Albania

Article 29(1) requires the controller to notify the Commissioner of a personal data breach as soon as possible and no later than 72 hours after becoming aware of it, unless the breach is unlikely to endanger the rights and freedoms of data subjects, and to give the Commissioner the reasons for any later notification. Article 29(2) requires a processor to notify the controller immediately after becoming aware of any personal data breach.

Article 29(4) requires the notification to the Commissioner to describe the nature of the breach, including where possible the categories and approximate number of data subjects and personal data records concerned, the data protection officer's or other contact point's details, the likely consequences, and the measures taken or proposed, and Article 29(5) lets information that cannot all be given at once follow as soon as possible afterward.

Article 29(6) requires the controller to document every personal data breach, its facts, its effects, and the corrective measures taken, so the Commissioner can verify compliance.

Article 29(3) requires the controller to inform the data subject of a breach likely to result in a high risk to their rights and freedoms, subject to exceptions for encryption, other risk reducing measures, or a public notice where individual notice would be disproportionate, but this paragraph does not itself bind until two years after the law's publication in the Official Gazette under Article 101(2).

Article 29(7) already lets the Commissioner order the controller to notify the data subject of a high risk breach case by case, so a request that never reaches the data subject can still draw a Commissioner order before the standalone Article 29(3) duty takes effect.

Article 3 applies this law to processing personal data wholly or partly by automated means and to processing that forms part of a filing system, excluding only processing by a natural person for personal or family purposes. Article 4 reaches a controller or processor established in Albania as well as one abroad that targets a person in Albania with goods, services, or behavioral monitoring.

Article 6 sets the lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability principles. Article 7 lists the lawful bases for processing, running from the data subject's consent through contractual necessity, a legal obligation, vital interests, a public task, and a legitimate interest that does not override the data subject's rights.

Article 8 requires consent to be demonstrable, presented separately from other matters in plain language, and withdrawable at any time as easily as it was given. Article 22 requires appropriate technical and organizational measures and data protection by design and by default under Article 23. Article 25 requires a local representative for a foreign controller or processor that targets people in Albania, unless the processing is occasional and low risk or the controller is a public authority.

Article 26 sets the processor's obligations under a binding written contract with the controller. Article 27 requires a written and electronic record of processing activities naming the controller, the purposes, the categories of data, and the recipients. Article 28 requires security measures appropriate to the risk, including pseudonymization and encryption.

Article 30 binds every controller, processor, and employee with access to personal data to a confidentiality obligation that survives the contract or the employment relationship. Article 33 requires a data protection officer where a public authority processes data, where core activities require large scale monitoring of data subjects, or where core activities involve large scale processing of sensitive data or criminal records.

Article 31's data protection impact assessment and Article 32's prior consultation with the Commissioner, together with the codes of conduct at Article 35 and the monitoring bodies at Article 36, do not bind until two years after the law's publication in the Official Gazette under Article 101(2). Article 43 lets journalistic, academic, literary, and artistic processing depart narrowly from this law's requirements.

Article 45 treats filing for public interest, historical, research, scientific, or statistical purposes as a legitimate interest subject to safeguards. Article 46 lets direct marketing rest on a legitimate interest but requires express consent to process sensitive data for that purpose.

Article 39 permits transferring personal data to a third country or an international organization, and any further onward transfer, only where the data receives adequate protection at the destination or a specific safeguard covers that transfer.

Article 39(2) permits recognizing or enforcing a foreign court or administrative decision that compels a transfer or disclosure of personal data only where it rests on an international agreement, such as a mutual legal assistance treaty in force with Albania.

Article 40 lets the Commissioner declare a country, territory, sector, or international organization adequate, weighing its data protection legislation, its rule of law and human rights record, its national security and criminal law regime, the existence of an effective independent supervisory authority, and its international commitments, and Article 40(4) requires the Commissioner to monitor and revise that finding over time.

Article 41 lets a controller or processor transfer personal data absent an adequacy decision where it provides an appropriate safeguard, such as a legally binding instrument between public authorities, Commissioner approved binding company rules, a Commissioner published data protection standard, or a code of conduct or certification mechanism carrying binding commitments from the recipient.

Article 41(3) allows a transfer absent both an adequacy decision and a safeguard only on a listed condition, including the data subject's informed and explicit consent to the transfer after being told its risks, contractual necessity, or an important public interest, and Article 41(4) confines a further fallback transfer to one that is not repetitive and concerns only a limited number of data subjects.

Article 42 lets the Commissioner approve binding rules for a group of companies that confer enforceable rights on data subjects, apply the general processing principles internally, and make the Albanian group member liable for another member's breach of the rules abroad.

