Albania

Article 29(1) requires the controller to notify the Commissioner of a personal data breach as soon as possible and no later than 72 hours after becoming aware of it, unless the breach is unlikely to endanger the rights and freedoms of data subjects, and to give the Commissioner the reasons for any later notification. Article 29(2) requires a processor to notify the controller immediately after becoming aware of any personal data breach.

Article 29(4) requires the notification to the Commissioner to describe the nature of the breach, including where possible the categories and approximate number of data subjects and personal data records concerned, the data protection officer's or other contact point's details, the likely consequences, and the measures taken or proposed, and Article 29(5) lets information that cannot all be given at once follow as soon as possible afterward.

Article 29(6) requires the controller to document every personal data breach, its facts, its effects, and the corrective measures taken, so the Commissioner can verify compliance.

Article 29(3) requires the controller to inform the data subject of a breach likely to result in a high risk to their rights and freedoms, subject to exceptions for encryption, other risk reducing measures, or a public notice where individual notice would be disproportionate, but this paragraph does not itself bind until two years after the law's publication in the Official Gazette under Article 101(2).

Article 29(7) already lets the Commissioner order the controller to notify the data subject of a high risk breach case by case, so a request that never reaches the data subject can still draw a Commissioner order before the standalone Article 29(3) duty takes effect.

Article 3 applies this law to processing personal data wholly or partly by automated means and to processing that forms part of a filing system, excluding only processing by a natural person for personal or family purposes. Article 4 reaches a controller or processor established in Albania as well as one abroad that targets a person in Albania with goods, services, or behavioral monitoring.

Article 6 sets the lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability principles. Article 7 lists the lawful bases for processing, running from the data subject's consent through contractual necessity, a legal obligation, vital interests, a public task, and a legitimate interest that does not override the data subject's rights.

Article 8 requires consent to be demonstrable, presented separately from other matters in plain language, and withdrawable at any time as easily as it was given. Article 22 requires appropriate technical and organizational measures and data protection by design and by default under Article 23. Article 25 requires a local representative for a foreign controller or processor that targets people in Albania, unless the processing is occasional and low risk or the controller is a public authority.

Article 26 sets the processor's obligations under a binding written contract with the controller. Article 27 requires a written and electronic record of processing activities naming the controller, the purposes, the categories of data, and the recipients. Article 28 requires security measures appropriate to the risk, including pseudonymization and encryption.

Article 30 binds every controller, processor, and employee with access to personal data to a confidentiality obligation that survives the contract or the employment relationship. Article 33 requires a data protection officer where a public authority processes data, where core activities require large scale monitoring of data subjects, or where core activities involve large scale processing of sensitive data or criminal records.

Article 31's data protection impact assessment and Article 32's prior consultation with the Commissioner, together with the codes of conduct at Article 35 and the monitoring bodies at Article 36, do not bind until two years after the law's publication in the Official Gazette under Article 101(2). Article 43 lets journalistic, academic, literary, and artistic processing depart narrowly from this law's requirements.

Article 45 treats filing for public interest, historical, research, scientific, or statistical purposes as a legitimate interest subject to safeguards. Article 46 lets direct marketing rest on a legitimate interest but requires express consent to process sensitive data for that purpose.

Article 39 permits transferring personal data to a third country or an international organization, and any further onward transfer, only where the data receives adequate protection at the destination or a specific safeguard covers that transfer.

Article 39(2) permits recognizing or enforcing a foreign court or administrative decision that compels a transfer or disclosure of personal data only where it rests on an international agreement, such as a mutual legal assistance treaty in force with Albania.

Article 40 lets the Commissioner declare a country, territory, sector, or international organization adequate, weighing its data protection legislation, its rule of law and human rights record, its national security and criminal law regime, the existence of an effective independent supervisory authority, and its international commitments, and Article 40(4) requires the Commissioner to monitor and revise that finding over time.

Article 41 lets a controller or processor transfer personal data absent an adequacy decision where it provides an appropriate safeguard, such as a legally binding instrument between public authorities, Commissioner approved binding company rules, a Commissioner published data protection standard, or a code of conduct or certification mechanism carrying binding commitments from the recipient.

Article 41(3) allows a transfer absent both an adequacy decision and a safeguard only on a listed condition, including the data subject's informed and explicit consent to the transfer after being told its risks, contractual necessity, or an important public interest, and Article 41(4) confines a further fallback transfer to one that is not repetitive and concerns only a limited number of data subjects.

