Moldova

Article 33(1) requires the controller, in the case of a personal data breach, to notify it to the National Centre for Personal Data Protection without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and to accompany a later notification with reasons for the delay.

Article 33(2) requires the processor to notify the controller without undue delay after becoming aware of a breach.

Article 33(3) fixes what the notification must contain: the nature of the breach including, where possible, the categories and approximate number of data subjects and of personal data records concerned, the name and contact details of the data protection officer or other contact point, the likely consequences, and the measures taken or proposed to address it and mitigate its adverse effects.

Article 34(1) requires the controller to communicate the breach to the data subject without undue delay where it is likely to result in a high risk to the rights and freedoms of natural persons, in clear and plain language, and article 34(3) excuses that communication only where protective measures such as encryption render the affected data unintelligible, where subsequent measures make the high risk no longer likely, or where it would involve a disproportionate effort and a public communication of equal effect is made instead.

Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication 23 August 2024, so these provisions bind from 23 August 2026.

Articles 2 and 3 fix the law's material and territorial scope. Article 5 carries the processing principles, article 6 the lawful bases and article 7 the conditions for valid consent. Article 11 governs processing which does not require identification. Article 24 places responsibility on the controller, article 25 requires data protection by design and by default, article 26 governs joint controllers and article 28 the engagement of a processor.

Article 30 requires records of processing activities and article 32 technical and organisational measures giving a level of security appropriate to the risk. Article 35 requires a data protection impact assessment where processing is likely to result in a high risk, and article 36 prior consultation of the National Centre for Personal Data Protection where it shows that risk remains.

Articles 37 to 39 govern the designation, position and tasks of the data protection officer, and articles 40 to 43 the codes of conduct, their monitoring, certification and certification bodies. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication 23 August 2024, so these provisions bind from 23 August 2026.

Article 44 permits a transfer of personal data to a foreign country or an international organisation only on the conditions this chapter lays down, including for onward transfers. Article 45 governs transfer on the basis of an adequacy decision, article 46 transfer subject to appropriate safeguards including a standard transfer agreement the National Centre for Personal Data Protection approves, and article 47 binding corporate rules and what they must specify.

Article 49 sets the narrow derogations that permit a transfer in the absence of an adequacy decision or appropriate safeguards, including the data subject's explicit consent after being informed of the risks, contractual necessity, important reasons of public interest, legal claims, vital interests and a transfer from a public register. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication 23 August 2024, so these provisions bind from 23 August 2026.

Article 22(1) gives the data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them. Paragraph 2 lists exceptions, including where the decision is necessary for a contract with the data subject.

Where a carve-out applies, the controller must implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, including at least the right to obtain human intervention, express a point of view, and contest the decision.

Articles 13 and 14 fix the information a controller gives when it collects personal data from the data subject and where the data came from elsewhere. Article 15 gives a right of access, article 16 a right to rectification, article 17 a right to erasure, article 18 a right to restriction of processing, article 19 the duty to notify recipients of a rectification, erasure or restriction, article 20 a right to data portability and article 21 a right to object, including to direct marketing.

Article 23 sets the restrictions on those rights. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication 23 August 2024, so these provisions bind from 23 August 2026.

Articles 55 to 71 establish the National Centre for Personal Data Protection, fix its status, funding, mission, tasks and powers, its leadership and the appointment of its Director and Deputy Directors, and the appointment and liability of data protection inspectors. Article 72 gives a data subject the right to lodge a complaint with the Centre, and article 73 the right to challenge the Centre's actions or inactions.

Article 76 entitles any person who has suffered material or non-material damage from an infringement of the law to compensation from the controller or processor, a claim that runs in court separately from a complaint to the Centre. Article 77 opens the Centre's examination procedure, and the articles that follow govern how it is conducted and the sanctions that close it.

Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication 23 August 2024, so these provisions bind from 23 August 2026.

Article 8 fixes the conditions on which a child's consent to an information society service offered directly to a child is lawful, and requires the controller to make reasonable efforts to verify that the holder of parental responsibility gave or authorised it, taking available technology into account.

Article 9(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the processing of genetic data, of biometric data for the purpose of uniquely identifying a natural person, and of data concerning health or a natural person's sex life or sexual orientation; the law names facial images as a qualifying example of biometric data, so biometric material derived from an ordinary recording is not carved out of the prohibition.

Article 9(2) lifts that prohibition only in the cases it lists, beginning with the data subject's explicit consent to one or more specified purposes and running through employment and social security law, vital interests, the legitimate activities of a not-for-profit body confined to its members, data manifestly made public by the data subject, legal claims, substantial public interest, occupational medicine and health or social care provided under a duty of secrecy, public health, and archiving, research or statistics.

Article 10 governs the processing of personal data relating to criminal convictions and offences. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication 23 August 2024, so these provisions bind from 23 August 2026.

Article 6(1) requires a lawful basis, such as consent, a contract, a legal obligation, or a legitimate interest, before processing personal data at all, with no exception for personal data that happens to be publicly accessible; article 6(1)(f)'s legitimate-interest ground is the one most likely to be invoked to justify scraping ordinary personal data from a public page, but it still requires weighing the data subject's rights and interests rather than acting as a blanket carve-out.

Article 9(1) separately prohibits processing special-category data, including biometric data, without a ground listed in article 9(2); the only publicly-available-adjacent ground there is article 9(2)(e), which reaches special-category data the data subject manifestly made public themselves, and does not extend to ordinary personal data, or to special-category data another party (rather than the data subject) posted or that became public through a third party's disclosure.

A scraper collecting the personal data of a person in Moldova from a public, unauthenticated page must therefore still establish an article 6 lawful basis for the collection and any later use, including for training a model, and must treat any biometric or other special-category data derived from public photographs, video, or audio as subject to article 9's narrower regime.