# Principles and legal bases Source: https://conformitate.md/en/law-195-2024/principles-and-legal-bases Updated: 2026-10-15 Law 195/2024 Law No. 195/2024 requires personal data to be processed lawfully, fairly and transparently, for specified purposes, limited to what is necessary, accurately, for no longer than needed and securely (art. 5). Processing is lawful only if it meets at least one of the six conditions in art. 6. ## The six principles All processing of personal data must comply with the principles in [art. 5(1)](https://conformitate.md/en/law-195-2024/article-5#p1 "Principles relating to processing"). Data is processed lawfully, fairly and transparently in relation to the data subject [art. 5(1)(a)](https://conformitate.md/en/law-195-2024/article-5#p1-a "Principles relating to processing"). It is collected for specified, explicit and legitimate purposes and is not further processed in a manner incompatible with those purposes [art. 5(1)(b)](https://conformitate.md/en/law-195-2024/article-5#p1-b "Principles relating to processing"). Data must be adequate, relevant and limited to what is necessary for the purpose [art. 5(1)(c)](https://conformitate.md/en/law-195-2024/article-5#p1-c "Principles relating to processing"), and accurate and, where necessary, kept up to date [art. 5(1)(d)](https://conformitate.md/en/law-195-2024/article-5#p1-d "Principles relating to processing"). It is not kept in a form that permits identification of individuals for longer than the purposes of the processing require [art. 5(1)(e)](https://conformitate.md/en/law-195-2024/article-5#p1-e "Principles relating to processing"), and it is protected by appropriate technical or organisational measures against unauthorised or unlawful processing and against accidental loss, destruction or damage [art. 5(1)(f)](https://conformitate.md/en/law-195-2024/article-5#p1-f "Principles relating to processing"). ## The principle of accountability The controller is responsible for compliance with these principles and must be able to demonstrate it [art. 5(2)](https://conformitate.md/en/law-195-2024/article-5#p2 "Principles relating to processing"). The measures by which the controller ensures and demonstrates compliance are laid down in [art. 24(1)](https://conformitate.md/en/law-195-2024/article-24#p1 "Responsibility of the controller"). ## Legal bases Processing is lawful only if and to the extent that at least one of the conditions in [art. 6(1)](https://conformitate.md/en/law-195-2024/article-6#p1 "Lawfulness of processing") is met: - the data subject has given consent for one or more specific purposes [art. 6(1)(a)](https://conformitate.md/en/law-195-2024/article-6#p1-a "Lawfulness of processing"); - processing is necessary for the performance of a contract to which the data subject is party, or for pre-contractual steps taken at his or her request [art. 6(1)(b)](https://conformitate.md/en/law-195-2024/article-6#p1-b "Lawfulness of processing"); - processing is necessary for compliance with a legal obligation of the controller [art. 6(1)(c)](https://conformitate.md/en/law-195-2024/article-6#p1-c "Lawfulness of processing"); - processing is necessary to protect the vital interests of the data subject or of another natural person [art. 6(1)(d)](https://conformitate.md/en/law-195-2024/article-6#p1-d "Lawfulness of processing"); - processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller [art. 6(1)(e)](https://conformitate.md/en/law-195-2024/article-6#p1-e "Lawfulness of processing"); - processing is necessary for the legitimate interests of the controller or of a third party, except where they are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child [art. 6(1)(f)](https://conformitate.md/en/law-195-2024/article-6#p1-f "Lawfulness of processing"). Bases resting on a legal obligation or on a task in the public interest must be laid down in the legislation of the Republic of Moldova [art. 6(3)](https://conformitate.md/en/law-195-2024/article-6#p3 "Lawfulness of processing"). Public authorities may not rely on legitimate interests in the performance of their duties [art. 6(4)](https://conformitate.md/en/law-195-2024/article-6#p4 "Lawfulness of processing"). For a new purpose that is not based on consent or on normative acts, the controller determines whether it is compatible with the purpose for which the data was originally collected [art. 6(5)](https://conformitate.md/en/law-195-2024/article-6#p5 "Lawfulness of processing"). ## Consent Where processing is based on consent, the controller must be able to demonstrate that the data subject has given it [art. 7(1)](https://conformitate.md/en/law-195-2024/article-7#p1 "Conditions for consent"). A request for consent in a written declaration that also concerns other matters must be clearly distinguishable from them [art. 7(2)](https://conformitate.md/en/law-195-2024/article-7#p2 "Conditions for consent"). The data subject may withdraw consent at any time, as easily as it was given [art. 7(3)](https://conformitate.md/en/law-195-2024/article-7#p3 "Conditions for consent"). Where the performance of a contract is made conditional on consent that is not necessary for that contract, this counts in assessing whether consent is freely given [art. 7(4)](https://conformitate.md/en/law-195-2024/article-7#p4 "Conditions for consent"). For information society services offered directly to a child, the child’s own consent is sufficient from the age of 14; below that age, it must be given or