MoldovaLaw No. 195/2024 on Personal Data Protection
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Consent, Security, DPIA, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a lawful basis and allocate controller and processor duties before processing personal data of a person in Moldova.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P4
- Take consent only on the conditions article 7 sets, and be able to demonstrate the data subject gave it.NIST Privacy FrameworkCT.PO-P1
- Build data protection into the design of your processing and make it the default, and keep records of your processing activities.NIST Privacy FrameworkGV.PO-P2NIST Privacy FrameworkID.IM-P4
- Implement technical and organisational measures giving a level of security appropriate to the risk.NIST Privacy FrameworkPR.DS-P5
- Carry out a data protection impact assessment before processing likely to result in a high risk, and consult the National Centre for Personal Data Protection beforehand where that risk remains.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkGV.PO-P5
- Designate a data protection officer where the law requires one, give them the position article 38 prescribes, and let them carry out the tasks article 39 lists.NIST Privacy FrameworkGV.PO-P3
- Where you engage a processor, govern the engagement as article 28 requires, and settle each party's responsibilities in an arrangement where you are a joint controller.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkGV.PO-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P4Privacy roles and responsibilities are coordinated and aligned with third-party stakeholders (e.g., service providers, customers, partners).
3 more
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The regulator's security guidelines construe Article 30 of Law No. 133/2011, not this Law.
- As of
- Open questions
- How many data subjects, or what volume of data, makes processing "on a large scale" within Article 37(1)(c), which requires the controller or processor to designate a data protection officer?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 30 makes every controller and processor keep a written record of processing activities and make it available to the Centre on request, with an exemption in Article 30(5) for an organisation of fewer than 250 persons unless its processing is risky, not occasional or covers special categories or criminal-conviction data. Article 7(1) makes a controller that relies on consent able to demonstrate that the data subject consented, which cannot be shown without a record. Article 33(5) makes the controller document every personal data breach, its facts, effects and remedial action, in a form that lets the Centre verify compliance. The register's items (purposes, categories, recipients, transfers, erasure time limits, security measures) and the breach documentation's items are not log content values, so only the consent state is recorded. The record is the controller's own, so its retention is not coded: the Law sets no period for keeping it. Article 3(3), which extends the Law to diplomatic missions and to controllers by virtue of public international law, names no territorial test and carries no hook value.
- Kind
- Explicit
- As of
- Provision
- Article 30 (records of processing activities), with Article 7(1) (demonstrating consent) and Article 33(5) (documenting breaches)
- Trigger
- personal_data_processing
- security_incident
- consent_or_optout
What this law does
Articles 2 and 3 fix the law's material and territorial scope. Article 5 carries the processing principles, article 6 the lawful bases and article 7 the conditions for valid consent. Article 11 governs processing which does not require identification. Article 24 places responsibility on the controller, article 25 requires data protection by design and by default, article 26 governs joint controllers and article 28 the engagement of a processor.
Article 30 requires records of processing activities and article 32 technical and organisational measures giving a level of security appropriate to the risk. Article 35 requires a data protection impact assessment where processing is likely to result in a high risk, and article 36 prior consultation of the National Centre for Personal Data Protection where it shows that risk remains.
Articles 37 to 39 govern the designation, position and tasks of the data protection officer, and articles 40 to 43 the codes of conduct, their monitoring, certification and certification bodies. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication , so these provisions bind from .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .