Compliance with Law No. 195/2024, without needless red tape

Yes. The Law applies to any processing of personal data by automated means or in a filing system, with no threshold based on company size. That includes employee data. The measures required depend on the nature of the processing and the risks, and the obligation to keep a record of processing activities has a conditional exemption for enterprises and organisations with fewer than 250 employees. art. 2 art. 24 art. 30

No. Law No. 195/2024 provides for neither the registration of controllers nor prior notification of the Centre. Instead, the controller must be able to demonstrate that its processing complies with the Law. The Centre is consulted before processing only where a data protection impact assessment indicates a high risk in the absence of mitigating measures. The Law does, however, require the Centre to be notified of a personal data breach and to be given the contact details of the data protection officer, if one is designated. art. 5 art. 24 art. 33 art. 36 art. 37

Only in the cases set out in the Law: the processing is carried out by a public authority or institution, except for courts acting in the administration of justice; the core activities consist of regular and systematic monitoring of data subjects on a large scale; or the core activities consist of large-scale processing of special categories of data or of data relating to criminal convictions and offences. In other cases, designation is optional unless other normative acts require it. We will tell you during the assessment whether this applies to you. art. 37

The Essential package is delivered in about 10 working days and Extended in 20–30 working days, counted from when we receive your questionnaire answers. For a custom offer, the timeline is set after the analysis.

An AI model can be a starting point, but the Law does not ask for generic documents: they must describe exactly how your company processes data, that is, which data you collect, for which purposes and on which legal basis, who receives it, how long you keep it and which security measures you apply. The model does not know these facts and does not check them, it may cite Regulation (EU) 2016/679 instead of Law No. 195/2024 or articles that do not exist, and the company remains responsible for the documents. Do not enter data about employees or clients into a public AI service: its provider then receives that data, often outside the Republic of Moldova. We start from conversations with your team, check every document against the text of the Law and answer your questions after delivery. If you already have documents made with AI, we can review them as part of the assessment. art. 13 art. 24 art. 28 art. 44