# Impact assessment and prior consultation Source: https://conformitate.md/en/law-195-2024/impact-assessment Updated: 2026-10-15 Law 195/2024 A data protection impact assessment is not required for all processing. The controller carries it out before processing where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons (art. 35). If the assessment shows an unmitigated high risk, the controller consults the Centre before processing (art. 36). ## What an impact assessment is A data protection impact assessment is the analysis the controller carries out before high-risk processing, to assess the impact of the envisaged processing operations on the protection of personal data [art. 35(1)](https://conformitate.md/en/law-195-2024/article-35#p1 "Data protection impact assessment"). The Law sets the minimum content of the assessment [art. 35(7)](https://conformitate.md/en/law-195-2024/article-35#p7 "Data protection impact assessment"), and the controller must be able to demonstrate that processing complies with the Law [art. 24(1)](https://conformitate.md/en/law-195-2024/article-24#p1 "Responsibility of the controller"). ## When it is required The obligation is not general. The controller carries out an assessment where, taking into account the nature, scope, context and purposes of the processing, a type of processing, in particular one using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons [art. 35(1)](https://conformitate.md/en/law-195-2024/article-35#p1 "Data protection impact assessment"). The Law names three situations in which an assessment is required in particular: - a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based [art. 35(3)(a)](https://conformitate.md/en/law-195-2024/article-35#p3-a "Data protection impact assessment"); - processing on a large scale of special categories of data or of data relating to criminal convictions and offences [art. 35(3)(b)](https://conformitate.md/en/law-195-2024/article-35#p3-b "Data protection impact assessment"); - systematic monitoring of a publicly accessible area on a large scale [art. 35(3)(c)](https://conformitate.md/en/law-195-2024/article-35#p3-c "Data protection impact assessment"). The National Centre for Personal Data Protection approves the list of types of processing operations that require an assessment [art. 35(4)](https://conformitate.md/en/law-195-2024/article-35#p4 "Data protection impact assessment") and may approve a list of those for which none is required [art. 35(5)](https://conformitate.md/en/law-195-2024/article-35#p5 "Data protection impact assessment"). The lists are published in the Official Gazette of the Republic of Moldova (Monitorul Oficial) and on the Centre’s website [art. 35(6)](https://conformitate.md/en/law-195-2024/article-35#p6 "Data protection impact assessment"). A single assessment may cover a set of similar operations that present similar high risks [art. 35(1)](https://conformitate.md/en/law-195-2024/article-35#p1 "Data protection impact assessment"). For processing based on a legal obligation or a task in the public interest, no assessment is needed if one has already been carried out as part of a general impact assessment when the normative acts providing for the processing were adopted, unless those acts require one before the processing [art. 35(10)](https://conformitate.md/en/law-195-2024/article-35#p10 "Data protection impact assessment"). ## Who is involved If a data protection officer has been designated, the controller seeks his or her advice [art. 35(2)](https://conformitate.md/en/law-195-2024/article-35#p2 "Data protection impact assessment"). Where appropriate, the controller also seeks the views of data subjects or their representatives [art. 35(9)](https://conformitate.md/en/law-195-2024/article-35#p9 "Data protection impact assessment"). Compliance with an approved code of conduct is duly taken into account in assessing the impact [art. 35(8)](https://conformitate.md/en/law-195-2024/article-35#p8 "Data protection impact assessment"). An assessment is not a one-off exercise: where necessary, the controller reviews whether the processing is carried out in accordance with it, at least when the risk changes [art. 35(11)](https://conformitate.md/en/law-195-2024/article-35#p11 "Data protection impact assessment"). ## Prior consultation of the Centre The controller consults the Centre before processing where the assessment indicates that the processing would result in a high risk in the absence of measures taken to mitigate it [art. 36(1)](https://conformitate.md/en/law-195-2024/article-36#p1 "Prior consultation"). In doing so, it provides the information required by the Law, including the impact assessment [art. 36(3)](https://conformitate.md/en/law-195-2024/article-36#p3 "Prior consultation"). If the Centre considers that the intended processing would infringe the Law, it provides the controller with written advice within eight weeks of receipt of the request, a period that may be extended by six weeks depending on complexity. The Centre may also use any of its powers [art. 36(2)](https://conformitate.md/en/law-195-2024/article-36#p2 "Prior consultation"), [art. 60](https://conformitate.md/en/law-195-2024/article-60 "Powers of the Centre"). ## Why it matters Infringements of the obligations on impact assessment and prior consultation are punishable by fines of up to 1,000,000 lei or, for an enterprise, of up to 1% of the total turnover achieved in the year preceding the imposition of the sanction, whichever is higher [art. 88(1)(a)](https://conformitate.md/en/law-195-2024/article-88#p1-a "Infringements punishable by a fine"). ## How we can help with this - [GDPR Moldova compliance assessment →](https://conformitate.md/en/services/compliance-assessment) We assess online how your company processes personal data and give you a written report of what is missing under Law No. 195/2024, in order of priority. ## Articles in this topic 1. [Article 35 Data protection impact assessment](https://conformitate.md/en/law-195-2024/article-35) 2. [Article 36 Prior consultation](https://conformitate.md/en/law-195-2024/article-36) **The Romanian and Russian texts are those published in Monitorul Oficial. This English text is an unofficial translation by conformitate.md and has no legal force.** Not an official publication. The Law was published in Monitorul Oficial No. 367-369/2024, art. 574. Text verified on 15 October 2026 · [Romanian text on legis.md](https://www.legis.md/cautare/getResults?doc_id=144681&lang=ro) FAQ ## What clients ask us ### Does every company have to carry out an impact assessment? No. An assessment is required where a type of processing, in particular one using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons. The Law names three situations in which it is required in particular, and the Centre approves the list of types of processing that require one. [art. 35](https://conformitate.md/en/law-195-2024/article-35 "Data protection impact assessment") ### Does the Centre have to approve the assessment? No. The controller consults the Centre only where the assessment indicates that the processing would result in a high risk in the absence of measures to mitigate it. [art. 36](https://conformitate.md/en/law-195-2024/article-36 "Prior consultation") ### How long does the Centre have to respond to a prior consultation? If the Centre considers that the intended processing would infringe the Law, it provides written advice within eight weeks of receipt of the request. The period may be extended by six weeks, taking into account the complexity of the processing, and may be suspended until the information requested has been obtained. [art. 36](https://conformitate.md/en/law-195-2024/article-36 "Prior consultation") ### Can one assessment cover several processing operations? Yes. A single assessment may address a set of similar processing operations that present similar high risks. [art. 35](https://conformitate.md/en/law-195-2024/article-35 "Data protection impact assessment") --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing