# Personal data breach: what to do

Source: https://conformitate.md/en/situations/data-breach
Updated: 2026-10-17

Situation

A laptop holding customer data has been stolen, a file with employee data has gone to the wrong recipient, or someone has accessed one of the company's systems without authorisation: a personal data breach has occurred.

Dealing with a breach right now? Call: [+373 767 27 667](tel:+37376727667)

Monday to Friday, 9:00–18:00.

Outside these hours, write to [contact@conformitate.md](mailto:contact@conformitate.md) and we reply on the morning of the next working day.

The 72 hours for notifying the Centre also run over weekends and public holidays. [art. 33(1)](https://conformitate.md/en/law-195-2024/article-33#p1 "Notification of a personal data breach to the Centre")

## What the Law requires

1.  Notifying the Centre on time. The controller notifies the National Centre for Personal Data Protection without undue delay and, where possible, not later than 72 hours from the date on which it became aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. A notification made after 72 hours is accompanied by a reasoned explanation of the delay. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre")
2.  The minimum content of the notification. The notification describes the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned, gives the contact details of the data protection officer or another contact point, and describes the likely consequences of the breach and the measures taken or proposed to address it. Where not all of the information can be provided at the same time, it may be provided in phases without undue delay. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre")
3.  Informing the data subjects when the risk is high. If the breach is likely to result in a high risk to their rights and freedoms, the data subjects are informed without undue delay. This is not required in the cases set out in the law, for example where the affected data were protected by measures that render them unintelligible to unauthorised persons, such as encryption. [art. 34](https://conformitate.md/en/law-195-2024/article-34 "Communication of a personal data breach to the data subject")
4.  Documenting every case. The controller keeps documents on every personal data breach, including those it does not notify, describing the facts, the effects and the remedial action taken, so that the Centre can verify compliance with these obligations. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre")
5.  Notice from the processor. If the breach occurs at a processor, such as your IT provider or accounting firm, the processor notifies you without undue delay after becoming aware of it. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre")

Industries concerned

[Medical & dental clinics](https://conformitate.md/en/industries/medical-clinics) [Online stores](https://conformitate.md/en/industries/online-stores) [Homeowners associations](https://conformitate.md/en/industries/homeowners-associations) [Accounting firms](https://conformitate.md/en/industries/accounting-firms)

What the Law says

[Security of processing](https://conformitate.md/en/law-195-2024/security-and-breaches)

## How we can help

We assess the risk, establish whether the Centre must be notified and whether the data subjects must be informed, prepare the notification and document the case, including where no notification is required.

1,000 MDL / hour

[Ask for help →](https://conformitate.md/en/situations/data-breach?pkg=incident#oferta) [About our breach response support →](https://conformitate.md/en/services/breach-response-support)

---

Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57  
Phone: +373 767 27 667 · Email: contact@conformitate.md  
Prices: https://conformitate.md/en/pricing