Article 13 requires the controller to tell a data subject its identity and contact details, the purposes and legal basis of processing, the recipients, any transfer abroad, the retention period, and the rights available, and Article 12 requires that information to be concise, transparent, and in plain language, with particular care for information addressed to a minor.

Article 12(4) requires the controller to act on a data subject's request as soon as possible and no later than 30 days after receipt, extendable to 60 days for complex or numerous requests, and Article 12(5) makes that response free of charge unless the request is manifestly unfounded or excessive. Article 14 gives a data subject the right to access their personal data, its purpose, retention period, source, and recipients within 30 days of the request.

Article 15 gives a right to rectification of inaccurate data and to erasure on the listed grounds, both within 30 days, and requires the controller to inform every recipient the data were disclosed to of the change. Article 16 gives a right to be forgotten against search engines that continue to surface outdated and reputationally damaging results.

Article 17 gives a right to restrict processing, and Article 18 gives a right to receive personal data in a structured, commonly used, machine readable format and to have it transmitted directly to another controller where technically feasible. Article 19 gives a right to object to processing based on a public task or legitimate interest, and an unqualified right to object to direct marketing and its related profiling at any time without giving a reason.

Article 20 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly serious effects, subject to listed exceptions under which the data subject may still obtain human intervention, express their view, and contest the decision.

Article 75 establishes the Commissioner for the Right to Information and Personal Data Protection as an independent public legal person responsible for monitoring and supervising this law.

Article 78 has the Assembly appoint the Commissioner for a 7 year renewable term on the Council of Ministers' proposal, and Article 82 gives the Commissioner authority to investigate on its own initiative or on a complaint, issue guidelines, approve codes of conduct and certification schemes, and authorize cross border transfers.

Article 83 gives the Commissioner remedial powers including warnings, notices, orders to comply with a data subject's rights, restrictions or bans on processing, orders to communicate a breach to data subjects, revocation of a certification, and suspension of a transfer, alongside its administrative sanction power.

Article 86 lets a data subject lodge a complaint with the Commissioner free of charge, and Article 87 lets any person appeal a Commissioner act, or a data subject sue, before the competent administrative court.

Article 88 gives a data subject a right to compensation for financial or non-financial damage from an infringement of this law, separate from and without prejudice to the administrative complaint route, with a controller or processor liable unless it proves it was not responsible for the event causing the damage. Article 89 lets a data subject authorize a public interest entity or association to lodge a complaint and exercise these rights on their behalf.

Article 94(2) fixes the highest administrative fine tier at 2,000,000,000 Albanian Lek or 4% of total annual worldwide turnover, whichever is higher, for failing to apply the basic lawfulness and consent principles, violating a data subject's rights, an unlawful cross border transfer, or breaching the specific purposes rules, and the same tier punishes non-compliance with a Commissioner order.

Article 94(1) fixes a lower tier at 1,000,000,000 Lek or 2% of turnover for the minors' online consent rule, the non-identification rule, and most of the controller and processor obligations chapter other than Article 22 itself. Article 95 lets a controller or processor appeal a fine to the competent court, and collected fines go to the state budget.

Article 5(28) defines sensitive data as a special category revealing racial or ethnic origin, political opinions, religious belief or philosophical views, trade union membership, genetic data, biometric data, health records, or a person's sexual orientation.

Article 5(24) defines biometric data as personal data from specific technical processing of a person's physical, physiological, or behavioral characteristics that allows or confirms unique identification, naming a facial image as an example, so a derived faceprint counts and the definition is not confined to a raw recording.

Article 9(1) prohibits the processing of sensitive data outright, and Article 9(2) permits it only in the listed cases, beginning with the data subject's explicit consent to a specified purpose. Article 9(3) bars processing sensitive data about race or ethnic origin unless it ensures justice and equality on that ground and carries appropriate safeguards, and Article 9(4) permits every listed exception only where appropriate technical and security safeguards are in place.

Article 10 confines the processing of criminal records to the control of the competent authority or a specific legal authorization, with adequate protection for the data subject's rights and freedoms. Article 8(6) makes consent based processing of a minor's personal data for the online delivery of goods or services legitimate only where the minor is at least 16, and where the minor is younger, requires consent given or authorized by a parent or legal custodian.

Article 192/b of the Criminal Code makes interference, in any way, in computer transmissions and programs a penal contravention, punished by a fine or imprisonment of up to three years, rising to imprisonment of up to seven years where the act brings about serious consequences.

The consolidated Albanian text currently in force is amended through Law No. 146/2020, but the World Intellectual Property Organization holds no English rendering of that current text; the earlier English reference translation of the Code available there, amended through Law No. 8733/2001, is the version that carries this article.

