MoldovaMoldova Law No. 195/2024, transfers of personal data abroad
Legea Nr. 195 din 25 iulie 2024, articolele 44-50 (transferuri catre tari terte)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- on_request
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Rely on the National Centre for Personal Data Protection's adequacy list or an approved standard transfer agreement before transferring personal data of a person in Moldova outside the country.
- Apply the same conditions to an onward transfer from the destination country or organisation to another one, not only to the first transfer out.
- Where you rely on a derogation in article 49 instead, use one the article lists, and where that is the data subject's explicit consent, inform them of the possible risks of the transfer first.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 49(7) makes a controller or processor that transfers data under the Article 49(2) derogation document its assessment and the suitable safeguards in the records of processing activities that Article 30 requires. Article 47(2)(j) makes binding corporate rules provide mechanisms for verifying compliance that include data protection audits within the group, with the results available to the Centre on request. The Law sets no period for keeping them. Article 30, which carries the record and its availability to the Centre, is not cited by this row and is named here only as the place the documentation goes. Article 3, the territorial scope clause, is not cited by this row, so no hook is recorded.
- Kind
- Explicit
- As of
- Provision
- Article 49(7), with Article 47(2)(j)
- Trigger
- personal_data_processing
What this law does
Article 44 permits a transfer of personal data to a foreign country or an international organisation only on the conditions this chapter lays down, including for onward transfers. Article 45 governs transfer on the basis of an adequacy decision, article 46 transfer subject to appropriate safeguards including a standard transfer agreement the National Centre for Personal Data Protection approves, and article 47 binding corporate rules and what they must specify.
Article 49 sets the narrow derogations that permit a transfer in the absence of an adequacy decision or appropriate safeguards, including the data subject's explicit consent after being informed of the risks, contractual necessity, important reasons of public interest, legal claims, vital interests and a transfer from a public register. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication , so these provisions bind from .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .