# Compliance test Source: https://conformitate.md/en/tools/compliance-test Tools Check whether your company meets the basic obligations of Law No. 195/2024 and see where gaps may exist, starting with the obligations that carry the highest fines. 12 questions, one for each obligation checked 1. Do you keep a written record of processing activities, or have you checked that you are exempt? The exemption covers only organisations with fewer than 250 employees whose processing is occasional, poses no risk to people and includes no special categories of data or data on criminal convictions and offences. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") 2. Have you identified the legal basis for each purpose for which you process personal data? [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") 3. When you obtain people's data, from them or from other sources, do you tell them who you are, why and on what basis you process it, and what rights they have? [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") [art. 14](https://conformitate.md/en/law-195-2024/article-14 "Information to be provided where personal data have not been obtained from the data subject") 4. Where processing is based on consent, can you demonstrate that the person gave it (or do you not rely on consent at all)? [art. 7](https://conformitate.md/en/law-195-2024/article-7 "Conditions for consent") 5. Do you know whether you process special categories of data (such as health data or biometric data used for identification), and on what basis? [art. 9](https://conformitate.md/en/law-195-2024/article-9 "Processing of special categories of personal data") 6. Can you answer people's requests for access, rectification or erasure within one month of receipt or, within the same month, tell them why you need longer? [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 15](https://conformitate.md/en/law-195-2024/article-15 "Right of access by the data subject") [art. 16](https://conformitate.md/en/law-195-2024/article-16 "Right to rectification") [art. 17](https://conformitate.md/en/law-195-2024/article-17 "Right to erasure (‘right to be forgotten’)") 7. Have you checked whether any supplier processes data on your behalf (such as outsourced accounting, IT services or web hosting) and, if so, do you have a contract with each that meets art. 28? [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") 8. Have you taken technical and organisational security measures suited to the risk? [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 9. Are you ready to document any personal data breach, notify the National Centre for Personal Data Protection unless the breach is unlikely to result in a risk to people, and inform the people themselves when the risk is high? [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") [art. 34](https://conformitate.md/en/law-195-2024/article-34 "Communication of a personal data breach to the data subject") 10. Have you checked whether any processing is likely to result in a high risk to people and, if so, carried out a data protection impact assessment before starting it? [art. 35](https://conformitate.md/en/law-195-2024/article-35 "Data protection impact assessment") 11. Have you checked whether you must designate a data protection officer and, if so, have you designated one? [art. 37](https://conformitate.md/en/law-195-2024/article-37 "Designation of the data protection officer") 12. Do you know whether you transfer data to states outside the European Economic Area (for example through cloud services), and on what basis each transfer is made? [art. 44](https://conformitate.md/en/law-195-2024/article-44 "General principle for transfers") [art. 45](https://conformitate.md/en/law-195-2024/article-45 "Transfers on the basis of a decision on the adequacy of the level of protection") [art. 46](https://conformitate.md/en/law-195-2024/article-46 "Transfers on the basis of appropriate safeguards") [art. 47](https://conformitate.md/en/law-195-2024/article-47 "Binding corporate rules") [art. 49](https://conformitate.md/en/law-195-2024/article-49 "Derogations for specific situations") The test shows likely gaps; it does not replace a compliance assessment. Your answers are not sent anywhere: the result is calculated in your browser. --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing