Personal Data Protection

Personal data protection is the safeguarding of individuals' personal information and ensuring it is collected, used, and stored lawfully and securely.

Monitoring of compliance of personal data processing with the requirements of this law is carried out by the National Center for Personal Data Protection of the Republic of Moldova.

For information - Legal basis of Moldova

Law No. 195/2024 on Personal Data Protection
This law transposes Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR).
Subject matter and purpose of the law (Article 1)
(1) This law establishes the legal framework regarding:
a) the protection of natural persons with regard to processing of personal data;
b) the organization and functioning of the National Center for Personal Data Protection (hereinafter referred to as the Center);
c) supervision of the implementation of the legislation on the protection of personal data;
d) legal liability and sanctions applied for violation of the legislation on the protection of personal data.
(2) This law aims to ensure the protection of the fundamental rights and freedoms of natural persons and, in particular, the right to intimate, family and private life, in relation to the processing of personal data.
Law No. 160/2026 on the protection of personal data processed for the purposes of preventing and combating crime
This law transposes Directive (EU) 2016/680 on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties (Law Enforcment Directive, LED).
Competent authorities: Police, prosecutor's office, courts, penitentiary system and other competent bodies.
Object and purpose of the law (Article 1)
(1) This law establishes the legal framework regarding the protection of individuals physical persons with regard to the processing of personal data by the competent authorities, for the purposes of:
a) preventing crimes, including the prevention and protection against threats to public order and security;
b) detecting or investigating crimes or conducting criminal prosecutions;
c) judging criminal cases;
d) executing criminal sentences or security measures.
(2) This law aims to ensure the protection of the fundamental rights and freedoms of natural persons and, in particular, the right to intimate, family and private life, in relation to the processing of personal data for the purposes provided for in paragraph (1).

For information - Personal Data Protection Regulation in EU

The General Data Protection Regulation (Regulation (EU) 2016/679), abbreviated GDPR, is a European Union regulation on information privacy in the European Union (EU) and the European Economic Area (EEA). The GDPR is an important component of EU privacy law and human rights law, in particular Article 8(1) of the Charter of Fundamental Rights of the European Union. It also governs the transfer of personal data outside the EU and EEA. The GDPR's goals are to enhance individuals' control and rights over their personal information and to simplify the regulations for international business.

What is the aim of the Regulation?

The general data protection regulation (GDPR) protects individuals when their data is being processed by the private sector and most of the public sector. The processing of data by the relevant authorities for law-enforcement purposes is subject to the data protection law enforcement directive (LED) instead.
It allows individuals to better control their personal data. It also modernises and unifies rules, allowing businesses to reduce red tape and to benefit from greater consumer trust.
It establishes a system of completely independent supervisory authorities in charge of monitoring and enforcing compliance.
It is part of the European Union (EU) data protection reform, along with the data protection law enforcement directive and Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies.

Key Points

Data protection rights for individuals

Under the GDPR, individuals have several rights over their personal data.

Right to be informed
Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability
Right to object
Rights in relation to automated decision-making and profiling

Regulation (EU) 2016/679 General Data Protection Regulation (GDPR)

Regulation (EU) 2018/1725 on Personal Data Processing by EU institutions (EUDPR)

Directive (EU) 2016/680 Personal Data Protection by competent authorities (LED)

Directive 2002/58/EC on privacy and electronic communications (ePrivacy Directive)

Rules for businesses

The GDPR creates a level playing field for all companies operating in the EU internal market, adopts a technology-neutral approach and stimulates innovation through a number of steps, which include the following.

A single set of EU-wide rules. A single EU-wide law for data protection increases legal certainty and reduces administrative burden.
A data protection officer. A person responsible for data protection has to be designated by public authorities and by businesses that process data on a large scale, or whose core activity is the processing of special categories of data, such as health-related data.
One-stop shop. Businesses only have to deal with one single supervisory authority (in the EU Member State in which they have their main establishment); the relevant supervisory authorities cooperate in the framework of the European Data Protection Board for cross-border cases.
EU rules for non-EU companies. Companies based outside the EU must apply the same rules when offering services or goods to, or when monitoring the behaviours of, individuals within the EU.
Innovation-friendly rules. A guarantee that data protection safeguards are built into products and services from the earliest stage of development (data protection by design and by default).
Privacy-friendly techniques. Pseudonymisation (when identifying fields within a data record are replaced by one or more artificial identifiers) and encryption (when data is coded in such a way that only authorised parties can read it), for example, are encouraged, in order to limit the intrusiveness of processing.
Removal of notifications. The GDPR scrapped most notification obligations and the costs associated with these. One of its aims is to remove obstacles that affect the free flow of personal data within the EU. This will make it easier for businesses to expand in the single digital market.
Data protection impact assessments. Organisations will have to carry out impact assessments when data processing may result in a high risk for the rights and freedoms of individuals.
Record keeping. Small and medium-sized enterprises are not required to keep records of processing activities – unless the processing is regular or likely to result in a risk to the rights and freedoms of the person whose data is being processed, or includes sensitive categories of data.
A modern toolbox for international data transfers. The GDPR offers various instruments to transfer data outside the EU, including adequacy decisions adopted by the European Commission where the non-EU country offers an adequate level of protection, pre-approved (standard) contractual clauses, binding corporate rules, codes of conduct and certification.

The main Legal basis of the Republic of Moldova

Law No. 195/2024 on Personal Data Protection
Law No. 160/2026 on the protection of personal data processed for the purposes of preventing and combating crime

The main EU regulatory framework

Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR)
Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (EUDPR)
Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data (Law Enforcement Directive) (GDPR-LED)
Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (ePrivacy Directive)
Directive (EU) 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (PNR Directive)
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (Network and Information Security Directive) (NIS2)
European Commission, official website
Wiki: General Data Protection Regulation (GDPR)