Articles 119 to 126 of Law No. 35/2016 On Copyright and Related Rights give the producer of a database, defined as a systematically or methodically arranged collection of independent works, data, or materials whose safety, verification, or presentation required a substantial qualitative or quantitative investment, the exclusive right to authorise or prohibit the extraction or reuse of the whole or a substantial part of its content, evaluated qualitatively or quantitatively, and extends that right to the repeated and systematic extraction or reuse of insubstantial parts where it conflicts with the database's normal exploitation or unreasonably harms the producer's legitimate interests.

The right runs for 15 years from the year following the database's completion, restarting on a substantial new investment in the database.

Article 124 exempts extraction or reuse of a non-electronic database's content for private purposes, for illustration in teaching or scientific research with the source cited and the extent limited to the non-commercial purpose, and for public security or an administrative or judicial proceeding; Article 123 lets a legitimate user of a publicly available database extract or reuse insubstantial parts for any purpose, a right no contract can override.

Article 179 makes an unauthorised issuance, making available, communication, or use of a database's data an administrative offence, sanctioned by a fine of ALL 100,000 to 500,000 against the responsible person of a legal entity and ALL 50,000 to 200,000 against an employee, rather than a criminal penalty, when the same conduct does not separately constitute a criminal offence. The 2022 amendments to this law did not touch Part IV.

Law No. 25/2024 sets the rights and duties of public and private subjects that administer information infrastructure, communication networks and their systems whose compromise would affect the health, safety or economic wellbeing of the public or the effective functioning of the economy.

The law also names the National Authority for Cybersecurity as the single point of contact for cybersecurity matters, establishes the National CSIRT, CERT and sectoral CSIRTs, and requires a subject named in Annexes I or II to comply with mandatory cybersecurity risk management measures and to report cybersecurity incidents.

Per PwC's published account of the law, a bound operator must register its critical or important information infrastructure with the Authority, establish its own Computer Security Incident Response Team, implement the technical, organisational and operational risk management measures the Council of Ministers sets, report a significant or substantial incident to the Authority and the relevant CSIRTs, inform affected users, and cooperate with the Authority and other operators on sharing threat and incident information.

The National Authority for Cybersecurity's own presentation of the law's Annexes lists digital service providers among the sectors it reaches, alongside energy, transport, banking, financial market infrastructure, health, water supply, digital infrastructure, public administration and several other named sectors. PwC's client alert reports an administrative fine of 200,000 to 10,000,000 Albanian Lek for a violation of the law, varying with the type and severity of the violation.

The law entered into force on 3 May 2024, fifteen days after its publication, and PwC reports a 24 month period from that date for operators to bring their practices into compliance. The measures, reporting and penalty articles themselves are not confirmed against the primary Fletorja Zyrtare text here, whose paginated viewer rendered only the law's opening chapter, so this instrument's operative content beyond Article 1 rests on the Authority's own presentation and on PwC's client alert.

Article 32/1, added to Law No. 97/2013 by Law No. 30/2023, requires that a program which may harm a child's physical, mental, or moral development be broadcast only in a way that ensures children do not normally hear or see it, by choosing the broadcast time, applying age verification tools, or other technical measures, with the strictest measures required for the most harmful content such as violence and pornography.

The same article bars processing a child's personal data collected by an audiovisual media service provider for commercial purposes such as direct marketing, profiling, or behavioural advertising, and separately requires a video-sharing platform provider to take measures protecting children from harmful programs, user-generated videos, and commercial communications, and protecting the general public from content that incites violence or hatred or constitutes a criminal offence such as child pornography, racism, or xenophobia.

The Audiovisual Media Authority (AMA) may fine a video-sharing platform provider ALL 200,000 to ALL 2,000,000 for a violation of these obligations, an administrative rather than criminal sanction.

Article 80 of Law No. 35/2016 On Copyright and Related Rights allows, without the author's authorization and without remuneration, the reproduction, distribution, and forwarding to the public of newspaper articles and photos on political, economic, or religious topics through any means of communication to the public, including making them available via computer networks, to the extent necessary for public information about current events, provided the author has not expressly prohibited the use and the work is used to the extent justified by the purpose and manner of reporting.

Citing the source and the author, where possible, is compulsory under paragraph 2. Article 81 separately permits quoting fragments of a lawfully published work for scientific research, teaching, criticism, illustration, argumentation, reference, or review, subject to fair practice and the extent required for the purpose, again with compulsory source and authorship citation. Neither article states a headline-length or short-extract cap distinct from these fair-practice and extent-justified tests.