authorised by the legal representative [art. 8(1)](https://conformitate.md/en/law-195-2024/article-8#p1 "Consent of children in relation to information society services"), and the controller makes reasonable efforts to verify this [art. 8(2)](https://conformitate.md/en/law-195-2024/article-8#p2 "Consent of children in relation to information society services"). ## Data that needs special protection Processing of special categories of data is prohibited [art. 9(1)](https://conformitate.md/en/law-195-2024/article-9#p1 "Processing of special categories of personal data"). They include data concerning health, genetic data, biometric data used to uniquely identify a person, and data revealing racial or ethnic origin, political opinions or trade union membership. The prohibition does not apply in the situations listed in [art. 9(2)](https://conformitate.md/en/law-195-2024/article-9#p2 "Processing of special categories of personal data"), for example where the data subject has given explicit consent [art. 9(2)(a)](https://conformitate.md/en/law-195-2024/article-9#p2-a "Processing of special categories of personal data"). Data relating to criminal convictions and offences is processed only under the control of a public authority or where authorised by normative acts that provide appropriate safeguards [art. 10(1)](https://conformitate.md/en/law-195-2024/article-10#p1 "Processing of personal data relating to criminal convictions and offences"). ## When identification is not required If the purposes of the processing do not require the data subject to be identified, the controller is not obliged to obtain additional information solely in order to comply with the Law [art. 11(1)](https://conformitate.md/en/law-195-2024/article-11#p1 "Processing which does not require identification"). If it can demonstrate that it cannot identify the data subject, the controller informs him or her accordingly, if possible, and the rights in art. 15–20 do not apply, unless the data subject provides additional information enabling his or her identification [art. 11(2)](https://conformitate.md/en/law-195-2024/article-11#p2 "Processing which does not require identification"). ## How we can help with this - [GDPR Moldova compliance documentation →](https://conformitate.md/en/services/compliance-documentation) We prepare the data protection documents that Law No. 195/2024 requires for your company’s activity, ready for you to sign and put into practice. ## Articles in this topic 1. [Article 5 Principles relating to processing](https://conformitate.md/en/law-195-2024/article-5) 2. [Article 6 Lawfulness of processing](https://conformitate.md/en/law-195-2024/article-6) 3. [Article 7 Conditions for consent](https://conformitate.md/en/law-195-2024/article-7) 4. [Article 8 Consent of children in relation to information society services](https://conformitate.md/en/law-195-2024/article-8) 5. [Article 9 Processing of special categories of personal data](https://conformitate.md/en/law-195-2024/article-9) 6. [Article 10 Processing of personal data relating to criminal convictions and offences](https://conformitate.md/en/law-195-2024/article-10) 7. [Article 11 Processing which does not require identification](https://conformitate.md/en/law-195-2024/article-11) **The Romanian and Russian texts are those published in Monitorul Oficial. This English text is an unofficial translation by conformitate.md and has no legal force.** Not an official publication. The Law was published in Monitorul Oficial No. 367-369/2024, art. 574. Text verified on 15 October 2026 · [Romanian text on legis.md](https://www.legis.md/cautare/getResults?doc_id=144681&lang=ro) FAQ ## What clients ask us ### Is consent needed for all processing? No. Consent is only one of the six conditions for lawful processing. Processing may rest on another basis instead, such as the performance of a contract, a legal obligation of the controller, or a legitimate interest that is not overridden by the interests or rights of the data subject. [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") ### Can a data subject withdraw consent? Yes, at any time, and withdrawing consent must be as easy as giving it. Withdrawal does not affect the lawfulness of the processing carried out before it. [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") ### From what age can a child consent to an online service on their own? For information society services offered directly to a child, the child’s consent makes the processing lawful if the child is at least 14. Below that age, the processing is lawful only if and to the extent that consent is given or authorised by the child’s legal representative. [art. 8](https://conformitate.md/en/law-195-2024/article-8 "Consent of children in relation to information society services") ### Can a company process data concerning its employees’ health? Data concerning health is one of the special categories, whose processing is prohibited outside the exceptions set by the Law. The exceptions include obligations in the field of employment, in so far as authorised by normative acts or by a collective labour agreement providing for appropriate safeguards, and occupational medicine on the basis of normative acts or a contract with a health service provider, subject to the obligation of professional secrecy. [art. 9](https://conformitate.md/en/law-195-2024/article-9 "Processing of special categories of personal data") --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing