The new legal framework in the field of personal data protection: it is not about fines, it is about accountability, caution and clear rules

       As of 23 August 2026, the Republic of Moldova applies a new legal framework in the field of personal data protection – Framework Law No. 195/2024 on personal data protection and Law No. 160/2026 on the protection of personal data processed for the purposes of preventing and combating crime.

       The new legislation should not be viewed through the lens of fines. First and foremost, it is about responsibility, precaution and clear rules governing the processing of personal data.

       At the heart of this new legal framework are individuals and their rights.

       The Law is not intended to hinder the activities of organisations and institutions, nor to turn personal data protection into an administrative or financial burden. On the contrary, it establishes a set of rules that helps controllers understand what data they process, why they process it, how long they store it and how they should protect it.

       One of the key elements of the new Law is the principle of accountability. This means that controllers must know their processing activities, assess the associated risks, establish appropriate measures and put in place internal rules and procedures that reflect how personal data are managed.

       Compliance does not begin when a complaint, inspection or security incident occurs. Compliance begins with preventive measures. Law No. 195/2024 was adopted in July 2024 precisely to provide controllers with a two-year transition period, allowing sufficient time to adapt their processes and internal measures to the new legal requirements.

       Precaution is more important than reaction. Therefore, the new Law places a strong emphasis on risk prevention.

       Organisations should collect only the data they need, use them for clearly defined purposes and protect them appropriately. Simple measures, such as strong passwords, restricted access, system updates and employee training, can make a significant contribution to personal data protection.

       The Law does not require every organisation to have expensive solutions in place. What is needed is care, caution and consistently applied rules. Knowing what data you hold, why you use them and how you protect them is an essential first step towards compliance.

       At the same time, data subjects must be informed in a clear and accessible manner about the data being collected, the purposes of the processing, the retention period and the rights to which they are entitled.

       Personal data protection is an investment in trust.

       It is a tool through which an organisation can strengthen its credibility, reduce risks and demonstrate respect for the individuals whose personal data it processes.

       An organisation that manages personal data responsibly is better prepared to deal with potential incidents and can more easily gain the trust of its customers, employees, partners and citizens.

       It is important to understand that Law No. 195/2024 is not about fines.

       The Law establishes a framework of corrective measures and sanctions for breaches of the legislation; however, the finding of a violation does not automatically result in the imposition of a fine. Furthermore, the Law provides for the possibility of issuing recommendations, as well as a gradual mechanism and defined criteria for determining the amount of fines.

       A sanction is a mechanism for ensuring accountability, it is not the purpose of the Law, nor is imposing sanctions the objective or intention of the National Centre for Personal Data Protection. The objective is to ensure that personal data are processed lawfully, transparently, securely and responsibly.

       The Center reaffirms its role as a supervisory authority, as well as an institution that informs, provides guidance and supports society in applying the new rules.

       We make explanatory materials and guidance available to those interested in understanding and correctly applying the Law, regularly organise training sessions and events dedicated to the new legislation and promote an approach based on risk assessment and personal data protection.

       Law No. 195/2024 is not about imposing sanctions or fines.

       It is about responsibility, precaution and clear rules.

       And, above all, it is about people’s trust that their personal data are treated with care. 

       The video can be viewed by accessing the following link: (https://datepersonale.md/videogalerie )