# Transfers to other states Source: https://conformitate.md/en/law-195-2024/transfers-to-other-states Updated: 2026-10-17 Law 195/2024 Data may be transferred to another state only under the conditions of Chapter V: on an adequacy decision of the National Centre for Personal Data Protection (art. 45), appropriate safeguards (art. 46) or, failing those, a derogation for specific situations (art. 49). The Chapter does not apply to European Economic Area states (art. 44). ## The general rule Personal data may be transferred to another state or to an international organisation only if the controller and the processor comply with the conditions of the Chapter on transfers, including for onward transfers from that state [art. 44(1)](https://conformitate.md/en/law-195-2024/article-44#p1 "General principle for transfers"). The aim is to ensure that the level of protection guaranteed by the Law is not undermined when data leaves the country. The Chapter does not apply to transfers to member states of the European Economic Area, and no special authorisation is needed for them [art. 44(2)](https://conformitate.md/en/law-195-2024/article-44#p2 "General principle for transfers"). The other obligations of the Law continue to apply to all processing. ## Adequacy decisions A transfer is carried out where the National Centre for Personal Data Protection decides that the state, a territory or a sector within it, or the international organisation, ensures an adequate level of protection; such a transfer requires no special authorisation [art. 45(1)](https://conformitate.md/en/law-195-2024/article-45#p1 "Transfers on the basis of a decision on the adequacy of the level of protection"). In its assessment, the Centre takes into account, among other things, the decisions of the European Commission on the adequacy of the level of protection [art. 45(2)(d)](https://conformitate.md/en/law-195-2024/article-45#p2-d "Transfers on the basis of a decision on the adequacy of the level of protection"). The list of states and organisations for which it has decided that the level of protection is, or is no longer, adequate is published in the Official Gazette of the Republic of Moldova (Monitorul Oficial) and on the Centre’s website [art. 45(8)](https://conformitate.md/en/law-195-2024/article-45#p8 "Transfers on the basis of a decision on the adequacy of the level of protection"). The Centre also monitors, on an ongoing basis, the adequacy decisions issued before the Law entered into force [art. 45(4)](https://conformitate.md/en/law-195-2024/article-45#p4 "Transfers on the basis of a decision on the adequacy of the level of protection"), and the Centre’s acts issued under art. 32(3) and (5)(f) and (i) of Law No. 133/2011, the article on cross-border transfers, remain in force [art. 90(5)](https://conformitate.md/en/law-195-2024/article-90#p5 "Transitional provisions"). ## Appropriate safeguards In the absence of a decision, a transfer is possible only if the controller or processor provides appropriate safeguards and data subjects have enforceable rights and effective legal remedies [art. 46(1)](https://conformitate.md/en/law-195-2024/article-46#p1 "Transfers on the basis of appropriate safeguards"). Without specific authorisation from the Centre, the safeguards may be provided only by the instruments the Law lists: a binding and enforceable legal act between public authorities or institutions, binding corporate rules, standard data protection clauses approved by the Centre or adopted by the European Commission, or an approved code of conduct or certification mechanism together with a binding and enforceable commitment of the controller or processor in the other state [art. 46(2)](https://conformitate.md/en/law-195-2024/article-46#p2 "Transfers on the basis of appropriate safeguards"). Contractual clauses agreed directly with the recipient and administrative arrangements between authorities require the Centre’s authorisation [art. 46(3)](https://conformitate.md/en/law-195-2024/article-46#p3 "Transfers on the basis of appropriate safeguards"). Binding corporate rules allow transfers within a group of enterprises and are approved by the Centre if they meet the requirements of the Law [art. 47(1)](https://conformitate.md/en/law-195-2024/article-47#p1 "Binding corporate rules"). ## Derogations for specific situations If there is neither a decision nor appropriate safeguards, a transfer may take place only in one of the situations listed in the Law [art. 49(1)](https://conformitate.md/en/law-195-2024/article-49#p1 "Derogations for specific situations"). They include the explicit consent of the data subject, given after being informed of the risks [art. 49(1)(a)](https://conformitate.md/en/law-195-2024/article-49#p1-a "Derogations for specific situations"), and a transfer necessary for the performance of a contract with the data subject [art. 49(1)(b)](https://conformitate.md/en/law-195-2024/article-49#p1-b "Derogations for specific situations"). As a last resort, a transfer that is not repetitive and concerns a limited number of data subjects may take place if it is necessary for the substantial legitimate interests of the controller, which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances and provided appropriate safeguards. The controller informs the Centre and the data subject of the transfer [art. 