# Transition from Law No. 133/2011

Source: https://conformitate.md/en/law-195-2024/transition-from-law-133-2011
Updated: 2026-10-17

Law 195/2024

Law No. 195/2024 applies from 23 August 2026 with no further adaptation period (art. 89), and Law No. 133/2011 is repealed on that date (art. 90). Registration as a controller with the Centre has ended: the controller keeps a record of processing activities instead (art. 30). Consent obtained earlier remains valid if the way it was given meets the conditions of the new Law (art. 90).

## Entry into force

Law No. 195/2024 enters into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova (Monitorul Oficial) [art. 89(1)](https://conformitate.md/en/law-195-2024/article-89#p1 "Final provisions"). The Law was published in Monitorul Oficial No. 367-369 of 23.08.2024, so the Law applies from 23 August 2026. By that date, the Government was to propose amendments to the legislation and amend its own normative acts [art. 89(2)](https://conformitate.md/en/law-195-2024/article-89#p2 "Final provisions"), and the National Centre for Personal Data Protection was to approve the acts needed to implement the Law [art. 89(3)](https://conformitate.md/en/law-195-2024/article-89#p3 "Final provisions").

## What changes compared with Law No. 133/2011

Law No. 133/2011 is repealed on the date the new Law enters into force [art. 90(3)(b)](https://conformitate.md/en/law-195-2024/article-90#p3-b "Transitional provisions"). The substantive change is that the controller no longer asks the Centre for anything before processing data; instead, it must be able to demonstrate at any time that the processing complies with the Law [art. 24(1)](https://conformitate.md/en/law-195-2024/article-24#p1 "Responsibility of the controller"). For a company this means:

-   notifying processing to the Centre and registering as a controller are gone; instead, the controller keeps its own record of processing activities [art. 30(1)](https://conformitate.md/en/law-195-2024/article-30#p1 "Records of processing activities");
-   a personal data breach is notified to the Centre without undue delay and, where feasible, within 72 hours [art. 33(1)](https://conformitate.md/en/law-195-2024/article-33#p1 "Notification of a personal data breach to the Centre");
-   processing likely to result in a high risk requires an impact assessment [art. 35(1)](https://conformitate.md/en/law-195-2024/article-35#p1 "Data protection impact assessment");
-   in certain cases a data protection officer must be designated [art. 37(1)](https://conformitate.md/en/law-195-2024/article-37#p1 "Designation of the data protection officer");
-   fines are imposed by the Centre: up to MDL 1,000,000 or 2,000,000 or, for an undertaking, up to 1% or 2% of total turnover, whichever is higher [art. 88(1)](https://conformitate.md/en/law-195-2024/article-88#p1 "Infringements punishable by a fine"), [art. 88(2)](https://conformitate.md/en/law-195-2024/article-88#p2 "Infringements punishable by a fine").

## Registration with the Centre has ended

Companies entered in the register of personal data controllers under Law No. 133/2011 do not need to register again or to notify the Centre in order to continue processing: Law No. 195/2024 provides for no such obligation, and the law that did is repealed [art. 90(3)(b)](https://conformitate.md/en/law-195-2024/article-90#p3-b "Transitional provisions"). The old registration does not, however, replace the documents the new Law requires. The record of processing activities is kept in writing, including in electronic form, and is made available to the Centre on request [art. 30(3)](https://conformitate.md/en/law-195-2024/article-30#p3 "Records of processing activities"), [art. 30(4)](https://conformitate.md/en/law-195-2024/article-30#p4 "Records of processing activities"). The exemption for enterprises with fewer than 250 employees is conditional [art. 30(5)](https://conformitate.md/en/law-195-2024/article-30#p5 "Records of processing activities"); we explain it under [controller and processor obligations](https://conformitate.md/en/law-195-2024/controller-and-processor-obligations). What the Centre does receive is the contact details of the data protection officer, where one is designated [art. 37(7)](https://conformitate.md/en/law-195-2024/article-37#p7 "Designation of the data protection officer").

## The deadline: 23 August 2026

The Law provides for no further adaptation period: its obligations apply from its entry into force [art. 89(1)](https://conformitate.md/en/law-195-2024/article-89#p1 "Final provisions"), and the transitional provisions phase in only the amount of fines [art. 90(4)](https://conformitate.md/en/law-195-2024/article-90#p4 "Transitional provisions"). A company that does not yet have a record of processing activities, information for data subjects or contracts with its processors is therefore already behind [art. 13(1)](https://conformitate.md/en/law-195-2024/article-13#p1 "Information to be provided where personal data are collected from the data subject"), [art. 28(3)](https://conformitate.md/en/law-195-2024/article-28#p3 "Processor").

## What is repealed

On the date of entry into force, Law No. 133/2011 on Personal Data Protection [art. 90(3)(b)](https://conformitate.md/en/law-195-2024/article-90#p3-b "Transitional provisions"), Law No. 182/2008 on the Regulation of the Centre [art. 90(3)(a)](https://conformitate.md/en/law-195-2024/article-90#p3-a "Transitional provisions") and art. 74¹–74³ and art. 423⁴ of the Contravention Code [art. 90(3)(c)](https://conformitate.md/en/law-195-2024/article-90#p3-c "Transitional provisions") are repealed.