Article 42 lets the Commissioner approve binding rules for a group of companies that confer enforceable rights on data subjects, apply the general processing principles internally, and make the Albanian group member liable for another member's breach of the rules abroad.

Article 20(1) gives the data subject the right not to be subject to a decision based solely on automated processing of their data, including profiling, that produces legal effects or similarly serious effects on them. Paragraph 2 lists exceptions, including where the decision is necessary for entering into or performing a contract. Where an exception applies, the controller must give the data subject the right to obtain human intervention, express their point of view, and contest the decision.

Article 13 requires the controller to tell a data subject its identity and contact details, the purposes and legal basis of processing, the recipients, any transfer abroad, the retention period, and the rights available, and Article 12 requires that information to be concise, transparent, and in plain language, with particular care for information addressed to a minor.

Article 12(4) requires the controller to act on a data subject's request as soon as possible and no later than 30 days after receipt, extendable to 60 days for complex or numerous requests, and Article 12(5) makes that response free of charge unless the request is manifestly unfounded or excessive. Article 14 gives a data subject the right to access their personal data, its purpose, retention period, source, and recipients within 30 days of the request.

Article 15 gives a right to rectification of inaccurate data and to erasure on the listed grounds, both within 30 days, and requires the controller to inform every recipient the data were disclosed to of the change. Article 16 gives a right to be forgotten against search engines that continue to surface outdated and reputationally damaging results.

Article 17 gives a right to restrict processing, and Article 18 gives a right to receive personal data in a structured, commonly used, machine readable format and to have it transmitted directly to another controller where technically feasible. Article 19 gives a right to object to processing based on a public task or legitimate interest, and an unqualified right to object to direct marketing and its related profiling at any time without giving a reason.

Article 75 establishes the Commissioner for the Right to Information and Personal Data Protection as an independent public legal person responsible for monitoring and supervising this law.

Article 78 has the Assembly appoint the Commissioner for a 7 year renewable term on the Council of Ministers' proposal, and Article 82 gives the Commissioner authority to investigate on its own initiative or on a complaint, issue guidelines, approve codes of conduct and certification schemes, and authorize cross border transfers.

Article 83 gives the Commissioner remedial powers including warnings, notices, orders to comply with a data subject's rights, restrictions or bans on processing, orders to communicate a breach to data subjects, revocation of a certification, and suspension of a transfer, alongside its administrative sanction power.

Article 86 lets a data subject lodge a complaint with the Commissioner free of charge, and Article 87 lets any person appeal a Commissioner act, or a data subject sue, before the competent administrative court.

Article 88 gives a data subject a right to compensation for financial or non-financial damage from an infringement of this law, separate from and without prejudice to the administrative complaint route, with a controller or processor liable unless it proves it was not responsible for the event causing the damage. Article 89 lets a data subject authorize a public interest entity or association to lodge a complaint and exercise these rights on their behalf.

Article 94(2) fixes the highest administrative fine tier at 2,000,000,000 Albanian Lek or 4% of total annual worldwide turnover, whichever is higher, for failing to apply the basic lawfulness and consent principles, violating a data subject's rights, an unlawful cross border transfer, or breaching the specific purposes rules, and the same tier punishes non-compliance with a Commissioner order.

Article 94(1) fixes a lower tier at 1,000,000,000 Lek or 2% of turnover for the minors' online consent rule, the non-identification rule, and most of the controller and processor obligations chapter other than Article 22 itself. Article 95 lets a controller or processor appeal a fine to the competent court, and collected fines go to the state budget.

Article 5(28) defines sensitive data as a special category revealing racial or ethnic origin, political opinions, religious belief or philosophical views, trade union membership, genetic data, biometric data, health records, or a person's sexual orientation.

Article 5(24) defines biometric data as personal data from specific technical processing of a person's physical, physiological, or behavioral characteristics that allows or confirms unique identification, naming a facial image as an example, so a derived faceprint counts and the definition is not confined to a raw recording.

Article 9(1) prohibits the processing of sensitive data outright, and Article 9(2) permits it only in the listed cases, beginning with the data subject's explicit consent to a specified purpose. Article 9(3) bars processing sensitive data about race or ethnic origin unless it ensures justice and equality on that ground and carries appropriate safeguards, and Article 9(4) permits every listed exception only where appropriate technical and security safeguards are in place.

Article 10 confines the processing of criminal records to the control of the competent authority or a specific legal authorization, with adequate protection for the data subject's rights and freedoms. Article 8(6) makes consent based processing of a minor's personal data for the online delivery of goods or services legitimate only where the minor is at least 16, and where the minor is younger, requires consent given or authorized by a parent or legal custodian.

