AlbaniaLaw No. 124/2024, international data transfer
Law No. 124/2024, Arts. 39-42 (international data transfer)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- continuous
- Who audits it
- Self
What it requires
- Transfer personal data outside Albania only where the destination country, territory, sector or international organization has been found by the Commissioner to ensure an adequate level of protection, or where you provide an appropriate safeguard such as binding company rules, standard contractual clauses, or a Commissioner approved code of conduct or certification mechanism.
- Absent an adequacy decision or safeguard, transfer personal data abroad only on a listed condition such as the data subject's informed and explicit consent to the transfer after being told its risks, contractual necessity, or an important public interest, and never repetitively or beyond a limited number of data subjects when relying on the legitimate-interests fallback.
- Recognize or enforce a foreign court or administrative decision compelling you to transfer or disclose personal data only where it rests on an international agreement, such as a mutual legal assistance treaty in force with Albania.
- Where the Commissioner approves binding rules for a group of companies, confer enforceable rights on data subjects, apply the general processing principles internally, and accept liability in Albania for another group member's breach of the rules abroad.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Only the group route is concerned: where a group of companies relies on binding company rules approved by the Commissioner for its transfers, Article 42(2)(e) requires those rules to specify the mechanisms the group uses to perform audits and to report and record breaches and rectifying actions, and the next point requires mechanisms for reporting and recording changes to the rules and reporting them to the Commissioner. What the records must hold is not stated, so the content list is empty. No audit cadence is stated. The adequacy, safeguard and derogation routes in Articles 39 to 41 require no record, and Article 41(4) only requires the controller to inform the Commissioner of a transfer, which is a report.
- Kind
- Explicit
- As of
- Provision
- Article 42(2)(e) (binding company rules must provide for audits and for reporting and recording breaches, rectifying actions and changes to the rules)
- Trigger
- personal_data_processing
- security_incident
What this law does
Article 39 permits transferring personal data to a third country or an international organization, and any further onward transfer, only where the data receives adequate protection at the destination or a specific safeguard covers that transfer.
Article 39(2) permits recognizing or enforcing a foreign court or administrative decision that compels a transfer or disclosure of personal data only where it rests on an international agreement, such as a mutual legal assistance treaty in force with Albania.
Article 40 lets the Commissioner declare a country, territory, sector, or international organization adequate, weighing its data protection legislation, its rule of law and human rights record, its national security and criminal law regime, the existence of an effective independent supervisory authority, and its international commitments, and Article 40(4) requires the Commissioner to monitor and revise that finding over time.
Article 41 lets a controller or processor transfer personal data absent an adequacy decision where it provides an appropriate safeguard, such as a legally binding instrument between public authorities, Commissioner approved binding company rules, a Commissioner published data protection standard, or a code of conduct or certification mechanism carrying binding commitments from the recipient.
Article 41(3) allows a transfer absent both an adequacy decision and a safeguard only on a listed condition, including the data subject's informed and explicit consent to the transfer after being told its risks, contractual necessity, or an important public interest, and Article 41(4) confines a further fallback transfer to one that is not repetitive and concerns only a limited number of data subjects.
Article 42 lets the Commissioner approve binding rules for a group of companies that confer enforceable rights on data subjects, apply the general processing principles internally, and make the Albanian group member liable for another member's breach of the rules abroad.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .