# Data subject rights

Source: https://conformitate.md/en/law-195-2024/data-subject-rights
Updated: 2026-10-17

Law 195/2024

The data subject has the right to be informed, the right of access, to rectification, to erasure, to restriction of processing, to data portability and to object, and the right not to be subject to a solely automated decision (art. 13–22). The controller responds without undue delay and within one month, extendable by two months where necessary (art. 12).

## How the rights are exercised

The controller provides information and communications about processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language [art. 12(1)](https://conformitate.md/en/law-195-2024/article-12#p1 "Transparency of information, communications and modalities for the exercise of the rights of the data subject"), and facilitates the exercise of the rights [art. 12(2)](https://conformitate.md/en/law-195-2024/article-12#p2 "Transparency of information, communications and modalities for the exercise of the rights of the data subject").

On receiving a request, the controller responds without undue delay and in any event within one month. The period may be extended by two months where necessary, taking into account the complexity and number of requests, and the data subject must be told of the extension and the reasons for it within the first month [art. 12(3)](https://conformitate.md/en/law-195-2024/article-12#p3 "Transparency of information, communications and modalities for the exercise of the rights of the data subject"). If the controller does not act on the request, it explains why within the same one-month period and informs the data subject of the possibility of lodging a complaint with the National Centre for Personal Data Protection or bringing an action before a court [art. 12(4)](https://conformitate.md/en/law-195-2024/article-12#p4 "Transparency of information, communications and modalities for the exercise of the rights of the data subject").

Responses are free of charge. For manifestly unfounded or excessive requests, the controller may charge a reasonable fee or refuse to act, but it must demonstrate that the request is of that kind [art. 12(5)](https://conformitate.md/en/law-195-2024/article-12#p5 "Transparency of information, communications and modalities for the exercise of the rights of the data subject"). Where it has reasonable doubts about the identity of the person making the request, the controller may ask for additional information to confirm it [art. 12(6)](https://conformitate.md/en/law-195-2024/article-12#p6 "Transparency of information, communications and modalities for the exercise of the rights of the data subject").

## The right to be informed

When it collects data from the data subject, the controller informs him or her at the time of collection of its identity, the purposes and legal basis of the processing, the recipients and the rights he or she has [art. 13(1)](https://conformitate.md/en/law-195-2024/article-13#p1 "Information to be provided where personal data are collected from the data subject"), [art. 13(2)](https://conformitate.md/en/law-195-2024/article-13#p2 "Information to be provided where personal data are collected from the data subject"). Where the data comes from another source, the information is given within a reasonable period of no more than one month [art. 14(3)(a)](https://conformitate.md/en/law-195-2024/article-14#p3-a "Information to be provided where personal data have not been obtained from the data subject"), or earlier in the cases in [art. 14(3)(b)](https://conformitate.md/en/law-195-2024/article-14#p3-b "Information to be provided where personal data have not been obtained from the data subject") and [art. 14(3)(c)](https://conformitate.md/en/law-195-2024/article-14#p3-c "Information to be provided where personal data have not been obtained from the data subject"). The obligation does not apply, for example, where the person already has the information [art. 13(4)](https://conformitate.md/en/law-195-2024/article-13#p4 "Information to be provided where personal data are collected from the data subject"), [art. 14(5)](https://conformitate.md/en/law-195-2024/article-14#p5 "Information to be provided where personal data have not been obtained from the data subject").

## Rights over one’s own data

-   **Access.** The data subject may find out whether his or her data is being processed and obtain access to it and to information about the processing [art. 15(1)](https://conformitate.md/en/law-195-2024/article-15#p1 "Right of access by the data subject"), including a copy of the data [art. 15(3)](https://conformitate.md/en/law-195-2024/article-15#p3 "Right of access by the data subject").
-   **Rectification.** Inaccurate data is rectified without undue delay, and incomplete data is completed, taking into account the purposes of the processing [art. 16](https://conformitate.md/en/law-195-2024/article-16 "Right to rectification").
-   **Erasure.** Data is erased in the cases set out in the Law, for example where it is no longer necessary, where consent has been withdrawn and there is no other legal basis, or where it has been processed unlawfully [art. 17(1)](https://conformitate.md/en/law-195-2024/article-17#p1 "Right to erasure (‘right to be forgotten’)"). Erasure does not apply, among other cases, where processing is necessary for a legal obligation or for the establishment, exercise or defence of a right [art. 17(3)](https://conformitate.md/en/law-195-2024/article-17#p3 "Right to erasure (‘right to be forgotten’)").
-   **Restriction.** The data subject may obtain restriction of processing, for example while the accuracy of contested data is being verified [art. 18(1)](https://conformitate.md/en/law-195-2024/article-18#p1 "Right to restriction of processing").
-   **Portability.** Data that the data subject has provided, processed by automated means on the basis of consent or a contract, is given to him or her in a structured, commonly used and machine-readable format [art. 20(1)](https://conformitate.md/en/law-195-2024/article-20#p1 "Right to data portability").

The controller communicates any rectification, erasure or restriction to each recipient to whom it has disclosed the data, unless this proves impossible or involves disproportionate effort [art. 19](https://conformitate.md/en/law-195-2024/article-19 "Notification obligation regarding rectification or erasure of personal data or restriction of processing").

