# Article 6. Lawfulness of processing

Source: https://conformitate.md/en/law-195-2024/article-6
Law version: 2026-10-15 · Official source: legis.md (https://www.legis.md/cautare/getResults?doc_id=144681&lang=ro)
Notice: The Romanian and Russian texts are those published in Monitorul Oficial. This English text is an unofficial translation by conformitate.md and has no legal force. Not an official publication. The Law was published in Monitorul Oficial No. 367-369/2024, art. 574.

Chapter II

(1) Processing shall be lawful only if and to the extent that at least one of the following conditions is met:

a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

c) processing is necessary for compliance with a legal obligation to which the controller is subject;

d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

(2) Personal data may be processed on the basis of paragraph (1)(e) where the processing is necessary for:

a) the performance of a task in the public interest arising from normative acts; or

b) the exercise by the controller of functions or duties provided for by normative acts.

(3) The bases for the processing referred to in paragraph (1)(c) and (e) and in paragraph (2) shall be laid down in the legislation of the Republic of Moldova.

(4) Paragraph (1)(f) shall not apply to processing carried out by public authorities in the performance of their duties.

(5) Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject’s consent or on normative acts which constitute a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in art. 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data were initially collected, take into account, inter alia:

a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;

b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;

c) the nature of the personal data, in particular where special categories of personal data are processed, in accordance with art. 9, or where personal data related to criminal convictions and offences are processed, in accordance with art. 10;

d) the possible consequences of the intended further processing for data subjects;

e) the existence of appropriate safeguards, which may include encryption or pseudonymisation.

Related topics [Principles of processing and legal bases](https://conformitate.md/en/law-195-2024/principles-and-legal-bases)

## How we can help with this

-   [GDPR Moldova compliance documentation →](https://conformitate.md/en/services/compliance-documentation)
    
    We prepare the data protection documents that Law No. 195/2024 requires for your company’s activity, ready for you to sign and put into practice.

---

Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57  
Phone: +373 767 27 667 · Email: contact@conformitate.md  
Prices: https://conformitate.md/en/pricing