🇦🇱Law No. 124/2024 on Personal Data Protection
Law No. 124/2024 “On Personal Data Protection”
Albania's current law aligns its general-processing regime with the GDPR and separately regulates competent-authority processing. Article 4 includes qualifying processing by organisations outside Albania that offer goods or services to, or monitor the behaviour of, people in Albania.
Core controller and processor duties
Lawfulness and children: Articles 6-9 cover principles, lawful bases, consent and special categories. Article 8 sets 16 as the consent age for information-society services offered directly to a child.
Transparency and rights: Articles 12-20 cover information, access, rectification, erasure, restriction, portability, objection and automated decisions.
Accountability: Articles 25-34 cover foreign representatives, processors, records, security, 72-hour regulator notification, high-risk communication, DPIAs, prior consultation and DPOs. Article 101(2) defers specified provisions for two years after publication.
Transfers: Articles 39-42 require an adequacy decision, appropriate safeguards or a limited statutory derogation.
A controller should not treat the general 1 February 2025 commencement as the only date. Its compliance register should separately track the provisions deferred by Article 101(2) and prepare before they commence.
Articles 4 and 6-9 - scope, principles, legal bases, consent and children.
Articles 12-20 - transparency and individual rights.
Articles 25-34 - representative, processors, records, security, incidents, DPIAs and DPOs.
Articles 39-42 and 101 - transfers and commencement.