# Compliance with Law No. 195/2024, without needless red tape Source: https://conformitate.md/en GDPR for the Republic of Moldova We assess how your company processes personal data, draft the documents you need under the Law and help you apply them, tailored to your industry. 23.08.2026 Law No. 195/2024 enters into force 24 months after its publication on 23.08.2024 [art. 89(1)](https://conformitate.md/en/law-195-2024/article-89#p1 "Final provisions") 72 hours Notifying the Centre of a personal data breach: without undue delay and, where possible, within 72 hours [art. 33(1)](https://conformitate.md/en/law-195-2024/article-33#p1 "Notification of a personal data breach to the Centre") up to 2,000,000 lei or, for an enterprise, 2% of total turnover, whichever is higher [art. 88(2)](https://conformitate.md/en/law-195-2024/article-88#p2 "Infringements punishable by a fine") 10% → 40% → 100% Fines phase in over the first three years [art. 90(4)](https://conformitate.md/en/law-195-2024/article-90#p4 "Transitional provisions") Industry guides ## Every industry has its own risks Guides for industries with specific risks: what data you process, what the Law requires of you and which documents you need. Choose your industry. [01 Medical & dental clinics Data concerning health, a special category with strict rules. Read the guide →](https://conformitate.md/en/industries/medical-clinics) [02 Online stores Orders, deliveries, payments, cookies and newsletters. Read the guide →](https://conformitate.md/en/industries/online-stores) [03 Homeowners associations Resident lists, CCTV and debts posted in the stairwell. Read the guide →](https://conformitate.md/en/industries/homeowners-associations) [04 Accounting firms Client data and their employees’ data, processed at scale. Read the guide →](https://conformitate.md/en/industries/accounting-firms) [All industries →](https://conformitate.md/en/industries) Examples from practice ## How the Law applies in real situations [ Case study Illustrative example ### Case study: accounting firm An accounting firm in Chișinău with 40 clients. Payroll sheets and the data of clients' employees went back and forth through the accountants' personal email addresses, and there was no contract governing the processing of data with any client. Files of clients who had left stayed in the same mailboxes. Result The firm now has a data processing agreement signed with each client, a secure space for exchanging files, a record of the activities carried out on its clients' behalf, internal security rules and a team briefed on its obligations. ](https://conformitate.md/en/case-studies/accounting-firm)[ Case study Illustrative example ### Case study: homeowners association A homeowners association in Chișinău with 120 flats. The cameras in the stairwells and the courtyard ran with no rules of use, no notice to residents and no retention period for the recordings, and the list of debtors was posted at the entrance with names and flat numbers. The firm that maintained the cameras had access to the recordings, and exported clips were posted to the building's group chat on request. Result The association now has a CCTV policy, warning signs, a privacy notice for residents, a retention period for the recordings, a contract with the maintenance firm and a format for the list of debts that does not identify anyone. ](https://conformitate.md/en/case-studies/homeowners-association)[ Case study Illustrative example ### Case study: medical clinic A dental clinic in Chișinău with three surgeries. Every member of staff, reception included, had access to every patient file, test results were sent to patients over Viber, and the clinic kept no record of processing activities. On their first visit, patients filled in a questionnaire with their contact details and medical history without being told who would process the data or why. Result Access to patient files is now granted by role, results are sent through a secure channel, patients receive a privacy notice, and the clinic has a record of processing activities, confidentiality undertakings signed by its staff, a breach register and a team briefed on its obligations. ](https://conformitate.md/en/case-studies/medical-clinic)[ Case study Illustrative example ### Case study: online store An online cosmetics store with around 3,000 orders a month. A social network's tracking pixel collected data on visitors with no established legal basis and without informing them, and the newsletter went to every customer, none of whom had been told of the right to object. The customer list was uploaded to an email marketing platform with servers outside the European Economic Area. Result The store now has an established legal basis for each purpose, direct marketing included, checked also against the rules on electronic commercial communications, a published privacy policy, a configured cookie banner, a contract with its email marketing platform and a cleaned-up subscriber list. ](https://conformitate.md/en/case-studies/online-store)[Situation ### Data access request A customer, an employee or another data subject asks you to confirm whether you process his or her personal data, to tell him or her what data you hold, and to provide a copy. art. 12 art. 15 See what the Law requires →](https://conformitate.md/en/situations/data-access-request) [Situation ### Inspection by the Centre The National Centre for Personal Data Protection has asked you for documents and information or has notified you of an investigation, following a complaint by a data subject or on its own initiative, for example after a personal data breach notification. art. 30 art. 31 art. 60 art. 77 art. 81 art. 82 art. 84 art. 88 See what the Law requires →](https://conformitate.md/en/situations/inspection-by-the-centre) [Situation ### Personal data breach: what to do A laptop holding customer data has been stolen, a file with employee data has gone to the wrong recipient, or someone has accessed one of the company's systems without authorisation: a personal data breach has occurred. art. 33 art. 34 See what the Law requires →](https://conformitate.md/en/situations/data-breach) How we work ## From the first conversation to a complete compliance file 1. 1 ### Free consultation 15 minutes online or by phone. We learn what your company does and what personal data it processes. 2. 2 ### Assessment We take stock of your data, processes and existing documents. You receive a gap report. 3. 3 ### Documentation We draft the records, policies and privacy notices tailored to your activity. 4. 