Albania. Comprehensive data protection. Act
Law 124/2024Law No. 124/2024 on Personal Data Protection
Partially in force
§1Summary
- Synopsis
Albania's new GDPR- and LED-aligned law replacing the 2008 Act, with extraterritorial scope, DPOs, breach notification and turnover-based fines. Some provisions apply after a two-year phase-in.
- Key themes
- Unique features
Fines up to ALL 2bn or 4% of global turnover; foreign controllers must appoint a local representative and notify the Commissioner; EU/EEA treated as adequate.
- SaaS relevance
Caught where a SaaS provider offers goods/services to or monitors people in Albania; local representative and Commissioner notification required.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Commissioner within 72h; individuals if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy (EU/EEA deemed adequate)/safeguards
- Maximum penalty
- ALL 2,000,000,000 (~€20m) or 4% global turnover (higher)
§3Dates
- Key dates
- Adopted
- In force
- Published Official Gazette No. 9, 2025-01-17; in force 2025-01-31; certain provisions phase in within two years (by ~January 2027); repealed Law No. 9887/2008
§4Text and authority
- Text
- Authoritative text idp.al
- Authority
- Commissioner for the Right to Information and Personal Data Protection (IDP)
§5Where it applies
- Domestic law of
- Albania
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Which articles are subject to the two-year deferral not verified.