Processes personal data, in Moldova

Legea Nr. 195 din 25 iulie 2024, articolele 1-7, 11 si 24-43 (principii, temeiuri legale si obligatiile operatorului) · Read the law's page

• Establish a lawful basis and allocate controller and processor duties before processing personal data of a person in Moldova.
• Take consent only on the conditions article 7 sets, and be able to demonstrate the data subject gave it.
• Build data protection into the design of your processing and make it the default, and keep records of your processing activities.
• Implement technical and organisational measures giving a level of security appropriate to the risk.
• Carry out a data protection impact assessment before processing likely to result in a high risk, and consult the National Centre for Personal Data Protection beforehand where that risk remains.
• Designate a data protection officer where the law requires one, give them the position article 38 prescribes, and let them carry out the tasks article 39 lists.
• Where you engage a processor, govern the engagement as article 28 requires, and settle each party's responsibilities in an arrangement where you are a joint controller.

Legea Nr. 195 din 25 iulie 2024, articolele 12-21, 23 (drepturile subiectului de date) · Read the law's page

• Give a data subject, at collection, your identity and contact details, the purposes and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, and where the data came from elsewhere, its source and the categories concerned.
• Answer a request for access, rectification, erasure, restriction or portability, and notify every recipient the data was disclosed to of a rectification, erasure or restriction you carry out.
• Stop processing personal data for direct marketing as soon as the data subject objects, including the profiling related to it.

Legea Nr. 195 din 25 iulie 2024, articolele 33-34 (notificarea incalcarii securitatii datelor) · Read the law's page

• Notify the National Centre for Personal Data Protection without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Moldova, unless the breach is unlikely to risk their rights and freedoms.
• Communicate the breach to the affected data subject without undue delay where it is likely to result in a high risk to their rights and freedoms, in clear and plain language.
• As a processor, notify the controller without undue delay after becoming aware of a personal data breach.
• Put in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of records concerned, the contact point, the likely consequences and the measures taken to address it and mitigate its effects.

Legea Nr. 195 din 25 iulie 2024, articolele 44-50 (transferuri catre tari terte) · Read the law's page

• Rely on the National Centre for Personal Data Protection's adequacy list or an approved standard transfer agreement before transferring personal data of a person in Moldova outside the country.
• Apply the same conditions to an onward transfer from the destination country or organisation to another one, not only to the first transfer out.
• Where you rely on a derogation in article 49 instead, use one the article lists, and where that is the data subject's explicit consent, inform them of the possible risks of the transfer first.

Legea Nr. 195 din 25 iulie 2024, articolele 55-86 (Centrul National, plangeri, despagubiri si sanctiuni) · Read the law's page

• Expect a person in Moldova to have a court-enforceable damages claim for material or non-material harm from an infringement of this law, separate from a complaint to the National Centre.
• Expect a data subject to be able to lodge a complaint with the National Centre for Personal Data Protection about your processing, and to challenge the Centre's own action or inaction.
• Answer the Centre's examination procedure once it is opened against you, and expect the sanctions the law provides at the end of it.

Legea Nr. 195 din 25 iulie 2024, articolele 8-10 (categorii speciale de date si consimtamantul copilului) · Read the law's page

• Obtain explicit consent or another enumerated exception before processing biometric data, including facial images, of a person in Moldova for unique identification.
• Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data or data concerning health, sex life or sexual orientation, unless one of the article 9(2) cases applies.
• Where you offer an information society service directly to a child, make reasonable efforts to verify that the holder of parental responsibility gave or authorised the consent, taking available technology into account.
• Process personal data relating to criminal convictions and offences only as article 10 permits.