🇲🇩Law No. 195/2024 on the Protection of Personal Data
Law No. 195/2024 on the Protection of Personal Data
Law No. 195/2024 enters into force on 23 August 2026 and replaces Law No. 133/2011. It is a comprehensive GDPR-aligned law; competent-authority law-enforcement processing is outside its general scope.
Core controller and processor duties
Scope and children: Articles 1-3 define the subject and territorial reach. A child may consent to a directly offered information-society service from age 14.
Rights and accountability: Requests normally have a one-month response period, extendable by two months. The law requires appropriate processor terms, records of processing, security, notification to CNPDCP within 72 hours where required, high-risk communication, DPIAs, prior consultation and DPO appointment for specified processing.
Foreign representatives and transfers: Article 27 covers representatives for certain controllers or processors outside Moldova and includes a stated EEA-representative exception. Articles 44-49 regulate transfers: EEA transfers do not require special authorisation, while other transfers need adequacy, safeguards or a permitted derogation.
Foreign authority demands: Article 48 treats a foreign court or administrative-authority decision requiring disclosure as recognisable or enforceable only where based on an applicable international agreement, without prejudice to other transfer grounds. This needs a specific government-access review rather than automatic disclosure.
Before disclosing Moldovan personal data in response to a foreign order, preserve the request, assess Article 48 and the applicable treaty basis, document the transfer route, necessity and scope, and escalate conflicts of law.
The official CNPDCP PDF stored in this project is a four-page implementation overview. The complete authoritative Romanian statute was checked in Moldova's official Legis register and is the source linked by the database record.