# Packages and prices Source: https://conformitate.md/en/pricing Packages Essential costs 5,900 MDL, Extended 19,900 MDL, and for complex cases we prepare a custom offer from 45,000 MDL. The price depends on what the company does with data, not on its headcount. ## Essential 5,900 MDL Module value: 18,500 MDL · you save 12,600 MDL Up to 3 processing activities · 2 privacy notices · 2 processor contracts For a small company with simple processing: a shop, an office, an accounting firm, a homeowners' association. - Data inventory and gap report - Records of processing activities, with the legal basis and retention period of each - Data protection policy and a description of the security measures - Privacy notices for each group of people: clients, employees, patients - Contracts with processors, new or reviewed - Internal rules for data subject requests and for personal data breaches - The confidentiality commitment and the written note for employees Online · delivered in 10 working days · 1 round of revisions · 14 calendar days of email questions [Choose Essential →](https://conformitate.md/en/pricing?pkg=essential#oferta) ## Extended Most popular 19,900 MDL Module value: 44,000 MDL · you save 24,100 MDL Up to 8 activities · 5 notices · 5 contracts · website, cameras, sensitive data For a small or medium company with varied processing: a clinic, an online shop, surveillance cameras, cloud services abroad. - Everything in Essential, with higher limits - Website privacy policy and cookie review - Video surveillance: notice, sign text, internal rules - Sensitive data in one activity (for example, medical records) - Transfers outside Moldova, one group of destinations - We check whether you need an impact assessment and a data protection officer Online · delivered in 20–30 working days · 2 rounds of revisions · 45 calendar days of email questions [Choose Extended →](https://conformitate.md/en/pricing?pkg=extended#oferta) ## Custom from 45,000 MDL No limits · analysis at your premises For clinic networks, banks and microfinance companies, groups of companies, public bodies, or companies that must appoint a data protection officer. - Everything in Extended, with no limits - Data protection impact assessments, as many as needed - Review of data flows and IT systems - Joint controller agreements, profiling, complex transfers Priced after analysis, at module prices [Request a quote →](https://conformitate.md/en/pricing?pkg=custom#oferta) Not sure which package fits? [Calculate the price →](https://conformitate.md/en/tools/price-calculator) [Request a free 15-minute consultation →](https://conformitate.md/en/pricing?pkg=consult#oferta) Documents are drafted in Romanian; an authorised translation into Russian or English is charged separately, at the translator's rate. ## Prices per module The prices of work beyond a package's limits. Each package's module value is calculated from them too. Work Price Legal basis Base work: interview, data inventory, gap report, data protection policy, procedures for requests and breaches, description of the security measures, the confidentiality commitment and the written note for employees 10,000 MDLonce [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 24](https://conformitate.md/en/law-195-2024/article-24 "Responsibility of the controller") [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") One processing activity: record, legal basis, retention period 1,500 MDLper activity [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") One privacy notice for a group of people 1,000 MDLper notice [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") [art. 14](https://conformitate.md/en/law-195-2024/article-14 "Information to be provided where personal data have not been obtained from the data subject") Reviewing an existing processor contract 500 MDLper contract [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") A new processor contract 1,000 MDLper contract [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") Sensitive data (health, biometric) in one activity 3,000 MDLper activity [art. 9](https://conformitate.md/en/law-195-2024/article-9 "Processing of special categories of personal data") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") Video surveillance 3,000 MDLonce [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") Presentation website: privacy policy, cookies, forms 3,000 MDLonce [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") Online shop, instead of a presentation website: orders and customer accounts as well 5,000 MDLonce [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") Transfers outside Moldova, one group of destinations 2,000 MDLper group [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") [art. 46](https://conformitate.md/en/law-195-2024/article-46 "Transfers on the basis of appropriate safeguards") Checking whether an impact assessment is required 1,000 MDLonce [art. 35](https://conformitate.md/en/law-195-2024/article-35 "Data protection impact assessment") Data protection impact assessment (one assessment)The price depends on complexity and is set after the check; it is not added to the package price. 8,000–16,000 MDL [art. 35](https://conformitate.md/en/law-195-2024/article-35 "Data protection impact assessment") [art. 36](https://conformitate.md/en/law-195-2024/article-36 "Prior consultation") ## Separate services You can order them at any time, apart from the packages. - Compliance assessment Interviews and a written report of what is missing under Law No. 195/2024, in order of priority, without drafting the documents. The price is not deducted from the price of a package. from 3,900 MDL [Request an offer →](https://conformitate.md/en/pricing?pkg=assessment#oferta) - Employee briefing and advice A session for the company's employees, built on its own documents, with an attendance list. 4,000 MDL / session, up to 20 people [Request an offer →](https://conformitate.md/en/pricing?pkg=briefing#oferta) - External data protection officer We carry out the tasks the law gives the data protection officer, under a contract. from 3,600 MDL / month [Request an offer →](https://conformitate.md/en/pricing?pkg=dpo#oferta) - Breach support Risk assessment, notification to the Centre and informing the people concerned, where the law requires it. 1,000 MDL / hour [Request an offer →](https://conformitate.md/en/pricing?pkg=incident#oferta) - Annual support Updating the documents when the law or your activity changes, and email questions, up to about 20 hours a year. 9,900 MDL / year [Request an offer →](https://conformitate.md/en/pricing?pkg=support#oferta) - Office visit (Chișinău) Analysis at your premises for the Essential and Extended packages, or the employee briefing session held at your office. 