🇨🇺Law 149/2022 on Protection of Personal Data
Law 149/2022 on Protection of Personal Data
Law 149 protects personal data held in physical or digital public and private records. It sets principles for collection limitation, quality, specified purpose, use limitation, authority, security, transparency, individual participation, responsibility, legality, confidentiality and consent.
Rights and procedure
People may seek access, non-disclosure, correction, modification, updating, cancellation and opposition. A responsible or entrusted person decides a request within five business days and implements an approved request within ten business days. A single equal extension is permitted when justified.
Retention, records and transfers
The default maximum retention period is five years unless law or consent establishes another term. Covered databases must be declared to the national control and kept current. International transfers are limited to the statutory grounds and require authorisation by the competent office-holder after considering purpose, duration, destination rules and security.
Electronic-data regulation
Resolution 58 requires security, cybersecurity-incident notification, electronic rights channels, comprehensible service terms, three months' advance notice of terms changes, deletion of links and copies where required, backups, national-server hosting unless law permits otherwise, and anonymisation for academic, research and social use.
Official text
Open Official Gazette No. 90 containing Law 149 and Resolution 58.