Law / Albania

Law No. 124/2024 On the Protection of Personal Data

Law No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data Arts. 1-8, 11, 22-38, 43-46 (general provisions, lawful basis, consent, controller and processor obligations, and specific-purpose exceptions), in force 31 January 2025

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 31 January 2025.

A comprehensive regime rule binding public and private bodies.

As of 19 September 2026.

What it requires

Establish one of the lawful bases Article 7 lists, such as the data subject's consent, contractual necessity, a legal obligation, vital interests, a public task, or a legitimate interest that does not override the data subject's rights, before processing personal data of a person in Albania.
Demonstrate that consent was given, present a request for consent separately from other matters in clear and plain language, and let the data subject withdraw consent at any time as easily as it was given.
Implement data protection by design and by default in every processing tool and process, and appoint a data protection officer where processing is carried out by a public authority, requires regular and systematic large scale monitoring of data subjects, or involves large scale processing of sensitive data or criminal records.
Appoint a representative located in Albania and notify the Commissioner in writing of that representative's identity when you target people in Albania from outside the country, unless the processing is occasional, small scale, and unlikely to risk fundamental rights, or you are a public authority.
Maintain written and electronic records of processing activities naming the controller, the purposes, the categories of data and recipients, any transfer outside Albania, and the envisaged erasure periods, and make the records available to the Commissioner on request.
Implement technical and organizational security measures appropriate to the risk, including pseudonymization and encryption, the ability to restore access after an incident, and a process for regularly testing their effectiveness.
Keep personal data confidential wherever an employee or processor has access to it for professional reasons, bind that confidentiality into every processor contract and employment contract, and continue it after the contract or employment ends.
From two years after the law's publication in the Official Gazette, carry out a data protection impact assessment before processing likely to result in a high risk to the rights and freedoms of a person in Albania, and seek the Commissioner's opinion in advance where the risk cannot be mitigated; until then, Articles 31 and 32 do not themselves bind.
Where personal data are prepared for journalistic, academic, literary or artistic publication, use them for no other purpose and do not identify a minor or a crime victim in the published material without the guardian's consent or a court's permission.

What it reaches

Obligation class

Consent, Governance, Security, DPIA, Retention

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 3 applies this law to processing personal data wholly or partly by automated means and to processing that forms part of a filing system, excluding only processing by a natural person for personal or family purposes. Article 4 reaches a controller or processor established in Albania as well as one abroad that targets a person in Albania with goods, services, or behavioral monitoring.

Article 6 sets the lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability principles. Article 7 lists the lawful bases for processing, running from the data subject's consent through contractual necessity, a legal obligation, vital interests, a public task, and a legitimate interest that does not override the data subject's rights.

Article 8 requires consent to be demonstrable, presented separately from other matters in plain language, and withdrawable at any time as easily as it was given. Article 22 requires appropriate technical and organizational measures and data protection by design and by default under Article 23. Article 25 requires a local representative for a foreign controller or processor that targets people in Albania, unless the processing is occasional and low risk or the controller is a public authority.

Article 26 sets the processor's obligations under a binding written contract with the controller. Article 27 requires a written and electronic record of processing activities naming the controller, the purposes, the categories of data, and the recipients. Article 28 requires security measures appropriate to the risk, including pseudonymization and encryption.

Article 30 binds every controller, processor, and employee with access to personal data to a confidentiality obligation that survives the contract or the employment relationship. Article 33 requires a data protection officer where a public authority processes data, where core activities require large scale monitoring of data subjects, or where core activities involve large scale processing of sensitive data or criminal records.

Article 31's data protection impact assessment and Article 32's prior consultation with the Commissioner, together with the codes of conduct at Article 35 and the monitoring bodies at Article 36, do not bind until two years after the law's publication in the Official Gazette under Article 101(2). Article 43 lets journalistic, academic, literary, and artistic processing depart narrowly from this law's requirements.

Article 45 treats filing for public interest, historical, research, scientific, or statistical purposes as a legitimate interest subject to safeguards. Article 46 lets direct marketing rest on a legitimate interest but requires express consent to process sensitive data for that purpose.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach

Read the law

Official statute PDF hosted by the Commissioner for the Right to Information and Personal Data Protection (idp.al)
read in full (169,825 characters, untruncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app