# The data protection officer

Source: https://conformitate.md/en/law-195-2024/data-protection-officer
Updated: 2026-10-17

Law 195/2024

Designating a data protection officer is mandatory in certain cases: for public authorities and institutions, for controllers and processors whose core activities involve regular and systematic monitoring of data subjects on a large scale or large-scale processing of special categories of data or data on criminal convictions (art. 37), and where normative acts require it.

## When designation is mandatory

The controller and the processor designate a data protection officer in three cases [art. 37(1)](https://conformitate.md/en/law-195-2024/article-37#p1 "Designation of the data protection officer"):

-   the processing is carried out by a public authority or institution, except courts acting in the administration of justice [art. 37(1)(a)](https://conformitate.md/en/law-195-2024/article-37#p1-a "Designation of the data protection officer");
-   the core activities consist of processing operations which, by virtue of their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale [art. 37(1)(b)](https://conformitate.md/en/law-195-2024/article-37#p1-b "Designation of the data protection officer");
-   the core activities consist of processing on a large scale of special categories of data or of data relating to criminal convictions and offences [art. 37(1)(c)](https://conformitate.md/en/law-195-2024/article-37#p1-c "Designation of the data protection officer").

The conditions in the Law do not refer to the size of the company: for example, what matters is who processes the data and what the core activities consist of, not the number of employees [art. 37(1)](https://conformitate.md/en/law-195-2024/article-37#p1 "Designation of the data protection officer"). In other cases, designation is voluntary, except where normative acts require it [art. 37(4)](https://conformitate.md/en/law-195-2024/article-37#p4 "Designation of the data protection officer").

## Who can be the officer

The officer is designated on the basis of professional qualities, in particular expert knowledge of data protection law and practice, and the ability to fulfil the tasks set by the Law [art. 37(5)](https://conformitate.md/en/law-195-2024/article-37#p5 "Designation of the data protection officer"). The officer may be an employee or may work under a service contract [art. 37(6)](https://conformitate.md/en/law-195-2024/article-37#p6 "Designation of the data protection officer"). A group of enterprises may designate a single officer, provided that he or she is easily accessible from each establishment [art. 37(2)](https://conformitate.md/en/law-195-2024/article-37#p2 "Designation of the data protection officer"). The officer’s contact details are published and communicated to the National Centre for Personal Data Protection [art. 37(7)](https://conformitate.md/en/law-195-2024/article-37#p7 "Designation of the data protection officer").

## What safeguards the officer has

The controller involves the officer properly and in a timely manner in all issues relating to data protection [art. 38(1)](https://conformitate.md/en/law-195-2024/article-38#p1 "Position of the data protection officer") and provides the resources needed to carry out the tasks and to maintain expert knowledge [art. 38(2)](https://conformitate.md/en/law-195-2024/article-38#p2 "Position of the data protection officer").

The officer receives no instructions regarding the performance of his or her tasks, may not be dismissed or penalised for performing them, and reports directly to the highest management level [art. 38(3)](https://conformitate.md/en/law-195-2024/article-38#p3 "Position of the data protection officer"). Data subjects may contact the officer on any issue relating to their data and their rights [art. 38(4)](https://conformitate.md/en/law-195-2024/article-38#p4 "Position of the data protection officer"). The officer is bound by secrecy or confidentiality in the performance of the tasks [art. 38(5)](https://conformitate.md/en/law-195-2024/article-38#p5 "Position of the data protection officer"). The officer may have other tasks, provided they do not result in a conflict of interests [art. 38(6)](https://conformitate.md/en/law-195-2024/article-38#p6 "Position of the data protection officer").

## What the tasks are

The Law sets the officer’s minimum tasks [art. 39(1)](https://conformitate.md/en/law-195-2024/article-39#p1 "Tasks of the data protection officer"):

-   informing and advising the controller and the employees who carry out processing of their obligations [art. 39(1)(a)](https://conformitate.md/en/law-195-2024/article-39#p1-a "Tasks of the data protection officer");
-   monitoring compliance with the Law and with internal data protection policies [art. 39(1)(b)](https://conformitate.md/en/law-195-2024/article-39#p1-b "Tasks of the data protection officer");
-   providing advice, on request, on the data protection impact assessment [art. 39(1)(c)](https://conformitate.md/en/law-195-2024/article-39#p1-c "Tasks of the data protection officer");
-   cooperating with the Centre [art. 39(1)(d)](https://conformitate.md/en/law-195-2024/article-39#p1-d "Tasks of the data protection officer") and acting as its contact point, including for prior consultation [art. 39(1)(e)](https://conformitate.md/en/law-195-2024/article-39#p1-e "Tasks of the data protection officer").

In performing the tasks, the officer has due regard to the risk associated with the processing [art. 39(2)](https://conformitate.md/en/law-195-2024/article-39#p2 "Tasks of the data protection officer"). Responsibility for compliance nevertheless remains with the controller, which must be able to demonstrate that processing complies with the Law [art. 24(1)](https://conformitate.md/en/law-195-2024/article-24#p1 "Responsibility of the controller").

## Why it matters

Infringements of the obligations concerning the data protection officer are punishable by fines of up to 1,000,000 lei or, for an enterprise, of up to 1% of the total turnover achieved in the year preceding the imposition of the sanction, whichever is higher [art. 88(1)(a)](https://conformitate.md/en/law-195-2024/article-88#p1-a "Infringements punishable by a fine").

## How we can help with this

-   [External DPO in Moldova →](https://conformitate.md/en/services/external-dpo)
    
    An external data protection officer under a service contract, for companies that are required to designate one or that choose to designate one.
    

## Articles in this topic

1.  [Article 37 Designation of the data protection officer](https://conformitate.md/en/law-195-2024/article-37)
2.  [Article 38 Position of the data protection officer](https://conformitate.md/en/law-195-2024/article-38)
3.  [Article 39 Tasks of the data protection officer](https://conformitate.md/en/law-195-2024/article-39)

**The Romanian and Russian texts are those published in Monitorul Oficial. This English text is an unofficial translation by conformitate.md and has no legal force.**

Not an official publication. The Law was published in Monitorul Oficial No. 367-369/2024, art. 574.

Text verified on 15 October 2026 · [Romanian text on legis.md](https://www.legis.md/cautare/getResults?doc_id=144681&lang=ro)

FAQ

## What clients ask us

### Does every company need a data protection officer?

No. Designation is mandatory in the three cases set out in the Law. In other cases, the controller or processor may designate an officer voluntarily, or must do so where normative acts require it. [art. 37](https://conformitate.md/en/law-195-2024/article-37 "Designation of the data protection officer")

### Can the data protection officer be someone outside the company?

Yes. The officer may be a member of staff or may fulfil the tasks on the basis of a service contract. A group of enterprises may designate a single officer, provided that he or she is easily accessible from each establishment. [art. 37](https://conformitate.md/en/law-195-2024/article-37 "Designation of the data protection officer")

### Can the officer be dismissed for performing his or her tasks?

No. The officer may not be dismissed or penalised for performing his or her tasks and receives no instructions regarding the performance of those tasks. The officer reports directly to the highest management level. [art. 38](https://conformitate.md/en/law-195-2024/article-38 "Position of the data protection officer")

### Must the Centre be told who the officer is?

Yes. The controller or processor publishes the contact details of the data protection officer and communicates them to the Centre. [art. 37](https://conformitate.md/en/law-195-2024/article-37 "Designation of the data protection officer")

---

Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57  
Phone: +373 767 27 667 · Email: contact@conformitate.md  
Prices: https://conformitate.md/en/pricing