49(2)](https://conformitate.md/en/law-195-2024/article-49#p2 "Derogations for specific situations") and documents the assessment in the records of processing activities [art. 49(7)](https://conformitate.md/en/law-195-2024/article-49#p7 "Derogations for specific situations"). ## Requests from foreign authorities A judgment of a court or a decision of an authority of another state requiring the transfer or disclosure of data may be recognised or enforced only if it is based on an international treaty, such as a mutual legal assistance treaty in force between the requesting state and the Republic of Moldova, without prejudice to the other grounds for transfer in Chapter V [art. 48](https://conformitate.md/en/law-195-2024/article-48 "Transfers or disclosures of information not authorised by normative acts"). The Centre cooperates with authorities in other states to enforce the legislation effectively [art. 50](https://conformitate.md/en/law-195-2024/article-50 "International cooperation in the field of personal data protection"). ## Why it matters The data subject must be informed of any intention to transfer data to another state and of the basis for the transfer [art. 13(1)(f)](https://conformitate.md/en/law-195-2024/article-13#p1-f "Information to be provided where personal data are collected from the data subject"). Infringements of the rules on transfers are punishable by fines of up to 2,000,000 lei or, for an enterprise, of up to 2% of total turnover, whichever is higher [art. 88(2)(c)](https://conformitate.md/en/law-195-2024/article-88#p2-c "Infringements punishable by a fine"). ## How we can help with this - [GDPR Moldova compliance assessment →](https://conformitate.md/en/services/compliance-assessment) We assess online how your company processes personal data and give you a written report of what is missing under Law No. 195/2024, in order of priority. ## Articles in this topic 1. [Article 44 General principle for transfers](https://conformitate.md/en/law-195-2024/article-44) 2. [Article 45 Transfers on the basis of a decision on the adequacy of the level of protection](https://conformitate.md/en/law-195-2024/article-45) 3. [Article 46 Transfers on the basis of appropriate safeguards](https://conformitate.md/en/law-195-2024/article-46) 4. [Article 47 Binding corporate rules](https://conformitate.md/en/law-195-2024/article-47) 5. [Article 48 Transfers or disclosures of information not authorised by normative acts](https://conformitate.md/en/law-195-2024/article-48) 6. [Article 49 Derogations for specific situations](https://conformitate.md/en/law-195-2024/article-49) 7. [Article 50 International cooperation in the field of personal data protection](https://conformitate.md/en/law-195-2024/article-50) **The Romanian and Russian texts are those published in Monitorul Oficial. This English text is an unofficial translation by conformitate.md and has no legal force.** Not an official publication. The Law was published in Monitorul Oficial No. 367-369/2024, art. 574. Text verified on 15 October 2026 · [Romanian text on legis.md](https://www.legis.md/cautare/getResults?doc_id=144681&lang=ro) FAQ ## What clients ask us ### Is a transfer to a European Union country subject to these rules? The Chapter on transfers does not apply to transfers to member states of the European Economic Area, and no special authorisation is needed for them. The rest of the Law, including the principles and the security obligations, still applies. [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") ### Can we use a cloud provider in a state outside the European Economic Area? Yes, if the transfer is based on a decision of the Centre on the adequacy of the level of protection, on appropriate safeguards such as standard data protection clauses approved by the Centre or adopted by the European Commission, or, failing those, only in one of the specific situations listed in art. 49. [art. 45](https://conformitate.md/en/law-195-2024/article-45 "Transfers on the basis of a decision on the adequacy of the level of protection") [art. 46](https://conformitate.md/en/law-195-2024/article-46 "Transfers on the basis of appropriate safeguards") [art. 49](https://conformitate.md/en/law-195-2024/article-49 "Derogations for specific situations") ### Do we need the Centre’s authorisation for a transfer? Not where the transfer is based on an adequacy decision or on the safeguards listed in art. 46(2). Authorisation is required for contractual clauses agreed directly between the controller or processor and the recipient, and for administrative arrangements between authorities. [art. 45](https://conformitate.md/en/law-195-2024/article-45 "Transfers on the basis of a decision on the adequacy of the level of protection") [art. 46](https://conformitate.md/en/law-195-2024/article-46 "Transfers on the basis of appropriate safeguards") ### Can a foreign court require us to disclose data? A judgment of a court or a decision of an authority of another state requiring the transfer or disclosure of data may be recognised or enforced only if it is based on an international treaty, such as a mutual legal assistance treaty, without prejudice to the other grounds for transfer in Chapter V. [art. 48](https://conformitate.md/en/law-195-2024/article-48 "Transfers or disclosures of information not authorised by normative acts") --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing