MoldovaMoldova Law No. 195/2024, the Centre, complaints, compensation and sanctions
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect a person in Moldova to have a court-enforceable damages claim for material or non-material harm from an infringement of this law, separate from a complaint to the National Centre.
- Expect a data subject to be able to lodge a complaint with the National Centre for Personal Data Protection about your processing, and to challenge the Centre's own action or inaction.
- Answer the Centre's examination procedure once it is opened against you, and expect the sanctions the law provides at the end of it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Law 195/2024 Article 88(2) sets the higher fine tier at up to 2,000,000 Moldovan lei or, for an undertaking, up to 2% of total turnover in the year preceding the sanctioning, whichever is higher, for breaches including the basic principles of processing and consent, data subject rights, cross-border transfers, Chapter VI obligations, and non-compliance with a Centre corrective measure. Article 88(1) sets a lower tier at up to 1,000,000 lei or 1% of turnover, whichever is higher, for narrower controller, processor, certification-body and monitoring-body obligations. Both tiers apply to public authorities and institutions as well as private undertakings under Article 88(4). Article 90(4), a transitional provision, phases enforcement in over three years from the law's entry into force: only 10% of the determined fine amount is collectible in the first year, 40% in the second year, and the full amount from the third year onward, so a fine imposed while the law is this new is capped at a fraction of these ceilings regardless of the infringement's severity.
- Rule
- Higher of
- As of
- Currency
- MDL
- Fixed cap
- 2,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
National Centre for Personal Data Protection (Centrul National pentru Protectia Datelor cu Caracter Personal), Moldova's independent public-authority supervisory body under Law 195/2024.
Settledness
- As of
- Open questions
- Does Article 90(4) of Law No. 195/2024, which applies 10% of the amount of the fine in the first year, 40% in the second year and 100% in the third year 'from the final amount of the pecuniary sanction determined by the Centre', limit the fine the Centre may impose or only the part of it that is collected, and does 'the first year' run from the Law's entry into force or from the date of the infringement?
What it makes you log
Logging duty
Articles 55 to 86 set up the Centre, its tasks and powers, the complaint and investigation procedure, compensation and sanctions. Article 82(1) entitles the Centre to request and obtain any necessary documents and information from natural and legal persons, and Article 81(10) lets the Centre's inspectors obtain access to data and documents and ask for the information and documents they request in an investigation; these are powers to demand information, with no record named, so there is no duty to log and the audit expectation is on request by the regulator. Article 59(1)(t), under which the Centre keeps internal records of infringements and measures, is the Centre's own record and not a controller's log. The record duties of Articles 7(1), 30 and 33(5) sit outside the cited articles. Article 3, the territorial scope clause, is not cited by this row, so no hook is recorded.
- Kind
- None
- As of
What this law does
Articles 55 to 71 establish the National Centre for Personal Data Protection, fix its status, funding, mission, tasks and powers, its leadership and the appointment of its Director and Deputy Directors, and the appointment and liability of data protection inspectors. Article 72 gives a data subject the right to lodge a complaint with the Centre, and article 73 the right to challenge the Centre's actions or inactions.
Article 76 entitles any person who has suffered material or non-material damage from an infringement of the law to compensation from the controller or processor, a claim that runs in court separately from a complaint to the Centre. Article 77 opens the Centre's examination procedure, and the articles that follow govern how it is conducted and the sanctions that close it.
Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication , so these provisions bind from .
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .