# Controller and processor obligations

Source: https://conformitate.md/en/law-195-2024/controller-and-processor-obligations
Updated: 2026-10-17

Law 195/2024

The controller implements appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing complies with the Law (art. 24). A processor acts under a written contract or other legal act and only on the controller’s instructions, save for statutory exceptions (art. 28–29). Both cooperate with the Centre on request (art. 31).

## Responsibility of the controller

The controller implements appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing complies with the Law, taking into account the nature, context and purposes of the processing and the risks to individuals. The measures are reviewed and updated where necessary [art. 24(1)](https://conformitate.md/en/law-195-2024/article-24#p1 "Responsibility of the controller"). Where proportionate to the processing, they include appropriate data protection policies [art. 24(2)](https://conformitate.md/en/law-195-2024/article-24#p2 "Responsibility of the controller").

Data protection is built in from the moment the means of processing are determined, not only afterwards [art. 25(1)](https://conformitate.md/en/law-195-2024/article-25#p1 "Data protection by design and by default"). By default, only the data necessary for each purpose is processed, and data is not made accessible to an indefinite number of people without the individual’s intervention [art. 25(2)](https://conformitate.md/en/law-195-2024/article-25#p2 "Data protection by design and by default").

## Joint controllers and representatives

Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers and allocate their responsibilities by means of an arrangement [art. 26(1)](https://conformitate.md/en/law-195-2024/article-26#p1 "Joint controllers"), the essence of which is made available to the data subject [art. 26(2)](https://conformitate.md/en/law-195-2024/article-26#p2 "Joint controllers"). Whatever the arrangement says, the data subject may exercise his or her rights against each of them [art. 26(3)](https://conformitate.md/en/law-195-2024/article-26#p3 "Joint controllers").

Controllers and processors not established in the Republic of Moldova that offer goods or services to people in the country or monitor their behaviour [art. 3(2)](https://conformitate.md/en/law-195-2024/article-3#p2 "Territorial scope") designate in writing a representative established in the country [art. 27(1)](https://conformitate.md/en/law-195-2024/article-27#p1 "Representatives of controllers or processors not established in the Republic of Moldova"), subject to the exceptions in the Law, for example for those established in a member state of the European Economic Area [art. 27(2)](https://conformitate.md/en/law-195-2024/article-27#p2 "Representatives of controllers or processors not established in the Republic of Moldova").

## The processor

The controller uses only processors that provide sufficient guarantees that the processing will comply with the Law [art. 28(1)](https://conformitate.md/en/law-195-2024/article-28#p1 "Processor"). The relationship is governed by a binding contract or other legal act whose minimum content is set by the Law [art. 28(3)](https://conformitate.md/en/law-195-2024/article-28#p3 "Processor"), drawn up in writing, including in electronic form [art. 28(8)](https://conformitate.md/en/law-195-2024/article-28#p8 "Processor"). A processor does not engage another processor without the controller’s written authorisation [art. 28(2)](https://conformitate.md/en/law-195-2024/article-28#p2 "Processor"), and it remains fully liable to the controller if that other processor fails to fulfil its obligations [art. 28(4)](https://conformitate.md/en/law-195-2024/article-28#p4 "Processor").

The processor, and anyone with access to the data acting under the authority of the controller, processes it only on the controller’s instructions, unless normative acts require the processing [art. 29](https://conformitate.md/en/law-195-2024/article-29 "Carrying out processing activities under the authority of the controller or the processor"). If a processor infringes the Law by determining the purposes and means of processing itself, it is considered a controller for that processing [art. 28(9)](https://conformitate.md/en/law-195-2024/article-28#p9 "Processor").

## Record of processing activities

Each controller maintains a record of the processing activities under its responsibility [art. 30(1)](https://conformitate.md/en/law-195-2024/article-30#p1 "Records of processing activities"), and each processor a record of the categories of activities carried out on behalf of controllers [art. 30(2)](https://conformitate.md/en/law-195-2024/article-30#p2 "Records of processing activities"). The records are kept in writing, including in electronic form [art. 30(3)](https://conformitate.md/en/law-195-2024/article-30#p3 "Records of processing activities"), and are made available to the National Centre for Personal Data Protection on request [art. 30(4)](https://conformitate.md/en/law-195-2024/article-30#p4 "Records of processing activities").

Enterprises and organisations with fewer than 250 employees are exempt, unless the processing is likely to result in a risk to the rights and freedoms of data subjects, is not occasional, or includes special categories of data or data relating to criminal convictions and offences [art. 30(5)](https://conformitate.md/en/law-195-2024/article-30#p5 "Records of processing activities"). The exemption is therefore conditional, not automatic. In our assessment, it rarely applies: in practice, most companies meet at least one of these conditions. The record takes the place of registration as a controller with the Centre, which ended with the repeal of Law No. 133/2011; see [transition from Law No. 133/2011](https://conformitate.md/en/law-195-2024/transition-from-law-133-2011).

