# Law No. 195/2024 on personal data protection

Source: https://conformitate.md/en/law-195-2024

Legislation

The full text of the law, article by article. The Law transposes Regulation (EU) 2016/679 (GDPR) into the law of the Republic of Moldova.

**The Romanian and Russian texts are those published in Monitorul Oficial. This English text is an unofficial translation by conformitate.md and has no legal force.**

Not an official publication. The Law was published in Monitorul Oficial No. 367-369/2024, art. 574.

Text verified on 15 October 2026 · [Romanian text on legis.md](https://www.legis.md/cautare/getResults?doc_id=144681&lang=ro)

[Glossary: the Article 4 definitions explained →](https://conformitate.md/en/glossary)

## The law by topic

[art. 5–11 Principles and legal bases Law No. 195/2024 requires personal data to be processed lawfully, fairly and transparently, for specified purposes, limited to what is necessary, accurately, for no longer than needed and securely (art. 5). Processing is lawful only if it meets at least one of the six conditions in art. 6. →](https://conformitate.md/en/law-195-2024/principles-and-legal-bases) [art. 12–23 Data subject rights The data subject has the right to be informed, the right of access, to rectification, to erasure, to restriction of processing, to data portability and to object, and the right not to be subject to a solely automated decision (art. 13–22). The controller responds without undue delay and within one month, extendable by two months where necessary (art. 12). →](https://conformitate.md/en/law-195-2024/data-subject-rights) [art. 24–43 Controller and processor obligations The controller implements appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing complies with the Law (art. 24). A processor acts under a written contract or other legal act and only on the controller’s instructions, save for statutory exceptions (art. 28–29). Both cooperate with the Centre on request (art. 31). →](https://conformitate.md/en/law-195-2024/controller-and-processor-obligations) [art. 32–34 Security and personal data breaches The controller and the processor ensure a level of security appropriate to the risk (art. 32). In the case of a personal data breach, the controller notifies the Centre without undue delay and, where possible, within 72 hours, unless the breach is unlikely to result in a risk (art. 33). →](https://conformitate.md/en/law-195-2024/security-and-breaches) [art. 35–36 Impact assessment and prior consultation A data protection impact assessment is not required for all processing. The controller carries it out before processing where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons (art. 35). If the assessment shows an unmitigated high risk, the controller consults the Centre before processing (art. 36). →](https://conformitate.md/en/law-195-2024/impact-assessment) [art. 37–39 The data protection officer Designating a data protection officer is mandatory in certain cases: for public authorities and institutions, for controllers and processors whose core activities involve regular and systematic monitoring of data subjects on a large scale or large-scale processing of special categories of data or data on criminal convictions (art. 37), and where normative acts require it. →](https://conformitate.md/en/law-195-2024/data-protection-officer) [art. 44–50 Transfers to other states Data may be transferred to another state only under the conditions of Chapter V: on an adequacy decision of the National Centre for Personal Data Protection (art. 45), appropriate safeguards (art. 46) or, failing those, a derogation for specific situations (art. 49). The Chapter does not apply to European Economic Area states (art. 44). →](https://conformitate.md/en/law-195-2024/transfers-to-other-states) [art. 51–54 Specific processing situations Law No. 195/2024 has special rules for four situations: processing for journalistic, academic, artistic or literary purposes (art. 51), access to information of public interest (art. 52), processing of the national identification number (art. 53), and processing for archiving, scientific or historical research or statistical purposes (art. 54). →](https://conformitate.md/en/law-195-2024/specific-processing-situations) [art. 55–85 The Centre, complaints and inspections The National Centre for Personal Data Protection supervises the application of Law No. 195/2024 (art. 58). It examines complaints from data subjects (art. 72), may also open investigations ex officio (art. 77, 81), and has investigative and corrective powers, including fines, as well as authorisation and advisory powers (art. 60). →](https://conformitate.md/en/law-195-2024/centre-complaints-and-inspections) [art. 86–88 Fines Law No. 195/2024 provides for fines of up to 1,000,000 lei or, for an enterprise, of up to 1% of total turnover in the year preceding the sanction, and for the infringements listed in art. 88(2) of up to 2,000,000 lei or 2%, in each case whichever is higher (art. 88). →](https://conformitate.md/en/law-195-2024/fines) [art. 89–90 Transition from Law No. 133/2011 Law No. 195/2024 applies from 23 August 2026 with no further adaptation period (art. 89), and Law No. 133/2011 is repealed on that date (art. 90). Registration as a controller with the Centre has ended: the controller keeps a record of processing activities instead (art. 30). Consent obtained earlier remains valid if the way it was given meets the conditions of the new Law (art. 90). →](https://conformitate.md/en/law-195-2024/transition-from-law-133-2011)

## Contents

## Chapter I General provisions

-   [1 Subject matter and purpose of the Law](https://conformitate.md/en/law-195-2024/article-1)
-   [2 Material scope](https://conformitate.md/en/law-195-2024/article-2)
-   [3 Territorial scope](https://conformitate.md/en/law-195-2024/article-3)
-   [4 Definitions](https://conformitate.md/en/law-195-2024/article-4)

