AlbaniaLaw No. 25/2024, On Cybersecurity
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance, Reporting
What it requires
- This binds a subject named in Annexes I or II of the law as administering a critical or important information infrastructure; the National Authority for Cybersecurity's own presentation of those Annexes lists digital service providers among the sectors reached, alongside energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, business to business ICT service management, public administration, space, education, tourism, postal and courier services, waste management, chemicals, food and manufacturing; the digital service provider class is reached as such, and the other named sectors are reached too, by declaring that you are an essential or important entity.
- Register your critical or important information infrastructure with the National Authority for Cybersecurity (AKSK), establish a Computer Security Incident Response Team and a single point of contact for AKSK and other computer security incident response teams (CSIRTs), and implement the technical, organisational and operational risk management measures a Council of Ministers methodology sets for your designated category.NIST CSF 2.0GV.OC-03NIST CSF 2.0GV.RR-02
- Report a significant or substantial cybersecurity incident to AKSK and the relevant CSIRTs, and inform the public or affected users where the incident reaches them; cooperate with AKSK and other operators in sharing cybersecurity threat, vulnerability and incident information. AKSK's own incident categorisation and log retention regulations set the reporting clock and severity thresholds that apply to your designated category.NIST CSF 2.0RS.CO-02NIST CSF 2.0RS.CO-03
- Where your organisation processes personal data in the course of these duties, do so under Albania's personal data protection legislation; this law's security measures duty is separate from, and does not substitute for, a breach notification duty to Albania's data protection authority under Law No. 124/2024.NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- RS.CO-02Internal and external stakeholders are notified of incidents
- RS.CO-03Information is shared with designated internal and external stakeholders
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
PwC's client alert reports that the law provides criminal sanctions for acts that endanger the security of networks and information systems, such as unauthorized access, interception, interference, damage or destruction; those are offences committed against a system by an intruder rather than a compliance failure by the bound operator, so this instrument carries no criminal exposure and the intrusion offences stay with this jurisdiction's scraping topic.
Penalty structure
PwC's client alert reports this range for a violation of the law generally, varying by the type and severity of the violation, without naming the enabling article; the penalty chapter's own text was not confirmed to verify the figure or to disaggregate it by violation type.
- Rule
- Fixed only
- As of
- Minimum
- 200,000
- Currency
- ALL
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
The National Authority for Cybersecurity (Autoriteti Kombëtar për Sigurinë Kibernetike, AKSK), a public legal entity under the Prime Minister that serves as the main regulator and supervisor of cybersecurity, the national single point of contact, and the National CSIRT and CERT.
Settledness
- As of
- Open questions
- Given the primary Fletorja Zyrtare text available here stops at Article 5 and the Annexes I and II were not confirmed against the statute's own text, do the law's own Chapter II through V articles confirm the Authority's presentation-slide account of the sector list, the operator duties, and the numeric clock for reporting an incident to the Authority and the sectoral CSIRTs?
- Given PwC's client alert states the 200,000 to 10,000,000 Albanian Lek administrative fine range without naming the enabling article, does the law's own penalty chapter confirm that range and tie it to specific violation classes rather than a single undifferentiated band?
What this law does
Law No. 25/2024 sets the rights and duties of public and private subjects that administer information infrastructure, communication networks and their systems whose compromise would affect the health, safety or economic wellbeing of the public or the effective functioning of the economy.
The law also names the National Authority for Cybersecurity as the single point of contact for cybersecurity matters, establishes the National computer security incident response team (CSIRT), CERT and sectoral CSIRTs, and requires a subject named in Annexes I or II to comply with mandatory cybersecurity risk management measures and to report cybersecurity incidents.
Per PwC's published account of the law, a bound operator must register its critical or important information infrastructure with the Authority, establish its own Computer Security Incident Response Team, implement the technical, organisational and operational risk management measures the Council of Ministers sets, report a significant or substantial incident to the Authority and the relevant CSIRTs, inform affected users, and cooperate with the Authority and other operators on sharing threat and incident information.
The National Authority for Cybersecurity's own presentation of the law's Annexes lists digital service providers among the sectors it reaches, alongside energy, transport, banking, financial market infrastructure, health, water supply, digital infrastructure, public administration and several other named sectors. PwC's client alert reports an administrative fine of 200,000 to 10,000,000 Albanian Lek for a violation of the law, varying with the type and severity of the violation.
The law entered into force on , fifteen days after its publication, and PwC reports a 24 month period from that date for operators to bring their practices into compliance. The measures, reporting and penalty articles themselves are not confirmed against the primary Fletorja Zyrtare text here, whose paginated viewer rendered only the law's opening chapter, so this instrument's operative content beyond Article 1 rests on the Authority's own presentation and on PwC's client alert.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.
Back to the example · Lint your app
Page updated .