Personal Data protection for Individuals

Law No. 133/2011 on the Protection of Personal Data establishes the basic rules regarding the protection of personal data in the Republic of Moldova.

Main concepts

• Personal data – any information relating to an identified or identifiable natural person (subject of personal data). An identifiable person is a person who can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity;
• Special categories of personal data – data revealing the racial or ethnic origin of the person, his or her political, religious or philosophical beliefs, social affiliation, data concerning health or sex life, as well as those relating to criminal convictions, procedural coercive measures or contravention sanctions;
• Processing of personal data – any operation or set of operations which is performed on personal data by automated or non-automated means, such as collection, recording, organization, storage, retention, retrieval, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

Rights of the data subject

The rights of the data subject are detailed in Chapter III of Law 133/2011.

• Information of the personal data subject

  (1) Where personal data are collected directly from the data subject, the controller or the person empowered by the controller is obliged to provide the data subject with the following information, unless the data subject already holds the information in question:
  1) the identity of the controller or, where applicable, the person empowered by the controller;
  2) the purpose of the processing of the collected data;
  3) additional information, such as:
  a) the recipients or categories of recipients of the personal data;
  b) the existence of the rights of access to data, intervention in data and opposition, as well as the conditions under which they may be exercised;
  c) whether the answers to the questions with which the data are collected are mandatory or voluntary, as well as the possible consequences of refusing to answer

• Right of access to personal data

  (1) Any subject of personal data shall have the right to obtain from the controller, upon request, without delay and free of charge:
  a) confirmation as to whether or not data concerning him or her are being processed by him, as well as information on the purposes of the processing, the categories of data concerned and the recipients or categories of recipients to whom the data are disclosed;
  b) communication, in an intelligible form and in a manner that does not require additional equipment, of the personal data which are the subject of the processing, as well as any available information on the origin of such data;
  c) information on the principles of operation of the mechanism by which automated processing of data concerning the subject of personal data is carried out;
  d) information on the legal consequences arising from the processing of personal data for the subject of such data;
  e) information on the manner in which the right of intervention in the data is exercised personal data.

• Right to intervention with respect to personal data

  Any subject of personal data has the right to obtain from the operator or the person empowered by him, upon request and free of charge: a) rectification, updating, blocking or deletion of personal data whose processing contravenes this law, in particular due to the incomplete or inaccurate nature of the data; b) notification of third parties to whom the personal data have been disclosed about the operations carried out in accordance with letter a), except in cases where such notification proves to be impossible or involves a disproportionate effort compared to the legitimate interest that could be harmed.

• Right to object of the data subject

  (1) The data subject has the right to object at any time, free of charge, on legitimate grounds relating to his or her particular situation, to the processing of personal data concerning him or her, unless otherwise provided for by law. If the objection is justified, the processing carried out by the controller may no longer concern these data.
  (2) The data subject has the right to object at any time, free of charge and without giving any reasons, to the processing of personal data concerning him or her for the purpose of commercial prospecting. The controller or the person authorised by the controller shall be obliged to inform the data subject of the right to object to such processing before his or her personal data are disclosed to third parties.

• Right not to be affected by a private decision

  (1) Any person shall have the right to obtain the annulment, in whole or in part, of any individual decision which produces legal effects on his or her rights and freedoms and which is based solely on automated processing of personal data intended to evaluate certain aspects of his or her personality, such as professional competence, credibility, conduct and the like.
  (2) The person may be subject to the decision referred to in paragraph (1) where: a) the decision is authorised by a law which lays down measures to safeguard the legitimate interests of the data subject; b) the decision is taken in the context of the conclusion or performance of a contract, provided that the request for the conclusion or performance of the contract submitted by the data subject has been satisfied.

• Access to Justice

  Any person who has suffered damage as a result of unlawful processing of personal data or whose rights and interests guaranteed by this law have been violated has the right to apply to the court for compensation for material and moral damages.

On August 23, 2026, the new Law No. 195/2024 on the protection of personal data will come into force in Moldova.

General Data Protection Regulation (GDPR) - rights over your personal data

In accordance with the General Data Protection Regulation, you have the following rights over your personal data:

• Right to be informed: You can obtain information about the processing of your personal data.
• Right of access: You can obtain access to the personal data held about you.
• Right to rectification: You can ask for incorrect, inaccurate or incomplete personal data to be corrected.
• Right to erasure: You can request that personal data be erased when it’s no longer needed or if processing it is unlawful.
• Right to restriction of processing: You can request the restriction of the processing of your personal data in specific cases.
• Right to data portability: You can receive your personal data in a machine-readable format and send it to another controller.
• Right to object: You can object to the processing of your personal data for marketing purposes or on grounds relating to your particular situation.
• Rights in relation to automated decision-making and profiling: You can request that decisions based on your personal data and that significantly affect you are made by natural persons, not only by computers.

Legal basis of the Republic of Moldova