## Chapter II Principles

-   [5 Principles relating to processing](https://conformitate.md/en/law-195-2024/article-5)
-   [6 Lawfulness of processing](https://conformitate.md/en/law-195-2024/article-6)
-   [7 Conditions for consent](https://conformitate.md/en/law-195-2024/article-7)
-   [8 Consent of children in relation to information society services](https://conformitate.md/en/law-195-2024/article-8)
-   [9 Processing of special categories of personal data](https://conformitate.md/en/law-195-2024/article-9)
-   [10 Processing of personal data relating to criminal convictions and offences](https://conformitate.md/en/law-195-2024/article-10)
-   [11 Processing which does not require identification](https://conformitate.md/en/law-195-2024/article-11)

## Chapter III Rights of the data subject

### Section 1. Transparency and modalities for the exercise of the rights of the data subject

-   [12 Transparency of information, communications and modalities for the exercise of the rights of the data subject](https://conformitate.md/en/law-195-2024/article-12)

### Section 2. Information and access to personal data

-   [13 Information to be provided where personal data are collected from the data subject](https://conformitate.md/en/law-195-2024/article-13)
-   [14 Information to be provided where personal data have not been obtained from the data subject](https://conformitate.md/en/law-195-2024/article-14)
-   [15 Right of access by the data subject](https://conformitate.md/en/law-195-2024/article-15)

### Section 3. Rectification and erasure

-   [16 Right to rectification](https://conformitate.md/en/law-195-2024/article-16)
-   [17 Right to erasure (‘right to be forgotten’)](https://conformitate.md/en/law-195-2024/article-17)
-   [18 Right to restriction of processing](https://conformitate.md/en/law-195-2024/article-18)
-   [19 Notification obligation regarding rectification or erasure of personal data or restriction of processing](https://conformitate.md/en/law-195-2024/article-19)
-   [20 Right to data portability](https://conformitate.md/en/law-195-2024/article-20)

### Section 4. Right to object and automated individual decision-making

-   [21 Right to object](https://conformitate.md/en/law-195-2024/article-21)
-   [22 Automated individual decision-making, including profiling](https://conformitate.md/en/law-195-2024/article-22)

### Section 5. Restrictions

-   [23 Restrictions](https://conformitate.md/en/law-195-2024/article-23)

## Chapter IV Controller and processor

### Section 1. General obligations

-   [24 Responsibility of the controller](https://conformitate.md/en/law-195-2024/article-24)
-   [25 Data protection by design and by default](https://conformitate.md/en/law-195-2024/article-25)
-   [26 Joint controllers](https://conformitate.md/en/law-195-2024/article-26)
-   [27 Representatives of controllers or processors not established in the Republic of Moldova](https://conformitate.md/en/law-195-2024/article-27)
-   [28 Processor](https://conformitate.md/en/law-195-2024/article-28)
-   [29 Carrying out processing activities under the authority of the controller or the processor](https://conformitate.md/en/law-195-2024/article-29)
-   [30 Records of processing activities](https://conformitate.md/en/law-195-2024/article-30)
-   [31 Cooperation with the Centre](https://conformitate.md/en/law-195-2024/article-31)

### Section 2. Security of personal data

-   [32 Security of processing](https://conformitate.md/en/law-195-2024/article-32)
-   [33 Notification of a personal data breach to the Centre](https://conformitate.md/en/law-195-2024/article-33)
-   [34 Communication of a personal data breach to the data subject](https://conformitate.md/en/law-195-2024/article-34)

### Section 3. Data protection impact assessment and prior consultation

-   [35 Data protection impact assessment](https://conformitate.md/en/law-195-2024/article-35)
-   [36 Prior consultation](https://conformitate.md/en/law-195-2024/article-36)

### Section 4. Data protection officer

-   [37 Designation of the data protection officer](https://conformitate.md/en/law-195-2024/article-37)
-   [38 Position of the data protection officer](https://conformitate.md/en/law-195-2024/article-38)
-   [39 Tasks of the data protection officer](https://conformitate.md/en/law-195-2024/article-39)

### Section 5. Codes of conduct and certification

-   [40 Codes of conduct](https://conformitate.md/en/law-195-2024/article-40)
-   [41 Monitoring of approved codes of conduct](https://conformitate.md/en/law-195-2024/article-41)
-   [42 Certification](https://conformitate.md/en/law-195-2024/article-42)
-   [43 Certification bodies](https://conformitate.md/en/law-195-2024/article-43)