Certain acts issued by the Centre under Law No. 133/2011, namely those adopted under art. 32(3) and (5)(f) and (i) of that Law, remain in force [art. 90(5)](https://conformitate.md/en/law-195-2024/article-90#p5 "Transitional provisions").

## Consent obtained earlier

Where processing was based on consent under Law No. 133/2011, the data subject does not need to give consent again, provided that the manner in which it was given complies with the conditions of the new Law. In that case the controller may continue the processing [art. 90(8)](https://conformitate.md/en/law-195-2024/article-90#p8 "Transitional provisions"). The new Law’s conditions for consent include the definition in [art. 4](https://conformitate.md/en/law-195-2024/article-4#term-12 "consent"), the conditions in [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") and, for children, those in [art. 8(1)](https://conformitate.md/en/law-195-2024/article-8#p1 "Consent of children in relation to information society services"). Consent that does not meet them does not benefit from this rule.

## Pending complaints and disputes

Complaints lodged with the Centre before the entry into force are examined under the procedural rules of the new Law, but under the substantive rules, including those on liability, of the law in force on the date the infringement was committed [art. 90(6)](https://conformitate.md/en/law-195-2024/article-90#p6 "Transitional provisions"). Civil cases and administrative litigation cases are examined under the law in force on the date the disputed legal relationship arose [art. 90(7)](https://conformitate.md/en/law-195-2024/article-90#p7 "Transitional provisions").

## Fines in the first years

From the entry into force, of the final amount of the fine set by the Centre, the following applies: from the first year – 10%, from the second year – 40%, from the third year – 100% [art. 90(4)](https://conformitate.md/en/law-195-2024/article-90#p4 "Transitional provisions"). The phasing in concerns only the amount of fines, not the obligations [art. 89(1)](https://conformitate.md/en/law-195-2024/article-89#p1 "Final provisions").

## Other provisions

The Law imposes no additional obligations on providers of publicly available electronic communications services in matters for which they already have specific obligations with the same objective under Electronic Communications Law No. 241/2007 [art. 89(4)](https://conformitate.md/en/law-195-2024/article-89#p4 "Final provisions"). The Centre’s management continues its term of office [art. 90(1)](https://conformitate.md/en/law-195-2024/article-90#p1 "Transitional provisions"), and its staff are assigned to the new positions [art. 90(2)](https://conformitate.md/en/law-195-2024/article-90#p2 "Transitional provisions").

Tools

-   [Check compliance in 12 questions →](https://conformitate.md/en/tools/compliance-test)
-   [Work out the cost of compliance →](https://conformitate.md/en/tools/price-calculator)

## How we can help with this

-   [GDPR Moldova compliance assessment →](https://conformitate.md/en/services/compliance-assessment)
    
    We assess online how your company processes personal data and give you a written report of what is missing under Law No. 195/2024, in order of priority.
    

## Articles in this topic

1.  [Article 89 Final provisions](https://conformitate.md/en/law-195-2024/article-89)
2.  [Article 90 Transitional provisions](https://conformitate.md/en/law-195-2024/article-90)

**The Romanian and Russian texts are those published in Monitorul Oficial. This English text is an unofficial translation by conformitate.md and has no legal force.**

Not an official publication. The Law was published in Monitorul Oficial No. 367-369/2024, art. 574.

Text verified on 15 October 2026 · [Romanian text on legis.md](https://www.legis.md/cautare/getResults?doc_id=144681&lang=ro)

FAQ

## What clients ask us

### From when does Law No. 195/2024 apply?

The Law enters into force on the expiry of 24 months from its publication in the Official Gazette, which took place on 23.08.2024. It therefore applies from 23 August 2026. [art. 89](https://conformitate.md/en/law-195-2024/article-89 "Final provisions")

### Do we have to ask data subjects for consent again?

No, if the manner in which consent was given under Law No. 133/2011 complies with the conditions of the new Law. In that case the controller may continue the processing after its entry into force. [art. 90](https://conformitate.md/en/law-195-2024/article-90 "Transitional provisions")

### Is Law No. 133/2011 still in force?

No. It is repealed on the date of entry into force of Law No. 195/2024. Certain acts issued by the Centre under it, however, remain in force. [art. 90](https://conformitate.md/en/law-195-2024/article-90 "Transitional provisions")

### Which law applies to a complaint lodged before the entry into force?

The complaint is examined under the procedural rules of the new Law, but under the substantive rules, including those on liability, of the law in force on the date the infringement was committed. [art. 90](https://conformitate.md/en/law-195-2024/article-90 "Transitional provisions")

### Do we have to register with the Centre or notify it as a controller?

No. Law No. 195/2024 provides for no registration of controllers or notification of processing, and Law No. 133/2011, which required them, has been repealed. Instead, the controller keeps a written record of processing activities and makes it available to the Centre on request. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") [art. 90](https://conformitate.md/en/law-195-2024/article-90 "Transitional provisions")

---

Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57  
Phone: +373 767 27 667 · Email: contact@conformitate.md  
Prices: https://conformitate.md/en/pricing