Services
Compliance documentation
Compliance documentation brings together, as applicable, the documents through which your company applies Law No. 195/2024: the record of processing activities (art. 30), the information for data subjects (art. 13 and 14), data protection policies (art. 24), contracts with processors (art. 28), the security measures (art. 32) and the rules for those who work with the data only on the controller's instructions (art. 29). We prepare them on the basis of what your company actually does.
What the Law provides
- Article 12Transparency of information, communications and modalities for the exercise of the rights of the data subjectart. 12
- Article 13Information to be provided where personal data are collected from the data subjectart. 13
- Article 14Information to be provided where personal data have not been obtained from the data subjectart. 14
- Article 24Responsibility of the controllerart. 24
- Article 28Processorart. 28
- Article 29Carrying out processing activities under the authority of the controller or the processorart. 29
- Article 30Records of processing activitiesart. 30
- Article 32Security of processingart. 32
- Article 33Notification of a personal data breach to the Centreart. 33
What we deliver
- ✓Data inventory and gap report
- ✓Records of processing activities, with the legal basis and retention period of each
- ✓Data protection policy and a description of the security measures
- ✓Privacy notices for each group of people: clients, employees, patients
- ✓Contracts with processors, new or reviewed
- ✓Internal rules for data subject requests and for personal data breaches
- ✓The confidentiality commitment and the written note for employees
For whom
Companies that want a complete compliance file they can make available to the National Centre for Personal Data Protection on request.
What you get
The documents of the chosen package, tailored to your company's activity and ready to sign and put into practice. The website, video surveillance, sensitive data and transfers outside Moldova are added as extra work or included in the Extended package.
Timeframe
Essential: 10 working days; Extended: 20–30 working days, counted from receipt of the company's information. For a custom offer, the timeframe is set after the analysis.
What you give us
- Answers to the questionnaire and the interview about the data processed, its purposes and the people concerned
- The list of suppliers with access to the data and the existing contracts with them
- Existing data protection documents
- Comments on the draft documents, in the rounds of revisions
How we work
- We sign a contract and issue an invoice.
- Work starts once the contract is signed.
- On request, we sign a confidentiality agreement (NDA).
- We deliver the documents by email, signed if you ask.
FAQ
Questions about this service
Is it enough to have the documents?
No. The Law requires measures that are applied, not just written down: the controller implements appropriate technical and organisational measures and must be able to demonstrate that processing complies with the Law. The documents describe what the company does; applying them is up to the company. art. 5 art. 24
Do we have to file the documents with the Centre?
No. Law No. 195/2024 provides for no registration of controllers and no filing of documents. The records of processing activities are made available to the Centre on request, and the controller cooperates with the Centre on request. art. 30 art. 31
What happens when the company's activity changes?
The measures are reviewed and updated where necessary, and the record must reflect the actual processing activities. After delivery, you can order annual support, which includes updating the documents when the law or your activity changes. art. 24 art. 30
Free consultation
Not sure where to start?
Request a free 15-minute consultation. We will tell you which obligations under Law No. 195/2024 apply to you and which steps are needed.