# Article 34. Communication of a personal data breach to the data subject

Source: https://conformitate.md/en/law-195-2024/article-34
Law version: 2026-10-15 · Official source: legis.md (https://www.legis.md/cautare/getResults?doc_id=144681&lang=ro)
Notice: The Romanian and Russian texts are those published in Monitorul Oficial. This English text is an unofficial translation by conformitate.md and has no legal force. Not an official publication. The Law was published in Monitorul Oficial No. 367-369/2024, art. 574.

Chapter IV · Section 2

(1) When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall inform the data subject of the personal data breach without undue delay.

(2) The information provided to the data subject as referred to in paragraph (1) shall include a description, in clear and plain language, of the nature of the personal data breach and at least the information and measures referred to in art. 33(3)(b)–(d).

(3) Informing the data subject as referred to in paragraph (1) shall not be required if one of the following conditions is met:

a) the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access them, such as encryption;

b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph (1) is no longer likely to materialise;

c) it would involve disproportionate effort. In such a case, a public communication shall be made or a similar measure shall be taken whereby the data subjects are informed in an equally effective manner.

(4) If the controller has not informed the data subject of the personal data breach, the Centre, having considered the likelihood of the personal data breach resulting in a high risk, may require the controller to inform the data subject or may decide that one of the conditions referred to in paragraph (3) is met.

Related topics [Security of processing](https://conformitate.md/en/law-195-2024/security-and-breaches)

## How we can help with this

-   [Data breach response support →](https://conformitate.md/en/services/breach-response-support)
    
    Support when a personal data breach occurs: we assess the risk and prepare the notification and communication that Law No. 195/2024 requires.
    
-   [Employee data protection briefing in Moldova →](https://conformitate.md/en/services/employee-briefing)
    
    A briefing and advice session for employees who process personal data, built on your company's own documents and on Law No. 195/2024.

---

Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57  
Phone: +373 767 27 667 · Email: contact@conformitate.md  
Prices: https://conformitate.md/en/pricing