## Objection and automated decisions

The data subject may object, on personal grounds, to processing based on a public interest or a legitimate interest. The controller stops the processing unless it demonstrates compelling legitimate grounds that override the data subject’s interests, or the defence of a right [art. 21(1)](https://conformitate.md/en/law-195-2024/article-21#p1 "Right to object"). For direct marketing, the data subject may object at any time, and once he or she does, the data is no longer processed for that purpose [art. 21(2)](https://conformitate.md/en/law-195-2024/article-21#p2 "Right to object"), [art. 21(3)](https://conformitate.md/en/law-195-2024/article-21#p3 "Right to object"). The right to object is explicitly brought to the data subject’s attention at the latest at the first communication [art. 21(4)](https://conformitate.md/en/law-195-2024/article-21#p4 "Right to object"). For online stores, we explain consent for cookies, pixels and newsletters under [data protection for online stores](https://conformitate.md/en/industries/online-stores).

The data subject has the right not to be subject to a decision based solely on automated processing that produces legal effects concerning him or her or similarly significantly affects him or her [art. 22(1)](https://conformitate.md/en/law-195-2024/article-22#p1 "Automated individual decision-making, including profiling"). The exceptions are limited [art. 22(2)](https://conformitate.md/en/law-195-2024/article-22#p2 "Automated individual decision-making, including profiling"), and where the decision rests on a contract or on explicit consent, the person keeps at least the right to obtain human intervention, to express his or her point of view and to contest the decision [art. 22(3)](https://conformitate.md/en/law-195-2024/article-22#p3 "Automated individual decision-making, including profiling").

## Restrictions

These rights may be restricted only by law, in a way that respects the essence of fundamental rights and as a necessary and proportionate measure for purposes such as national security or the prevention of criminal offences [art. 23(1)](https://conformitate.md/en/law-195-2024/article-23#p1 "Restrictions").

Specific situations

-   [Data subject access request →](https://conformitate.md/en/situations/data-access-request)

## How we can help with this

-   [GDPR Moldova compliance documentation →](https://conformitate.md/en/services/compliance-documentation)
    
    We prepare the data protection documents that Law No. 195/2024 requires for your company’s activity, ready for you to sign and put into practice.
    

## Articles in this topic

1.  [Article 12 Transparency of information, communications and modalities for the exercise of the rights of the data subject](https://conformitate.md/en/law-195-2024/article-12)
2.  [Article 13 Information to be provided where personal data are collected from the data subject](https://conformitate.md/en/law-195-2024/article-13)
3.  [Article 14 Information to be provided where personal data have not been obtained from the data subject](https://conformitate.md/en/law-195-2024/article-14)
4.  [Article 15 Right of access by the data subject](https://conformitate.md/en/law-195-2024/article-15)
5.  [Article 16 Right to rectification](https://conformitate.md/en/law-195-2024/article-16)
6.  [Article 17 Right to erasure (‘right to be forgotten’)](https://conformitate.md/en/law-195-2024/article-17)
7.  [Article 18 Right to restriction of processing](https://conformitate.md/en/law-195-2024/article-18)
8.  [Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing](https://conformitate.md/en/law-195-2024/article-19)
9.  [Article 20 Right to data portability](https://conformitate.md/en/law-195-2024/article-20)
10.  [Article 21 Right to object](https://conformitate.md/en/law-195-2024/article-21)
11.  [Article 22 Automated individual decision-making, including profiling](https://conformitate.md/en/law-195-2024/article-22)
12.  [Article 23 Restrictions](https://conformitate.md/en/law-195-2024/article-23)

**The Romanian and Russian texts are those published in Monitorul Oficial. This English text is an unofficial translation by conformitate.md and has no legal force.**

Not an official publication. The Law was published in Monitorul Oficial No. 367-369/2024, art. 574.

Text verified on 15 October 2026 · [Romanian text on legis.md](https://www.legis.md/cautare/getResults?doc_id=144681&lang=ro)

FAQ

## What clients ask us

### How long does the controller have to respond to a request?

Without undue delay and in any event within one month of receipt of the request. The period may be extended by two months where necessary, taking into account the complexity and number of requests, and the data subject is told of the extension and the reasons for it within the first month. [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject")

### Can the controller charge a fee for responding?

As a rule, information and action taken on a request are free of charge. The controller may charge a reasonable fee or refuse to act only where a request is manifestly unfounded or excessive, and it bears the burden of demonstrating this. It may charge a reasonable fee for further copies of the data. [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 15](https://conformitate.md/en/law-195-2024/article-15 "Right of access by the data subject")

### Must data be erased whenever the data subject asks?

No. The right to erasure applies in the cases set out in the Law, for example where the data is no longer necessary or has been processed unlawfully. It does not apply, among other cases, where processing is necessary to comply with a legal obligation or for the establishment, exercise or defence of a right in administrative, judicial or out-of-court proceedings. [art. 17](https://conformitate.md/en/law-195-2024/article-17 "Right to erasure (‘right to be forgotten’)")

### Can a person object to direct marketing?

Yes, at any time. Once the person objects, the data may no longer be processed for direct marketing purposes. [art. 21](https://conformitate.md/en/law-195-2024/article-21 "Right to object")

---

Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57  
Phone: +373 767 27 667 · Email: contact@conformitate.md  
Prices: https://conformitate.md/en/pricing