Article 192/b of the Criminal Code, headed unauthorized computer access, punishes entering a computer system or part of it without authorization, or beyond the authorization held, by breaching its security measures, with a fine or imprisonment of up to three years. Where the offense is committed in a military, national security, public order, civil protection or health computer system, or in any other computer system of public importance, the penalty is imprisonment of three to ten years.

Law 8733 of 24 January 2001 added the article, and Law 9686 of 26 February 2007 and Law 10 023 of 27 November 2008 amended it, but no source stating the day Law 10 023 came into force has been located.

Articles 119 to 126 of Law No. 35/2016 On Copyright and Related Rights give the producer of a database, defined as a systematically or methodically arranged collection of independent works, data, or materials whose safety, verification, or presentation required a substantial qualitative or quantitative investment, the exclusive right to authorise or prohibit the extraction or reuse of the whole or a substantial part of its content, evaluated qualitatively or quantitatively, and extends that right to the repeated and systematic extraction or reuse of insubstantial parts where it conflicts with the database's normal exploitation or unreasonably harms the producer's legitimate interests.

The right runs for 15 years from the year following the database's completion, restarting on a substantial new investment in the database.

Article 124 exempts extraction or reuse of a non-electronic database's content for private purposes, for illustration in teaching or scientific research with the source cited and the extent limited to the non-commercial purpose, and for public security or an administrative or judicial proceeding; Article 123 lets a legitimate user of a publicly available database extract or reuse insubstantial parts for any purpose, a right no contract can override.

Article 179 makes an unauthorised issuance, making available, communication, or use of a database's data an administrative offence, sanctioned by a fine of ALL 100,000 to 500,000 against the responsible person of a legal entity and ALL 50,000 to 200,000 against an employee, rather than a criminal penalty, when the same conduct does not separately constitute a criminal offence. The 2022 amendments to this law did not touch Part IV.

Article 190 of Law 35/2016 brings that Law into force six months after its publication in the Official Gazette, and no source stating the resulting day has been located.

Article 7(1) point a requires undertakings to adopt a written internal information security policy approved by management and reviewed at least once a year. Article 10(1) requires undertakings to file a report on the security measures applied with AKEP once a year, by February of each year. Article 10(2) requires an undertaking with more than 2,000 subscribers, or one that meets another listed condition, to file an ISO 27001 certificate or a security audit report with AKEP.

Article 10(2) makes the undertaking bear the cost of that audit in every case. Article 12 treats a violation of the regulation that is not a criminal offence as an administrative offence fined under article 184 of Law No. 54/2024.

Law No. 25/2024 sets the rights and duties of public and private subjects that administer information infrastructure, communication networks and their systems whose compromise would affect the health, safety or economic wellbeing of the public or the effective functioning of the economy.

The law also names the National Authority for Cybersecurity as the single point of contact for cybersecurity matters, establishes the National computer security incident response team (CSIRT), CERT and sectoral CSIRTs, and requires a subject named in Annexes I or II to comply with mandatory cybersecurity risk management measures and to report cybersecurity incidents.

Per PwC's published account of the law, a bound operator must register its critical or important information infrastructure with the Authority, establish its own Computer Security Incident Response Team, implement the technical, organisational and operational risk management measures the Council of Ministers sets, report a significant or substantial incident to the Authority and the relevant CSIRTs, inform affected users, and cooperate with the Authority and other operators on sharing threat and incident information.

The National Authority for Cybersecurity's own presentation of the law's Annexes lists digital service providers among the sectors it reaches, alongside energy, transport, banking, financial market infrastructure, health, water supply, digital infrastructure, public administration and several other named sectors. PwC's client alert reports an administrative fine of 200,000 to 10,000,000 Albanian Lek for a violation of the law, varying with the type and severity of the violation.

The law entered into force on 3 May 2024, fifteen days after its publication, and PwC reports a 24 month period from that date for operators to bring their practices into compliance. The measures, reporting and penalty articles themselves are not confirmed against the primary Fletorja Zyrtare text here, whose paginated viewer rendered only the law's opening chapter, so this instrument's operative content beyond Article 1 rests on the Authority's own presentation and on PwC's client alert.

Article 54(1) obliges providers of public electronic communications networks or services available to the public to take appropriate, proportionate technical and organisational measures to manage the risks to the security of networks and services. Article 54(2) obliges internet access providers to take measures to protect against DDoS attacks.