4 ### Implementation We walk you through the documents and leave a written note for employees; on request, we hold a briefing session for them. Packages ## Fixed prices, no surprises Choose a package by how your company processes data, not by headcount. Prices start from the lawyer's work, and a package costs less than its modules bought separately. ### Essential 5,900 MDL Module value: 18,500 MDL · you save 12,600 MDL Up to 3 processing activities · 2 privacy notices · 2 processor contracts For a small company with simple processing: a shop, an office, an accounting firm, a homeowners' association. - Data inventory and gap report - Records of processing activities, with the legal basis and retention period of each - Data protection policy and a description of the security measures - Privacy notices for each group of people: clients, employees, patients - Contracts with processors, new or reviewed - Internal rules for data subject requests and for personal data breaches - The confidentiality commitment and the written note for employees Online · delivered in 10 working days · 1 round of revisions · 14 calendar days of email questions [Choose Essential →](https://conformitate.md/en?pkg=essential#oferta) ### Extended Most popular 19,900 MDL Module value: 44,000 MDL · you save 24,100 MDL Up to 8 activities · 5 notices · 5 contracts · website, cameras, sensitive data For a small or medium company with varied processing: a clinic, an online shop, surveillance cameras, cloud services abroad. - Everything in Essential, with higher limits - Website privacy policy and cookie review - Video surveillance: notice, sign text, internal rules - Sensitive data in one activity (for example, medical records) - Transfers outside Moldova, one group of destinations - We check whether you need an impact assessment and a data protection officer Online · delivered in 20–30 working days · 2 rounds of revisions · 45 calendar days of email questions [Choose Extended →](https://conformitate.md/en?pkg=extended#oferta) ### Custom from 45,000 MDL No limits · analysis at your premises For clinic networks, banks and microfinance companies, groups of companies, public bodies, or companies that must appoint a data protection officer. - Everything in Extended, with no limits - Data protection impact assessments, as many as needed - Review of data flows and IT systems - Joint controller agreements, profiling, complex transfers Priced after analysis, at module prices [Request a quote →](https://conformitate.md/en?pkg=custom#oferta) Not sure which package fits? [Calculate the price →](https://conformitate.md/en/tools/price-calculator) [Request a free 15-minute consultation →](https://conformitate.md/en?pkg=consult#oferta) Documents are drafted in Romanian; an authorised translation into Russian or English is charged separately, at the translator's rate. Separate services ## When you need just one thing [Compliance assessment We assess online how your company processes personal data and give you a written report of what is missing under Law No. 195/2024, in order of priority. from 3,900 MDL](https://conformitate.md/en/services/compliance-assessment) [External data protection officer An external data protection officer under a service contract, for companies that are required to designate one or that choose to designate one. from 3,600 MDL / month](https://conformitate.md/en/services/external-dpo) [Employee briefing and advice A briefing and advice session for employees who process personal data, built on your company's own documents and on Law No. 195/2024. 4,000 MDL / session, up to 20 people](https://conformitate.md/en/services/employee-briefing) [Breach response support Support when a personal data breach occurs: we assess the risk and prepare the notification and communication that Law No. 195/2024 requires. 1,000 MDL / hour](https://conformitate.md/en/services/breach-response-support) [All services →](https://conformitate.md/en/services) FAQ ## What clients ask us ### Does Law No. 195/2024 apply to small companies too? Yes. The Law applies to any processing of personal data by automated means or in a filing system, with no threshold based on company size. That includes employee data. The measures required depend on the nature of the processing and the risks, and the obligation to keep a record of processing activities has a conditional exemption for enterprises and organisations with fewer than 250 employees. [art. 2](https://conformitate.md/en/law-195-2024/article-2 "Material scope") [art. 24](https://conformitate.md/en/law-195-2024/article-24 "Responsibility of the controller") [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") ### Does a company have to register with the National Centre for Personal Data Protection? No. Law No. 195/2024 provides for neither the registration of controllers nor prior notification of the Centre. Instead, the controller must be able to demonstrate that its processing complies with the Law. The Centre is consulted before processing only where a data protection impact assessment indicates a high risk in the absence of mitigating measures. The Law does, however, require the Centre to be notified of a personal data breach and to be given the contact details of the data protection officer, if one is designated. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 24](https://conformitate.md/en/law-195-2024/article-24 "Responsibility of the controller") [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") [art. 36](https://conformitate.md/en/law-195-2024/article-36 "Prior consultation") [art. 37](https://conformitate.md/en/law-195-2024/article-37 "Designation of the data protection officer") ### Does a company need a data protection officer? Only in the cases set out in the Law: the processing is carried out by a public authority or institution, except for courts acting in the administration of justice; the core activities consist of regular and systematic monitoring of data subjects on a large scale; or the core activities consist of large-scale processing of special categories of data or of data relating to criminal convictions and offences. In other cases, designation is optional unless other normative acts require it. We will tell you during the assessment whether this applies to you. [art. 37](https://conformitate.md/en/law-195-2024/article-37 "Designation of the data protection officer") ### How long does it take for a company to become compliant? The Essential package is delivered in about 10 working days and Extended in 20–30 working days, counted from when we receive your questionnaire answers. For a custom offer, the timeline is set after the analysis. ### Can I produce the documents with an AI model instead of hiring you? An AI model can be a starting point, but the Law does not ask for generic documents: they must describe exactly how your company processes data, that is, which data you collect, for which purposes and on which legal basis, who receives it, how long you keep it and which security measures you apply. The model does not know these facts and does not check them, it may cite Regulation (EU) 2016/679 instead of Law No. 195/2024 or articles that do not exist, and the company remains responsible for the documents. Do not enter data about employees or clients into a public AI service: its provider then receives that data, often outside the Republic of Moldova. We start from conversations with your team, check every document against the text of the Law and answer your questions after delivery. If you already have documents made with AI, we can review them as part of the assessment. [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") [art. 24](https://conformitate.md/en/law-195-2024/article-24 "Responsibility of the controller") [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing