AlbaniaLaw No. 124/2024, Commissioner, remedies, liability and penalties
Law No. 124/2024, Arts. 75-95 (Commissioner, remedies, liability and penalties)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Commissioner for the Right to Information and Personal Data Protection, an independent public legal person, to monitor and supervise compliance with this law and to investigate on its own initiative or on a complaint.
- Expect a data subject to be able to lodge a complaint with the Commissioner free of charge, and separately to bring a civil claim for compensation for any financial or non-financial damage caused by an infringement of this law.
- Comply with a Commissioner order such as a warning, a notice, a processing restriction, a rectification or erasure order, or a suspension of a data transfer, and expect an administrative fine reaching 2,000,000,000 Albanian Lek or 4% of worldwide annual turnover, whichever is higher, for the most serious violations, or 1,000,000,000 Lek or 2% for the minors' online consent rule, the non-identification rule, and most of the controller and processor obligations chapter other than Article 22 itself.
- Expect a Commissioner decision or fine to be appealable to the competent administrative court, and expect the Commissioner to bear the burden of proving a complaint unfounded or excessive rather than you.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Higher tier, Art. 94(2)-(3): failure to apply the basic lawful-basis and consent principles (Arts. 6-9), violation of data-subject rights (Arts. 12-20), unlawful cross-border transfer (Arts. 39-42), violation of the specific-purposes rules (Arts. 43-46), and non-compliance with a Commissioner order. A lower tier at Art. 94(1) caps at 1,000,000,000 ALL or 2% of global annual turnover, whichever higher, for the minors' online consent rule (Art. 8(6)), the non-identification rule (Art. 11), and Chapter III controller and processor obligations (Arts. 22-38) other than Art. 22 itself, and for certification and monitoring bodies.
- Rule
- Higher of
- As of
- Currency
- ALL
- Fixed cap
- 2,000,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Commissioner for the Right to Information and Personal Data Protection (Komisioneri per te Drejten e Informimit dhe Mbrojtjen e te Dhenave Personale, IDP)
Enforcement record
The Commissioner's annual report for 2024 counts, for personal data protection, 16 decisions corresponding to 48 administrative sanctions and fines and 2 orders for rectification of personal data, and administrative sanctions imposed for violation of the Law on Personal Data Protection of 3,680,000 Albanian Lek. Those 2024 decisions fall before Law No. 124/2024 took effect, which the report says repealed Law No. 9887/2008; the figure is the Commissioner's enforcement volume under the predecessor law.
- As of
- Currency
- ALL
- Source link
- https://idp.al/wp-content/uploads/2025/05/Annual-Report-2024.pdf
- Fines per year
- 3,680,000
- Actions per year
- 18
Settledness
- As of
- Open questions
- Has the Commissioner issued the guideline that Article 94(4) requires on whether and to what extent the administrative penalties in Article 94(1) to (3) may be imposed?
- Does "commercial company" in Article 94(2) and (3) reach a public body, association or other controller that is not a commercial company, so that only the Albanian Lek ceiling and not the 4% turnover leg applies to it?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 75 to 95 set up the Commissioner, its tasks and its investigative, remedial and sanction powers, and the complaint, appeal, compensation and penalty rules. Article 83(1)(b) lets the Commissioner order a controller or processor to provide information, including access to documentation, and Article 83(1)(รง) lets it conduct data protection audits, which are powers of the authority and name no record a controller must keep. The internal register of violations in Article 82(1)(n) is the Commissioner's own record. The record duties of the Law are in Articles 27, 29 and 62.
- Kind
- None
- As of
What this law does
Article 75 establishes the Commissioner for the Right to Information and Personal Data Protection as an independent public legal person responsible for monitoring and supervising this law.
Article 78 has the Assembly appoint the Commissioner for a 7 year renewable term on the Council of Ministers' proposal, and Article 82 gives the Commissioner authority to investigate on its own initiative or on a complaint, issue guidelines, approve codes of conduct and certification schemes, and authorize cross border transfers.
Article 83 gives the Commissioner remedial powers including warnings, notices, orders to comply with a data subject's rights, restrictions or bans on processing, orders to communicate a breach to data subjects, revocation of a certification, and suspension of a transfer, alongside its administrative sanction power.
Article 86 lets a data subject lodge a complaint with the Commissioner free of charge, and Article 87 lets any person appeal a Commissioner act, or a data subject sue, before the competent administrative court.
Article 88 gives a data subject a right to compensation for financial or non-financial damage from an infringement of this law, separate from and without prejudice to the administrative complaint route, with a controller or processor liable unless it proves it was not responsible for the event causing the damage. Article 89 lets a data subject authorize a public interest entity or association to lodge a complaint and exercise these rights on their behalf.
Article 94(2) fixes the highest administrative fine tier at 2,000,000,000 Albanian Lek or 4% of total annual worldwide turnover, whichever is higher, for failing to apply the basic lawfulness and consent principles, violating a data subject's rights, an unlawful cross border transfer, or breaching the specific purposes rules, and the same tier punishes non-compliance with a Commissioner order.
Article 94(1) fixes a lower tier at 1,000,000,000 Lek or 2% of turnover for the minors' online consent rule, the non-identification rule, and most of the controller and processor obligations chapter other than Article 22 itself. Article 95 lets a controller or processor appeal a fine to the competent court, and collected fines go to the state budget.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .