# Security and personal data breaches Source: https://conformitate.md/en/law-195-2024/security-and-breaches Updated: 2026-10-17 Law 195/2024 The controller and the processor ensure a level of security appropriate to the risk (art. 32). In the case of a personal data breach, the controller notifies the Centre without undue delay and, where possible, within 72 hours, unless the breach is unlikely to result in a risk (art. 33). ## What a personal data breach is The Law defines a personal data breach as any breach of security leading, accidentally or unlawfully, to the destruction, loss, alteration or unauthorised disclosure of personal data, or to unauthorised access to it [art. 4](https://conformitate.md/en/law-195-2024/article-4#term-13 "personal data breach"). This is not only about cyberattacks: for example, a lost file or an e-mail sent to the wrong recipient can also fall within the definition. ## Security of processing The controller and the processor implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. They take into account the current state of technological development, the costs, the nature and purposes of the processing and the risks to individuals [art. 32(1)](https://conformitate.md/en/law-195-2024/article-32#p1 "Security of processing"). The Law gives examples of such measures, as appropriate: pseudonymisation and encryption [art. 32(1)(a)](https://conformitate.md/en/law-195-2024/article-32#p1-a "Security of processing"), ensuring the confidentiality, integrity, availability and resilience of systems [art. 32(1)(b)](https://conformitate.md/en/law-195-2024/article-32#p1-b "Security of processing"), restoring access to data after an incident [art. 32(1)(c)](https://conformitate.md/en/law-195-2024/article-32#p1-c "Security of processing"), and regularly testing how effective the measures are [art. 32(1)(d)](https://conformitate.md/en/law-195-2024/article-32#p1-d "Security of processing"). In assessing the appropriate level of security, account is taken in particular of the risks of destruction, loss, alteration, unauthorised disclosure of or unauthorised access to data [art. 32(2)](https://conformitate.md/en/law-195-2024/article-32#p2 "Security of processing"). The controller and the processor take steps to ensure that people acting under their authority who have access to data process it only on the controller’s instructions [art. 32(4)](https://conformitate.md/en/law-195-2024/article-32#p4 "Security of processing"). Adherence to an approved code of conduct or certification mechanism may be used as an element by which to demonstrate that these requirements are met [art. 32(3)](https://conformitate.md/en/law-195-2024/article-32#p3 "Security of processing"). ## Notifying the Centre In the case of a personal data breach, the controller notifies the National Centre for Personal Data Protection without undue delay and, where possible, within 72 hours of becoming aware of it. Notification is not required where the breach is unlikely to result in a risk to the rights and freedoms of natural persons. A notification made after 72 hours is accompanied by a reasoned explanation of the delay [art. 33(1)](https://conformitate.md/en/law-195-2024/article-33#p1 "Notification of a personal data breach to the Centre"). The processor notifies the controller without undue delay after becoming aware of a breach [art. 33(2)](https://conformitate.md/en/law-195-2024/article-33#p2 "Notification of a personal data breach to the Centre"). The minimum content of the notification is set by the Law [art. 33(3)](https://conformitate.md/en/law-195-2024/article-33#p3 "Notification of a personal data breach to the Centre"), and the information may be provided in phases if it is not all available at once [art. 33(4)](https://conformitate.md/en/law-195-2024/article-33#p4 "Notification of a personal data breach to the Centre"). Whether or not it notifies, the controller documents all personal data breaches so that the Centre can verify compliance [art. 33(5)](https://conformitate.md/en/law-195-2024/article-33#p5 "Notification of a personal data breach to the Centre"). ## Informing data subjects Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller informs the data subjects without undue delay [art. 34(1)](https://conformitate.md/en/law-195-2024/article-34#p1 "Communication of a personal data breach to the data subject"), in clear and plain language [art. 34(2)](https://conformitate.md/en/law-195-2024/article-34#p2 "Communication of a personal data breach to the data subject"). Informing them is not required if the controller had applied measures that render the data unintelligible to unauthorised persons, such as encryption; if it has since taken measures ensuring that the high risk is no longer likely to materialise; or if informing them would involve disproportionate effort, in which case a public communication or an equally effective measure is used instead [art. 34(3)](https://conformitate.md/en/law-195-2024/article-34#p3 "Communication of a personal data breach to the data subject"). The Centre may require the controller to inform the data subjects, or may decide that one of these conditions is met [art. 34(4)](https://conformitate.md/en/law-195-2024/article-34#p4 "Communication of a personal data breach to the data subject"). ## Why it matters Infringements of the security and notification obligations are punishable by fines of up to 1,000,000 lei or, for an enterprise, of up to 1% of the total turnover achieved in the year preceding the imposition of the sanction, whichever is higher [art. 88(1)(a)](https://conformitate.md/en/law-195-2024/article-88#p1-a "Infringements punishable by a fine"). The way the breach became known to the Centre, including whether it was notified, is taken into account in setting the fine [art. 87(2)(h)](https://conformitate.md/en/law-195-2024/article-87#p2-h "General conditions for imposing fines"). Specific situations - [Personal data breach: what to do →](https://conformitate.md/en/situations/data-breach) ## How we can help with this - [Data breach response support →](https://conformitate.md/en/services/breach-response-support) Support when a personal data breach occurs: we assess the risk and prepare the notification and communication that Law No. 195/2024 requires. - [Employee data protection briefing in Moldova →](https://conformitate.md/en/services/employee-briefing) A briefing and advice session for employees who process personal data, built on your company's own documents and on Law No. 195/2024. ## Articles in this topic 1. [Article 32 Security of processing](https://conformitate.md/en/law-195-2024/article-32) 2. [Article 33 Notification of a personal data breach to the Centre](https://conformitate.md/en/law-195-2024/article-33) 3. [Article 34 Communication of a personal data breach to the data subject](https://conformitate.md/en/law-195-2024/article-34) **The Romanian and Russian texts are those published in Monitorul Oficial. This English text is an unofficial translation by conformitate.md and has no legal force.** Not an official publication. The Law was published in Monitorul Oficial No. 367-369/2024, art. 574. Text verified on 15 October 2026 · [Romanian text on legis.md](https://www.legis.md/cautare/getResults?doc_id=144681&lang=ro) FAQ ## What clients ask us ### Must the Centre be notified of every incident? No. Notification is not required where the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. The controller nevertheless keeps documentation of all breaches, including those it did not notify. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") ### What if the notification is made after 72 hours? The notification is still made, but it is accompanied by a reasoned explanation of the delay. The 72-hour period applies where possible; the basic rule is notification without undue delay. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") ### When must data subjects be informed? When the breach is likely to result in a high risk to their rights and freedoms. Informing them is not required, for example, if the data affected was encrypted and therefore unintelligible to unauthorised persons. [art. 34](https://conformitate.md/en/law-195-2024/article-34 "Communication of a personal data breach to the data subject") ### What are the processor’s obligations in a breach? It notifies the controller without undue delay after becoming aware of the breach. Notifying the Centre remains the controller’s obligation. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing