AlbaniaLaw No. 124/2024 On the Protection of Personal Data
Law No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data Arts. 1-8, 11, 22-38, 43-46 (general provisions, lawful basis, consent, controller and processor obligations, and specific-purpose exceptions), in force
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Consent, Governance, Security, DPIA, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish one of the lawful bases Article 7 lists, such as the data subject's consent, contractual necessity, a legal obligation, vital interests, a public task, or a legitimate interest that does not override the data subject's rights, before processing personal data of a person in Albania.NIST Privacy FrameworkCT.PO-P1
- Demonstrate that consent was given, present a request for consent separately from other matters in clear and plain language, and let the data subject withdraw consent at any time as easily as it was given.NIST Privacy FrameworkCT.PO-P1
- Implement data protection by design and by default in every processing tool and process, and appoint a data protection officer where processing is carried out by a public authority, requires regular and systematic large scale monitoring of data subjects, or involves large scale processing of sensitive data or criminal records.NIST Privacy FrameworkGV.PO-P2NIST Privacy FrameworkGV.PO-P3
- Appoint a representative located in Albania and notify the Commissioner in writing of that representative's identity when you target people in Albania from outside the country, unless the processing is occasional, small scale, and unlikely to risk fundamental rights, or you are a public authority.NIST Privacy FrameworkGV.PO-P5
- Maintain written and electronic records of processing activities naming the controller, the purposes, the categories of data and recipients, any transfer outside Albania, and the envisaged erasure periods, and make the records available to the Commissioner on request.NIST Privacy FrameworkID.IM-P4
- Implement technical and organizational security measures appropriate to the risk, including pseudonymization and encryption, the ability to restore access after an incident, and a process for regularly testing their effectiveness.NIST Privacy FrameworkPR.DS-P1NIST Privacy FrameworkPR.PO-P7
- Keep personal data confidential wherever an employee or processor has access to it for professional reasons, bind that confidentiality into every processor contract and employment contract, and continue it after the contract or employment ends.NIST Privacy FrameworkPR.PO-P9NIST Privacy FrameworkID.DE-P3
- From two years after the law's publication in the Official Gazette, carry out a data protection impact assessment before processing likely to result in a high risk to the rights and freedoms of a person in Albania, and seek the Commissioner's opinion in advance where the risk cannot be mitigated; until then, Articles 31 and 32 do not themselves bind.NIST Privacy FrameworkID.RA-P4
- Where personal data are prepared for journalistic, academic, literary or artistic publication, use them for no other purpose and do not identify a minor or a crime victim in the published material without the guardian's consent or a court's permission.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: Commissioner for the Right to Information and Protection of Personal Data of Albania (Komisioneri per te Drejten e Informimit dhe Mbrojtjen e te Dhenave Personale) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
4 more
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening).
- PR.DS-P1Data-at-rest are protected.
- NIST CSF 2.0
- GV.RR-04Cybersecurity is included in human resources practices
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://idp.al/wp-content/uploads/2025/05/Udhezim-nr.04-date-30.04.2025-per-mbrojtjen-e-te-dhenave-personale-dhe-masat-e-duhura-te-sigurise-ne-marketingun-e-drejtperdrejte.pdf
- Guidance body
- Commissioner for the Right to Information and Protection of Personal Data of Albania (Komisioneri per te Drejten e Informimit dhe Mbrojtjen e te Dhenave Personale)
- Open questions
- Outside direct marketing, which uses of personal data count as the "legitimate interests of the controller or a third party" that Article 7, paragraph 1, point dh of Law No. 124/2024 allows as a lawful basis, given that the Commissioner's Instruction No. 04 addresses that ground only for direct marketing?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 27(1) and (2) make each controller, its representative and each processor keep a written and electronic record of processing activities, naming the controller, the purposes, the categories of data subjects, data and recipients, transfers abroad, the envisaged erasure periods and the security measures; those items are outside the closed list of log contents. Article 27(3) makes the record available to the Commissioner on request, and Article 27(4) lifts the duty for a body with fewer than 250 staff unless its processing is risky, not occasional, or covers sensitive data or criminal records. The Law states no period for keeping the record. Article 8(1) requires a controller relying on consent to be able to demonstrate it, which names no record format, and Article 29(6) is the breach documentation duty the breach row carries. Article 62, which requires logs of consultation and disclosure, sits in the Part for competent authorities and is not among the sections this row cites. Article 4(1)(c), which reaches a territory where Albanian law applies under public international law, names no hook in the closed list and is left out of the territorial hook.
- Kind
- Explicit
- As of
- Provision
- Article 27 (written and electronic record of processing activities), with Article 8(1) (the controller must be able to demonstrate consent) and Article 29(6) (documentation of every personal data breach)
- Trigger
- personal_data_processing
- consent_or_optout
- security_incident
What this law does
Article 3 applies this law to processing personal data wholly or partly by automated means and to processing that forms part of a filing system, excluding only processing by a natural person for personal or family purposes. Article 4 reaches a controller or processor established in Albania as well as one abroad that targets a person in Albania with goods, services, or behavioral monitoring.
Article 6 sets the lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability principles. Article 7 lists the lawful bases for processing, running from the data subject's consent through contractual necessity, a legal obligation, vital interests, a public task, and a legitimate interest that does not override the data subject's rights.
Article 8 requires consent to be demonstrable, presented separately from other matters in plain language, and withdrawable at any time as easily as it was given. Article 22 requires appropriate technical and organizational measures and data protection by design and by default under Article 23. Article 25 requires a local representative for a foreign controller or processor that targets people in Albania, unless the processing is occasional and low risk or the controller is a public authority.
Article 26 sets the processor's obligations under a binding written contract with the controller. Article 27 requires a written and electronic record of processing activities naming the controller, the purposes, the categories of data, and the recipients. Article 28 requires security measures appropriate to the risk, including pseudonymization and encryption.
Article 30 binds every controller, processor, and employee with access to personal data to a confidentiality obligation that survives the contract or the employment relationship. Article 33 requires a data protection officer where a public authority processes data, where core activities require large scale monitoring of data subjects, or where core activities involve large scale processing of sensitive data or criminal records.
Article 31's data protection impact assessment and Article 32's prior consultation with the Commissioner, together with the codes of conduct at Article 35 and the monitoring bodies at Article 36, do not bind until two years after the law's publication in the Official Gazette under Article 101(2). Article 43 lets journalistic, academic, literary, and artistic processing depart narrowly from this law's requirements.
Article 45 treats filing for public interest, historical, research, scientific, or statistical purposes as a legitimate interest subject to safeguards. Article 46 lets direct marketing rest on a legitimate interest but requires express consent to process sensitive data for that purpose.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .