# Article 35. Data protection impact assessment

Source: https://conformitate.md/en/law-195-2024/article-35
Law version: 2026-10-15 · Official source: legis.md (https://www.legis.md/cautare/getResults?doc_id=144681&lang=ro)
Notice: The Romanian and Russian texts are those published in Monitorul Oficial. This English text is an unofficial translation by conformitate.md and has no legal force. Not an official publication. The Law was published in Monitorul Oficial No. 367-369/2024, art. 574.

Chapter IV · Section 3

(1) Taking into account the nature, scope, context and purposes of the processing, where a type of processing, in particular one based on the use of new technologies, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.

(2) When carrying out a data protection impact assessment, the controller shall seek the opinion of the data protection officer, where one has been designated.

(3) A data protection impact assessment referred to in paragraph (1) shall in particular be required in the case of:

a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;

b) processing on a large scale of special categories of data referred to in art. 9(1), or of personal data relating to criminal convictions and offences referred to in art. 10; or

c) a systematic monitoring of a publicly accessible area on a large scale.

(4) The Centre shall approve the list of the types of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph (1).

(5) The Centre may approve a list of the types of processing operations for which no data protection impact assessment is required.

(6) The lists approved under paragraphs (4) and (5) shall be published in the Official Gazette of the Republic of Moldova (Monitorul Oficial) and on the official website of the Centre.

(7) The assessment shall contain at least:

a) a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller;

b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes;

c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph (1); and

d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with the provisions of this Law, taking into account the rights and legitimate interests of data subjects and other persons concerned.

(8) In assessing the impact of the processing operations performed by the controller or by the processors, in particular for the purposes of a data protection impact assessment, due account shall be taken of compliance by the controller or by the processors with codes of conduct, if they have been approved in accordance with art. 40.

(9) Where applicable, the controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations.

(10) In the case of processing pursuant to art. 6(1)(c) or (e), paragraphs (1)–(7) of this Article shall not apply if a data protection impact assessment has already been carried out as part of a general impact assessment in the context of the adoption of the normative acts providing for the legal bases for the processing, unless the normative acts provide that it is necessary to carry out a data protection impact assessment prior to the processing activities.

(11) Where necessary, the controller shall carry out a review to assess whether processing is performed in accordance with the data protection impact assessment, at least when there is a change in the risk represented by processing operations.

Related topics [Data protection impact assessment](https://conformitate.md/en/law-195-2024/impact-assessment)

## How we can help with this

-   [GDPR Moldova compliance assessment →](https://conformitate.md/en/services/compliance-assessment)
    
    We assess online how your company processes personal data and give you a written report of what is missing under Law No. 195/2024, in order of priority.

---

Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57  
Phone: +373 767 27 667 · Email: contact@conformitate.md  
Prices: https://conformitate.md/en/pricing