## Cooperation with the Centre

The controller, the processor and, where applicable, their representatives cooperate on request with the Centre in the performance of its tasks [art. 31](https://conformitate.md/en/law-195-2024/article-31 "Cooperation with the Centre").

## Codes of conduct and certification

Associations representing categories of controllers may draw up codes of conduct [art. 40(2)](https://conformitate.md/en/law-195-2024/article-40#p2 "Codes of conduct"), which are approved by the Centre [art. 40(5)](https://conformitate.md/en/law-195-2024/article-40#p5 "Codes of conduct") and compliance with which may be monitored by an accredited body [art. 41(1)](https://conformitate.md/en/law-195-2024/article-41#p1 "Monitoring of approved codes of conduct"). Certification is voluntary [art. 42(3)](https://conformitate.md/en/law-195-2024/article-42#p3 "Certification"), is granted for a maximum of three years [art. 42(7)](https://conformitate.md/en/law-195-2024/article-42#p7 "Certification") and does not reduce the controller’s responsibility for complying with the Law [art. 42(4)](https://conformitate.md/en/law-195-2024/article-42#p4 "Certification"). Certification bodies are accredited by the National Accreditation Centre [art. 43(2)](https://conformitate.md/en/law-195-2024/article-43#p2 "Certification bodies"). Adherence to an approved code or certification mechanism may be used as an element by which to demonstrate compliance with the obligations [art. 24(3)](https://conformitate.md/en/law-195-2024/article-24#p3 "Responsibility of the controller").

Tools

-   [Check compliance in 12 questions →](https://conformitate.md/en/tools/compliance-test)

## How we can help with this

-   [GDPR Moldova compliance documentation →](https://conformitate.md/en/services/compliance-documentation)
    
    We prepare the data protection documents that Law No. 195/2024 requires for your company’s activity, ready for you to sign and put into practice.
    

## Articles in this topic

1.  [Article 24 Responsibility of the controller](https://conformitate.md/en/law-195-2024/article-24)
2.  [Article 25 Data protection by design and by default](https://conformitate.md/en/law-195-2024/article-25)
3.  [Article 26 Joint controllers](https://conformitate.md/en/law-195-2024/article-26)
4.  [Article 27 Representatives of controllers or processors not established in the Republic of Moldova](https://conformitate.md/en/law-195-2024/article-27)
5.  [Article 28 Processor](https://conformitate.md/en/law-195-2024/article-28)
6.  [Article 29 Carrying out processing activities under the authority of the controller or the processor](https://conformitate.md/en/law-195-2024/article-29)
7.  [Article 30 Records of processing activities](https://conformitate.md/en/law-195-2024/article-30)
8.  [Article 31 Cooperation with the Centre](https://conformitate.md/en/law-195-2024/article-31)
9.  [Article 40 Codes of conduct](https://conformitate.md/en/law-195-2024/article-40)
10.  [Article 41 Monitoring of approved codes of conduct](https://conformitate.md/en/law-195-2024/article-41)
11.  [Article 42 Certification](https://conformitate.md/en/law-195-2024/article-42)
12.  [Article 43 Certification bodies](https://conformitate.md/en/law-195-2024/article-43)

**The Romanian and Russian texts are those published in Monitorul Oficial. This English text is an unofficial translation by conformitate.md and has no legal force.**

Not an official publication. The Law was published in Monitorul Oficial No. 367-369/2024, art. 574.

Text verified on 15 October 2026 · [Romanian text on legis.md](https://www.legis.md/cautare/getResults?doc_id=144681&lang=ro)

FAQ

## What clients ask us

### Does every company have to keep a record of processing activities?

Enterprises and organisations with fewer than 250 employees are exempt, but only if the processing is unlikely to result in a risk to data subjects, is occasional and does not include special categories of data or data relating to criminal convictions and offences. If any of these conditions is not met, the record is mandatory. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities")

### Do we need a contract with a provider that processes data on our behalf?

Yes. Processing by a processor is governed by a contract or other legal act that is binding on the processor and is drawn up in writing, including in electronic form. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor")

### Is certification mandatory?

No. Certification is voluntary and does not reduce the responsibility of the controller or processor for complying with the Law. It may be used as an element by which to demonstrate compliance with the obligations. [art. 24](https://conformitate.md/en/law-195-2024/article-24 "Responsibility of the controller") [art. 42](https://conformitate.md/en/law-195-2024/article-42 "Certification")

### What happens if the provider decides the purposes of processing itself?

If a processor infringes the Law by determining the purposes and means of processing itself, it is considered a controller in respect of that processing. [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor")

---

Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57  
Phone: +373 767 27 667 · Email: contact@conformitate.md  
Prices: https://conformitate.md/en/pricing