## Chapter V Transfers of personal data to other states or to international organisations

-   [44 General principle for transfers](https://conformitate.md/en/law-195-2024/article-44)
-   [45 Transfers on the basis of a decision on the adequacy of the level of protection](https://conformitate.md/en/law-195-2024/article-45)
-   [46 Transfers on the basis of appropriate safeguards](https://conformitate.md/en/law-195-2024/article-46)
-   [47 Binding corporate rules](https://conformitate.md/en/law-195-2024/article-47)
-   [48 Transfers or disclosures of information not authorised by normative acts](https://conformitate.md/en/law-195-2024/article-48)
-   [49 Derogations for specific situations](https://conformitate.md/en/law-195-2024/article-49)
-   [50 International cooperation in the field of personal data protection](https://conformitate.md/en/law-195-2024/article-50)

## Chapter VI Specific cases of processing of personal data

-   [51 Processing and freedom of expression](https://conformitate.md/en/law-195-2024/article-51)
-   [52 Processing and access to information of public interest](https://conformitate.md/en/law-195-2024/article-52)
-   [53 Processing of a national identification number](https://conformitate.md/en/law-195-2024/article-53)
-   [54 Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes](https://conformitate.md/en/law-195-2024/article-54)

## Chapter VII National Centre for Personal Data Protection

### Section 1. General provisions

-   [55 Status of the Centre](https://conformitate.md/en/law-195-2024/article-55)
-   [56 Financing of the activity of the Centre](https://conformitate.md/en/law-195-2024/article-56)
-   [57 Staff ceiling and structure of the Centre](https://conformitate.md/en/law-195-2024/article-57)

### Section 2. Mission, tasks and powers of the Centre

-   [58 Mission of the Centre](https://conformitate.md/en/law-195-2024/article-58)
-   [59 Tasks of the Centre](https://conformitate.md/en/law-195-2024/article-59)
-   [60 Powers of the Centre](https://conformitate.md/en/law-195-2024/article-60)
-   [61 Activity report](https://conformitate.md/en/law-195-2024/article-61)

### Section 3. Organisation of the Centre

-   [62 Management of the Centre](https://conformitate.md/en/law-195-2024/article-62)
-   [63 Appointment of the Director of the Centre](https://conformitate.md/en/law-195-2024/article-63)
-   [64 Appointment of the Deputy Directors of the Centre](https://conformitate.md/en/law-195-2024/article-64)
-   [65 Duties of the Director and of the Deputy Directors of the Centre](https://conformitate.md/en/law-195-2024/article-65)
-   [66 Termination of the term of office of the Director and of the Deputy Directors of the Centre](https://conformitate.md/en/law-195-2024/article-66)
-   [67 Staff of the Centre](https://conformitate.md/en/law-195-2024/article-67)
-   [68 Data protection inspector](https://conformitate.md/en/law-195-2024/article-68)
-   [69 Appointment to the position of data protection inspector](https://conformitate.md/en/law-195-2024/article-69)
-   [70 Liability of the data protection inspector](https://conformitate.md/en/law-195-2024/article-70)
-   [71 Status of the staff of the Centre](https://conformitate.md/en/law-195-2024/article-71)

## Chapter VIII Legal remedies, liability and sanctions

### Section 1. General provisions

-   [72 Right to lodge a complaint with the Centre](https://conformitate.md/en/law-195-2024/article-72)
-   [73 Right to challenge the actions or inaction of the Centre](https://conformitate.md/en/law-195-2024/article-73)
-   [74 Right to bring an action before a court against a controller or processor](https://conformitate.md/en/law-195-2024/article-74)
-   [75 Representation of data subjects](https://conformitate.md/en/law-195-2024/article-75)
-   [76 Right to compensation and liability](https://conformitate.md/en/law-195-2024/article-76)

### Section 2. Preliminary examination, investigation and decision-making

-   [77 Initiation of the examination procedure](https://conformitate.md/en/law-195-2024/article-77)
-   [78 Stages of the examination procedure](https://conformitate.md/en/law-195-2024/article-78)
-   [79 Lodging of the complaint](https://conformitate.md/en/law-195-2024/article-79)
-   [80 Preliminary examination of the complaint](https://conformitate.md/en/law-195-2024/article-80)
-   [81 Investigation](https://conformitate.md/en/law-195-2024/article-81)
-   [82 Requests for information](https://conformitate.md/en/law-195-2024/article-82)
-   [83 Confidentiality](https://conformitate.md/en/law-195-2024/article-83)
-   [84 Issue and communication of decisions](https://conformitate.md/en/law-195-2024/article-84)
-   [85 Execution of the decisions of the Centre](https://conformitate.md/en/law-195-2024/article-85)

### Section 3. Pecuniary sanctions

-   [86 Fine](https://conformitate.md/en/law-195-2024/article-86)
-   [87 General conditions for imposing fines](https://conformitate.md/en/law-195-2024/article-87)
-   [88 Infringements punishable by a fine](https://conformitate.md/en/law-195-2024/article-88)

## Chapter IX Final and transitional provisions

-   [89 Final provisions](https://conformitate.md/en/law-195-2024/article-89)
-   [90 Transitional provisions](https://conformitate.md/en/law-195-2024/article-90)

---

Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57  
Phone: +373 767 27 667 · Email: contact@conformitate.md  
Prices: https://conformitate.md/en/pricing