Article 54(3) obliges those providers to notify AKEP and the authority responsible for cybersecurity without delay of a cybersecurity incident that has affected the operation of their networks, systems or services. Article 56(3) point a requires electronic communications undertakings to give AKEP the information it needs to assess the security of their networks and services, including documented security policies.

Article 56(3) point b requires them to submit a security audit by a qualified independent body or a competent authority at their own cost. Article 184(1) point a fines an undertaking up to 3% of its annual revenue in the last closed financial year, and not more than 100,000,000 lek, for the infringements listed under it.

Article 184(1) point a sub-point xii lists among those infringements a failure to take the appropriate, technical, organisational and proportionate measures required by article 54. The law was adopted on 30 May 2024 and promulgated by decree no. 227 of 14 June 2024. Article 193(2) provides that the law enters into force 6 months after publication in the Official Gazette. The Official Gazette issue no. 102 of 20 June 2024 published the law.

Article 11(1) requires an electronic communications undertaking to notify AKEP electronically within 24 hours of recording a security incident. Article 11(1) makes that notification mandatory only where the incident is classified as of medium or high impact. Article 11(2) requires Annexes 1 and 2 to be filed within 72 hours of recording the incident. Article 11(4) requires the updated Annexes 1 and 2 as the final report within 30 calendar days of recording the incident.

Article 11(7) requires undertakings to keep all data on an incident for at least 12 months from filing the final notification. Article 12 treats a violation of the regulation that is not a criminal offence as an administrative offence fined under article 184 of Law No. 54/2024. Article 14 provides that the regulation enters into force on the date of its approval by the Governing Council of AKEP. The regulation was approved by decision no. 8 of 13 March 2026 of the Governing Council of AKEP.

Article 23(3) obliges operators of critical and important information infrastructure to report every type of cybersecurity incident to the National computer security incident response team (CSIRT) and the sectoral CSIRT within 4 hours of identifying the incident. Article 23(3) also requires an operator, for a significant incident, to update the information and make an initial assessment of severity and impact within 72 hours of identifying the significant incident.

Article 23(5) requires a final report to the National CSIRT within one month after the incident notification. Article 26(3) requires operators to notify without delay the users of their services who are potentially affected by a significant cybersecurity incident. Article 44 point a makes the failure to report a cybersecurity incident under article 23(3) an administrative offence.

Article 45(1) point a sets a fine of 1,000,000 to 10,000,000 lek for the administrative offences in points a and d of article 44. Article 50(1) gives the subjects responsible for cybersecurity 24 months from the law's entry into force to harmonise their activity with it. The National Authority for Cybersecurity states that the law entered into force on 3 May 2024.

Article 32/1, added to Law No. 97/2013 by Law No. 30/2023, requires that a program which may harm a child's physical, mental, or moral development be broadcast only in a way that ensures children do not normally hear or see it, by choosing the broadcast time, applying age verification tools, or other technical measures, with the strictest measures required for the most harmful content such as violence and pornography.

The same article bars processing a child's personal data collected by an audiovisual media service provider for commercial purposes such as direct marketing, profiling, or behavioural advertising, and separately requires a video-sharing platform provider to take measures protecting children from harmful programs, user-generated videos, and commercial communications, and protecting the general public from content that incites violence or hatred or constitutes a criminal offence such as child pornography, racism, or xenophobia.

The Audiovisual Media Authority (AMA) may fine a video-sharing platform provider ALL 200,000 to ALL 2,000,000 for a violation of these obligations, an administrative rather than criminal sanction. Article 20 of Law 30/2023 brings that Law into force fifteen days after its publication in the Official Gazette, and Law 30/2023 was published in Official Gazette no. 75 of 10 May 2023.

Article 80 of Law No. 35/2016 On Copyright and Related Rights allows, without the author's authorization and without remuneration, the reproduction, distribution, and forwarding to the public of newspaper articles and photos on political, economic, or religious topics through any means of communication to the public, including making them available via computer networks, to the extent necessary for public information about current events, provided the author has not expressly prohibited the use and the work is used to the extent justified by the purpose and manner of reporting.

Citing the source and the author, where possible, is compulsory under paragraph 2. Article 81 separately permits quoting fragments of a lawfully published work for scientific research, teaching, criticism, illustration, argumentation, reference, or review, subject to fair practice and the extent required for the purpose, again with compulsory source and authorship citation. Neither article states a headline-length or short-extract cap distinct from these fair-practice and extent-justified tests.

Article 190 of Law 35/2016 brings that Law into force six months after its publication in the Official Gazette, and no source stating the resulting day has been located.