AL-LAW-124-2024
Law No. 124/2024 on Personal Data Protection
Commissioner for the Right to Information and Personal Data Protection
Commissioner for the Right to Information and Personal Data Protection
Law No. 124/2024 “On Personal Data Protection” entered into force on 1 February 2025 and replaced Law No. 9887/2008. It applies to private and public-sector processing and includes an extraterritorial test for certain offers to, and monitoring of, people in Albania. The Commissioner for the Right to Information and Personal Data Protection supervises the law.
The law requires a lawful basis, transparent information, processor contracts, records, appropriate security, breach procedures, impact assessments for high-risk processing, DPOs in specified cases and lawful transfer mechanisms. Children may consent to an information-society service from age 16.
Several accountability provisions identified in Article 101(2), including parts of the breach, DPIA, code-of-conduct and certification framework, have a two-year deferred commencement. Implementation plans should therefore record both the general commencement date and the later date for those provisions.
Use a GDPR-style accountability programme, but map it to Albania's own scope, regulator, age-16 rule, statutory wording and phased commencement.