Legislation
Law No. 195/2024 on personal data protection
The full text of the law, article by article. The Law transposes Regulation (EU) 2016/679 (GDPR) into the law of the Republic of Moldova.
The law by topic
art. 5–11Principles and legal basesLaw No. 195/2024 requires personal data to be processed lawfully, fairly and transparently, for specified purposes, limited to what is necessary, accurately, for no longer than needed and securely (art. 5). Processing is lawful only if it meets at least one of the six conditions in art. 6.→art. 12–23Data subject rightsThe data subject has the right to be informed, the right of access, to rectification, to erasure, to restriction of processing, to data portability and to object, and the right not to be subject to a solely automated decision (art. 13–22). The controller responds without undue delay and within one month, extendable by two months where necessary (art. 12).→art. 24–43Controller and processor obligationsThe controller implements appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing complies with the Law (art. 24). A processor acts under a written contract or other legal act and only on the controller’s instructions, save for statutory exceptions (art. 28–29). Both cooperate with the Centre on request (art. 31).→art. 32–34Security and personal data breachesThe controller and the processor ensure a level of security appropriate to the risk (art. 32). In the case of a personal data breach, the controller notifies the Centre without undue delay and, where possible, within 72 hours, unless the breach is unlikely to result in a risk (art. 33).→art. 35–36Impact assessment and prior consultationA data protection impact assessment is not required for all processing. The controller carries it out before processing where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons (art. 35). If the assessment shows an unmitigated high risk, the controller consults the Centre before processing (art. 36).→art. 37–39The data protection officerDesignating a data protection officer is mandatory in certain cases: for public authorities and institutions, for controllers and processors whose core activities involve regular and systematic monitoring of data subjects on a large scale or large-scale processing of special categories of data or data on criminal convictions (art. 37), and where normative acts require it.→art. 44–50Transfers to other statesData may be transferred to another state only under the conditions of Chapter V: on an adequacy decision of the National Centre for Personal Data Protection (art. 45), appropriate safeguards (art. 46) or, failing those, a derogation for specific situations (art. 49). The Chapter does not apply to European Economic Area states (art. 44).→art. 51–54Specific processing situationsLaw No. 195/2024 has special rules for four situations: processing for journalistic, academic, artistic or literary purposes (art. 51), access to information of public interest (art. 52), processing of the national identification number (art. 53), and processing for archiving, scientific or historical research or statistical purposes (art. 54).→art. 55–85The Centre, complaints and inspectionsThe National Centre for Personal Data Protection supervises the application of Law No. 195/2024 (art. 58). It examines complaints from data subjects (art. 72), may also open investigations ex officio (art. 77, 81), and has investigative and corrective powers, including fines, as well as authorisation and advisory powers (art. 60).→art. 86–88FinesLaw No. 195/2024 provides for fines of up to 1,000,000 lei or, for an enterprise, of up to 1% of total turnover in the year preceding the sanction, and for the infringements listed in art. 88(2) of up to 2,000,000 lei or 2%, in each case whichever is higher (art. 88).→art. 89–90Transition from Law No. 133/2011Law No. 195/2024 applies from 23 August 2026 with no further adaptation period (art. 89), and Law No. 133/2011 is repealed on that date (art. 90). Registration as a controller with the Centre has ended: the controller keeps a record of processing activities instead (art. 30). Consent obtained earlier remains valid if the way it was given meets the conditions of the new Law (art. 90).→