4,000 MDL - Authorised translations The documents in Russian or English, through an authorised translator. At the translator's rate ## Good to know - Documents are drafted in Romanian; an authorised translation into Russian or English is charged separately, at the translator's rate. - Existing documents drafted under Law No. 133/2011 do not lower the price: we verify everything again. - Technical IT work (configuring systems or the cookie banner) and representation before the Centre or in court are not included. ## How we work - We sign a contract and issue an invoice. - Work starts once the contract is signed. - On request, we sign a confidentiality agreement (NDA). - We deliver the documents by email, signed if you ask. FAQ ## What clients ask us ### What does “module value” mean? It is the price of the same work counted per module, at the prices in the table on this page. A package costs less because standard work takes less time. Module prices are real: work beyond a package's limits is charged at them. ### Can I add modules to a package? Yes. If you have, for example, a website or one activity more than the Essential package allows, you pay for the package and those modules. The price calculator picks the cheaper option for you. ### Why doesn't the price depend on the number of employees? Because the lawyer's work depends on what the company does with data. The law requires records of processing, a notice for each group of people and a contract with each processor. The record-keeping exemption for companies with fewer than 250 employees does not apply when processing is not occasional, as payroll is. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") ### Is the employee briefing included? No. Employee briefing and advice is a separate service, 4,000 MDL per session for up to 20 people. Every package includes a written note for employees and the confidentiality commitment. [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") ### In which language do we receive the documents? In Romanian. Documents are drafted in Romanian; an authorised translation into Russian or English is charged separately, at the translator's rate. ### Can I order only the assessment? Yes. The assessment on its own costs from 3,900 MDL: interviews and a written report of what is missing under Law No. 195/2024, in order of priority, without drafting the documents. Every package starts with an assessment included in its price anyway, because the controller's measures must take into account the nature, scope, context and purposes of processing; that is why the price of a separate assessment is not deducted from a package ordered later. [art. 24](https://conformitate.md/en/law-195-2024/article-24 "Responsibility of the controller") ### Why now, if fines are phased in? The reduction applies only to the amount of the fine: of the fine set by the Centre, 10% applies in the first year after the Law enters into force, 40% in the second and 100% from the third. The Centre's other corrective powers are not reduced, such as an order to bring processing into compliance or a temporary or definitive limitation of processing. Nor are data subjects' rights to lodge a complaint with the Centre and to receive compensation for the damage suffered. [art. 60](https://conformitate.md/en/law-195-2024/article-60 "Powers of the Centre") [art. 72](https://conformitate.md/en/law-195-2024/article-72 "Right to lodge a complaint with the Centre") [art. 76](https://conformitate.md/en/law-195-2024/article-76 "Right to compensation and liability") [art. 90](https://conformitate.md/en/law-195-2024/article-90 "Transitional provisions") ### We have documents drafted under Law No. 133/2011. Why does it not cost less? Because Law No. 133/2011 was repealed when Law No. 195/2024 entered into force, and the documents have to be checked again against the new Law: the references to the law, the legal bases, the retention periods, the contracts with processors. What still fits is kept, but checking it takes the same work. [art. 90](https://conformitate.md/en/law-195-2024/article-90 "Transitional provisions") ### We have already implemented the GDPR for EU clients. Do we need anything else? Law No. 195/2024 transposes Regulation (EU) 2016/679, so much of the work carries over, but the Law has rules of its own. The supervisory authority is the National Centre for Personal Data Protection. Transfers from Moldova to countries outside the European Economic Area follow the conditions of the Moldovan Law. Processing the IDNP on the basis of legitimate interest requires specific safeguards, and fines are set under the Moldovan Law. The documents must refer to Law No. 195/2024. [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") [art. 53](https://conformitate.md/en/law-195-2024/article-53 "Processing of a national identification number") [art. 55](https://conformitate.md/en/law-195-2024/article-55 "Status of the Centre") [art. 88](https://conformitate.md/en/law-195-2024/article-88 "Infringements punishable by a fine") ### Can I produce the documents with an AI model instead of hiring you? An AI model can be a starting point, but the Law does not ask for generic documents: they must describe exactly how your company processes data, that is, which data you collect, for which purposes and on which legal basis, who receives it, how long you keep it and which security measures you apply. The model does not know these facts and does not check them, it may cite Regulation (EU) 2016/679 instead of Law No. 195/2024 or articles that do not exist, and the company remains responsible for the documents. Do not enter data about employees or clients into a public AI service: its provider then receives that data, often outside the Republic of Moldova. We start from conversations with your team, check every document against the text of the Law and answer your questions after delivery. If you already have documents made with AI, we can review them as part of the assessment. [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") [art. 24](https://conformitate.md/en/law-195-2024/article-24 "Responsibility of the controller") [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing