Moldova. Comprehensive data protection. Act

Law 195/2024Law No. 195 of 25 July 2024 on Personal Data Protection

In force

Partly verified

Medium confidence. Sources disagree on max fine (another source: MDL 1m or 1%); confirm against statute.

§1Summary

Synopsis

Moldova's new GDPR-transposing law, in force from 23 August 2026, introducing extraterritorial scope, DPOs, breach notification, accountability and turnover-based fines.

Key themes

GDPR alignment
extraterritorial scope
representative
DPO
breach notification
transfers
graduated sanctions

Unique features

Fines phase in gradually over three years, and the NCPDP emphasises corrective orders before fines.

SaaS relevance

SaaS providers offering services to or monitoring people in Moldova must comply and appoint a local representative.

§2Obligations

Extraterritorial: Yes
Breach notification: NCPDP within 72h; individuals if high risk
DPO: Conditional
Cross-border transfers: Adequacy/safeguards (GDPR-style)
Maximum penalty: MDL 2,000,000 or 2% of worldwide annual turnover (higher) per DLA Piper

§3Dates

Key dates

Adopted 25 July 2024
In force 23 August 2026
Two-year preparation period; applies from 2026-08-23; penalties phase in over first three years

§4Text and authority

Text

Authoritative text legis.md

Authority

National Center for Personal Data Protection (NCPDP)

§5Where it applies

Domestic law of: Moldova

§6Sources and verification

Sources consulted

Verification

Medium confidence.

Partly verified

Medium confidence. Sources disagree on max fine (another source: MDL 1m or 1%); confirm against statute.