Processes personal data, in Albania

Law No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data, Arts. 1-8, 11, 22-38, 43-46 (general provisions, lawful basis, consent, controller and processor obligations, and specific-purpose exceptions), in force 31 January 2025 · Read the law's page

• Establish one of the lawful bases Article 7 lists, such as the data subject's consent, contractual necessity, a legal obligation, vital interests, a public task, or a legitimate interest that does not override the data subject's rights, before processing personal data of a person in Albania.
• Demonstrate that consent was given, present a request for consent separately from other matters in clear and plain language, and let the data subject withdraw consent at any time as easily as it was given.
• Implement data protection by design and by default in every processing tool and process, and appoint a data protection officer where processing is carried out by a public authority, requires regular and systematic large scale monitoring of data subjects, or involves large scale processing of sensitive data or criminal records.
• Appoint a representative located in Albania and notify the Commissioner in writing of that representative's identity when you target people in Albania from outside the country, unless the processing is occasional, small scale, and unlikely to risk fundamental rights, or you are a public authority.
• Maintain written and electronic records of processing activities naming the controller, the purposes, the categories of data and recipients, any transfer outside Albania, and the envisaged erasure periods, and make the records available to the Commissioner on request.
• Implement technical and organizational security measures appropriate to the risk, including pseudonymization and encryption, the ability to restore access after an incident, and a process for regularly testing their effectiveness.
• Keep personal data confidential wherever an employee or processor has access to it for professional reasons, bind that confidentiality into every processor contract and employment contract, and continue it after the contract or employment ends.
• From two years after the law's publication in the Official Gazette, carry out a data protection impact assessment before processing likely to result in a high risk to the rights and freedoms of a person in Albania, and seek the Commissioner's opinion in advance where the risk cannot be mitigated; until then, Articles 31 and 32 do not themselves bind.
• Where personal data are prepared for journalistic, academic, literary or artistic publication, use them for no other purpose and do not identify a minor or a crime victim in the published material without the guardian's consent or a court's permission.

Law No. 124/2024, Art. 29 (notification of a personal data breach) · Read the law's page

• Notify the Commissioner of a personal data breach as soon as possible and no later than 72 hours of becoming aware of the breach, unless the breach is unlikely to endanger the rights and freedoms of data subjects, and give the Commissioner your reasons for any later notification.
• As a processor, notify the controller immediately after becoming aware of any personal data breach.
• Describe in the notification to the Commissioner the nature of the breach, including where possible the categories and approximate number of data subjects and personal data records concerned, the data protection officer's or other contact point's details, the likely consequences, and the measures taken or proposed, supplying anything you cannot give at once as soon as possible afterward.
• Document every personal data breach, its facts, its effects, and the corrective measures taken, so the Commissioner can verify compliance.
• From two years after the law's publication in the Official Gazette, inform the data subject of a personal data breach likely to result in a high risk to their rights and freedoms, unless an exception for encryption, other risk reducing measures, or a disproportionate-effort public notice applies; until then this Article 29(3) duty does not itself bind, though the Commissioner may already order you to notify the data subject case by case under Article 29(7).

Law No. 124/2024, Arts. 12-19, 21 (rights of the data subject) · Read the law's page

• Tell a data subject, in concise and plain language and with particular care where the information is addressed to a minor, your identity and contact details, the purposes and legal basis of processing, the recipients, any transfer abroad, the retention period, and the rights available to them.
• Answer a data subject's request under Articles 13 to 20 as soon as possible and no later than 30 days after receiving it, extendable to 60 days for complex or numerous requests, and free of charge unless the request is manifestly unfounded or excessive.
• Give a data subject access to their personal data, its purpose, retention period, source, and recipients within 30 days of the request, and correct or erase inaccurate, unlawfully processed, or no longer necessary personal data within 30 days, telling every recipient the data were disclosed to of the change.
• Provide a data subject their personal data in a structured, commonly used, machine readable format on request, and transmit it directly to another controller where technically feasible.
• Stop processing a data subject's personal data for direct marketing, including related profiling, as soon as they object, without requiring a reason, and tell them of this right explicitly and separately at the first communication.

Law No. 124/2024, Arts. 39-42 (international data transfer) · Read the law's page

• Transfer personal data outside Albania only where the destination country, territory, sector or international organization has been found by the Commissioner to ensure an adequate level of protection, or where you provide an appropriate safeguard such as binding company rules, standard contractual clauses, or a Commissioner approved code of conduct or certification mechanism.
• Absent an adequacy decision or safeguard, transfer personal data abroad only on a listed condition such as the data subject's informed and explicit consent to the transfer after being told its risks, contractual necessity, or an important public interest, and never repetitively or beyond a limited number of data subjects when relying on the legitimate-interests fallback.
• Recognize or enforce a foreign court or administrative decision compelling you to transfer or disclose personal data only where it rests on an international agreement, such as a mutual legal assistance treaty in force with Albania.
• Where the Commissioner approves binding rules for a group of companies, confer enforceable rights on data subjects, apply the general processing principles internally, and accept liability in Albania for another group member's breach of the rules abroad.

Law No. 124/2024, Arts. 75-95 (Commissioner, remedies, liability and penalties) · Read the law's page

• Expect the Commissioner for the Right to Information and Personal Data Protection, an independent public legal person, to monitor and supervise compliance with this law and to investigate on its own initiative or on a complaint.
• Expect a data subject to be able to lodge a complaint with the Commissioner free of charge, and separately to bring a civil claim for compensation for any financial or non-financial damage caused by an infringement of this law.
• Comply with a Commissioner order such as a warning, a notice, a processing restriction, a rectification or erasure order, or a suspension of a data transfer, and expect an administrative fine reaching 2,000,000,000 Albanian Lek or 4% of worldwide annual turnover, whichever is higher, for the most serious violations, or 1,000,000,000 Lek or 2% for the minors' online consent rule, the non-identification rule, and most of the controller and processor obligations chapter other than Article 22 itself.
• Expect a Commissioner decision or fine to be appealable to the competent administrative court, and expect the Commissioner to bear the burden of proving a complaint unfounded or excessive rather than you.

Law No. 124/2024, Arts. 8(6), 9, 10 (special categories, criminal records and children's data) · Read the law's page

• Do not process sensitive data, meaning racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership, genetic data, biometric data, health records, or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent to a specified purpose.
• Treat a facial image or other biometric identifier as sensitive data requiring one of Article 9's listed exceptions before you may process it; the definition names a facial image as an example, so a derived faceprint is covered and the definition is not confined to a raw recording.
• Do not process sensitive data about race or ethnic origin unless the processing ensures justice and equality on that ground and carries appropriate safeguards, and put appropriate technical and security safeguards in place before relying on any Article 9 exception.
• Process the personal data of a minor for the online delivery of goods or services only where the minor is at least 16, and where the minor is younger, obtain consent given or authorized by a parent or legal custodian.
• Process criminal records only under the control of the competent authority or where a law specifically authorizes it, with adequate protection for the rights and freedoms of the data subject.