MoldovaMoldova Law No. 195/2024, rights of the data subject
Legea Nr. 195 din 25 iulie 2024, articolele 12-21, 23 (drepturile subiectului de date)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Give a data subject, at collection, your identity and contact details, the purposes and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, and where the data came from elsewhere, its source and the categories concerned.NIST Privacy FrameworkCM.AW-P1
- Answer a request for access, rectification, erasure, restriction or portability, and notify every recipient the data was disclosed to of a rectification, erasure or restriction you carry out.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Stop processing personal data for direct marketing as soon as the data subject objects, including the profiling related to it.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 12 to 21 and 23 set the transparency duties, the rights of access, rectification, erasure, restriction, portability and objection, and the limits on them. They tell the controller to provide information and to act on requests within time limits, and they state no duty to create, keep or produce a log or record; Article 11(2) and Article 21 ask a controller to demonstrate a fact to a data subject in a single case, which is an evidentiary burden and not a record duty. The record duties of Articles 7(1), 30 and 33(5) sit outside the cited articles. Article 3, the territorial scope clause, is not cited by this row and is not invoked by these articles, so no hook is recorded.
- Kind
- None
- As of
What this law does
Articles 13 and 14 fix the information a controller gives when it collects personal data from the data subject and where the data came from elsewhere. Article 15 gives a right of access, article 16 a right to rectification, article 17 a right to erasure, article 18 a right to restriction of processing, article 19 the duty to notify recipients of a rectification, erasure or restriction, article 20 a right to data portability and article 21 a right to object, including to direct marketing.
Article 23 sets the restrictions on those rights. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication , so these provisions bind from .
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .