Controller and processor obligations

Responsibility of the controller

The controller implements appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing complies with the Law, taking into account the nature, context and purposes of the processing and the risks to individuals. The measures are reviewed and updated where necessary art. 24(1). Where proportionate to the processing, they include appropriate data protection policies art. 24(2).

Data protection is built in from the moment the means of processing are determined, not only afterwards art. 25(1). By default, only the data necessary for each purpose is processed, and data is not made accessible to an indefinite number of people without the individual’s intervention art. 25(2).

Joint controllers and representatives

Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers and allocate their responsibilities by means of an arrangement art. 26(1), the essence of which is made available to the data subject art. 26(2). Whatever the arrangement says, the data subject may exercise his or her rights against each of them art. 26(3).

Controllers and processors not established in the Republic of Moldova that offer goods or services to people in the country or monitor their behaviour art. 3(2) designate in writing a representative established in the country art. 27(1), subject to the exceptions in the Law, for example for those established in a member state of the European Economic Area art. 27(2).

The processor

The controller uses only processors that provide sufficient guarantees that the processing will comply with the Law art. 28(1). The relationship is governed by a binding contract or other legal act whose minimum content is set by the Law art. 28(3), drawn up in writing, including in electronic form art. 28(8). A processor does not engage another processor without the controller’s written authorisation art. 28(2), and it remains fully liable to the controller if that other processor fails to fulfil its obligations art. 28(4).

The processor, and anyone with access to the data acting under the authority of the controller, processes it only on the controller’s instructions, unless normative acts require the processing art. 29. If a processor infringes the Law by determining the purposes and means of processing itself, it is considered a controller for that processing art. 28(9).

Record of processing activities

Each controller maintains a record of the processing activities under its responsibility art. 30(1), and each processor a record of the categories of activities carried out on behalf of controllers art. 30(2). The records are kept in writing, including in electronic form art. 30(3), and are made available to the National Centre for Personal Data Protection on request art. 30(4).

Enterprises and organisations with fewer than 250 employees are exempt, unless the processing is likely to result in a risk to the rights and freedoms of data subjects, is not occasional, or includes special categories of data or data relating to criminal convictions and offences art. 30(5). The exemption is therefore conditional, not automatic. In our assessment, it rarely applies: in practice, most companies meet at least one of these conditions. The record takes the place of registration as a controller with the Centre, which ended with the repeal of Law No. 133/2011; see transition from Law No. 133/2011.

Cooperation with the Centre

The controller, the processor and, where applicable, their representatives cooperate on request with the Centre in the performance of its tasks art. 31.

Codes of conduct and certification

Associations representing categories of controllers may draw up codes of conduct art. 40(2), which are approved by the Centre art. 40(5) and compliance with which may be monitored by an accredited body art. 41(1). Certification is voluntary art. 42(3), is granted for a maximum of three years art. 42(7) and does not reduce the controller’s responsibility for complying with the Law art. 42(4). Certification bodies are accredited by the National Accreditation Centre art. 43(2). Adherence to an approved code or certification mechanism may be used as an element by which to demonstrate compliance with the obligations art. 24(3).