doors close and lock correctly

Fire

• The fire panel is in normal state, with no faults
• Detectors are not covered or moved
• Escape routes are clear
• The maintenance contract is valid

Download the full checklist as a PDF, so you can print it and tick it off every month.