Services
Breach response support
In the case of a personal data breach, the controller notifies the National Centre for Personal Data Protection without undue delay and, where possible, not later than 72 hours, unless the breach is unlikely to result in a risk (art. 33(1)). Where the risk is high, it informs the data subjects (art. 34(1)).
Dealing with a breach right now? Call: +373 767 27 667
Monday to Friday, 9:00–18:00.
Outside these hours, write to contact@conformitate.md and we reply on the morning of the next working day.
The 72 hours for notifying the Centre also run over weekends and public holidays. art. 33(1)
What the Law provides
What we deliver
- ✓Assessment of the risk to the rights and freedoms of natural persons
- ✓Notification to the Centre, where required
- ✓Communication to data subjects, where the risk is high
- ✓Documentation of the breach, its effects and the remedial action taken
For whom
Controllers that have discovered a personal data breach, and processors, which must notify the controller without undue delay.
What you get
The risk assessed, the Centre notified and the data subjects informed where the Law requires it, and the case documented so that the Centre can verify compliance with art. 33. The time limit of no more than 72 hours, which applies where feasible, runs from when the controller became aware of the breach, and a notification made after 72 hours is accompanied by the reasons for the delay.
Timeframe
Monday to Friday, 9:00–18:00, you can call us; outside these hours, email us and we reply on the morning of the next working day. The work is charged by the hour, for as long as the case requires.
What you give us
- What happened and when you became aware of the breach
- Which data and how many people are affected, as far as you know
- The measures already taken to stop the breach or limit its effects
- Contact details of the IT supplier or processor involved
How we work
- We sign a contract and issue an invoice.
- Work starts once the contract is signed.
- On request, we sign a confidentiality agreement (NDA).
- We deliver the documents by email, signed if you ask.
FAQ
Questions about this service
Does the 72-hour time limit run over the weekend?
Yes. It is counted in hours from when the controller became aware of the breach, not in working days, so it includes weekends and public holidays. A notification made after 72 hours is accompanied by the reasons for the delay. art. 33
What if we do not have all the information yet?
Notify within the time limit anyway. Where, and in so far as, it is not possible to provide the information at the same time, it may be provided in phases without undue further delay. art. 33
Does every incident have to be notified to the Centre?
No. Notification is not required where the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Every breach must still be documented, including those you do not notify. art. 33
Will notifying the breach get us fined?
Notification is an obligation, not an admission of fault. When deciding whether to impose a fine and on its amount, the Centre takes into account, among other things, the action taken to mitigate the damage, the degree of cooperation with the Centre and the manner in which it learned of the breach, in particular whether the controller notified it. art. 87
Free consultation
Not sure where to start?
Request a free 15-minute consultation. We will tell you which obligations under Law No. 195/2024 apply to you and which steps are needed.