Transition from Law No. 133/2011

Entry into force

Law No. 195/2024 enters into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova (Monitorul Oficial) art. 89(1). The Law was published in Monitorul Oficial No. 367-369 of 23.08.2024, so the Law applies from 23 August 2026. By that date, the Government was to propose amendments to the legislation and amend its own normative acts art. 89(2), and the National Centre for Personal Data Protection was to approve the acts needed to implement the Law art. 89(3).

What changes compared with Law No. 133/2011

Law No. 133/2011 is repealed on the date the new Law enters into force art. 90(3)(b). The substantive change is that the controller no longer asks the Centre for anything before processing data; instead, it must be able to demonstrate at any time that the processing complies with the Law art. 24(1). For a company this means:

• notifying processing to the Centre and registering as a controller are gone; instead, the controller keeps its own record of processing activities art. 30(1);
• a personal data breach is notified to the Centre without undue delay and, where feasible, within 72 hours art. 33(1);
• processing likely to result in a high risk requires an impact assessment art. 35(1);
• in certain cases a data protection officer must be designated art. 37(1);
• fines are imposed by the Centre: up to MDL 1,000,000 or 2,000,000 or, for an undertaking, up to 1% or 2% of total turnover, whichever is higher art. 88(1), art. 88(2).

Registration with the Centre has ended

Companies entered in the register of personal data controllers under Law No. 133/2011 do not need to register again or to notify the Centre in order to continue processing: Law No. 195/2024 provides for no such obligation, and the law that did is repealed art. 90(3)(b). The old registration does not, however, replace the documents the new Law requires. The record of processing activities is kept in writing, including in electronic form, and is made available to the Centre on request art. 30(3), art. 30(4). The exemption for enterprises with fewer than 250 employees is conditional art. 30(5); we explain it under controller and processor obligations. What the Centre does receive is the contact details of the data protection officer, where one is designated art. 37(7).

The deadline: 23 August 2026

The Law provides for no further adaptation period: its obligations apply from its entry into force art. 89(1), and the transitional provisions phase in only the amount of fines art. 90(4). A company that does not yet have a record of processing activities, information for data subjects or contracts with its processors is therefore already behind art. 13(1), art. 28(3).

What is repealed

On the date of entry into force, Law No. 133/2011 on Personal Data Protection art. 90(3)(b), Law No. 182/2008 on the Regulation of the Centre art. 90(3)(a) and art. 74¹–74³ and art. 423⁴ of the Contravention Code art. 90(3)(c) are repealed.

Certain acts issued by the Centre under Law No. 133/2011, namely those adopted under art. 32(3) and (5)(f) and (i) of that Law, remain in force art. 90(5).

Consent obtained earlier

Where processing was based on consent under Law No. 133/2011, the data subject does not need to give consent again, provided that the manner in which it was given complies with the conditions of the new Law. In that case the controller may continue the processing art. 90(8). The new Law’s conditions for consent include the definition in art. 4, the conditions in art. 7 and, for children, those in art. 8(1). Consent that does not meet them does not benefit from this rule.

Pending complaints and disputes

Complaints lodged with the Centre before the entry into force are examined under the procedural rules of the new Law, but under the substantive rules, including those on liability, of the law in force on the date the infringement was committed art. 90(6). Civil cases and administrative litigation cases are examined under the law in force on the date the disputed legal relationship arose art. 90(7).

Fines in the first years

From the entry into force, of the final amount of the fine set by the Centre, the following applies: from the first year – 10%, from the second year – 40%, from the third year – 100% art. 90(4). The phasing in concerns only the amount of fines, not the obligations art. 89(1).

Other provisions

The Law imposes no additional obligations on providers of publicly available electronic communications services in matters for which they already have specific obligations with the same objective under Electronic Communications Law No. 241/2007 art. 89(4). The Centre’s management continues its term of office art. 90(1), and its staff are assigned to the new positions art. 90(2).