Personal Data protection for Individuals

Personal data protection for individuals is the right to control how companies and government agencies collect, use and share your personal information.

Law No. 195/2024 on the Protection of Personal Data (in force 23.08.2026) establishes the basic rules regarding the protection of personal data in the Republic of Moldova.

Monitoring of compliance of personal data processing with the requirements of this law is carried out by the National Center for Personal Data Protection of the Republic of Moldova.

This law aims to ensure the protection of the fundamental rights and freedoms of natural persons and, in particular, the right to intimate, family and private life, in relation to the processing of personal data.

Main concepts

Personal data - any information relating to an identified or identifiable natural person (hereinafter - data subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity;
Processing (of personal data) - any operation or set of operations performed on personal data or on sets of personal data, with or without the use of automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Operator (of personal data) - a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of processing are laid down in regulatory acts, the controller or the specific criteria for its designation are laid down in those regulatory acts;
Data processor - a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
Consent - any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Special categories of personal data

Special categories of personal data - genetic data (e.g. a sample of biological material taken from the person concerned), biometric data (e.g. such as facial images or fingerprint data), data revealing the racial or ethnic origin of the person, his or her political, religious or philosophical beliefs, social affiliation, data concerning health or sex life, as well as those relating to criminal convictions, procedural coercive measures or contravention sanctions.

Basic rights of the data subject

The rights of the data subject are detailed in Chapter III of Law 195/2024.

Right to Transparency and Information
Receive clear, understandable, and easily accessible information from the data controller about the processing of your data (purposes, retention periods, recipients).
Right of Access
Request and receive confirmation as to whether data is being processed, as well as access to the personal data itself.
Right to Rectification
Request, without undue delay, the rectification of inaccurate or completion of incomplete personal data.
Right to Erasure ("Right to Be Forgotten")
Request that your data be deleted without undue delay if it is no longer necessary for the purposes for which it was collected or if its lawfulness has been revoked.
Right to Restriction of Processing
Suspend data processing under certain conditions (e.g., contesting the accuracy of the data).
Right to Data Portability
Receive your data in a structured, commonly used format and transmit it to another controller.
Right to object
Object to data processing, including profiling or processing for direct marketing purposes.
Right not to be subject to automated decision-making
Object to decisions based solely on automated processing (including profiling) that produce legal effects.