The Public Institution “e-Governance Agency” (AGE) has notified the National Center for Personal Data Protection of the Republic of Moldova (NCPDP) of a personal data breach identified in certain government electronic services.

       According to the preliminary information reported by the AGE, following technical investigations conducted by the AGE in cooperation with the Public Institution “Information Technology and Cyber Security Service” (STISC) and the Agency for Cyber Security (ASC), approximately one million attempts to unlawfully extract personal data sets and around 750,000 data sets potentially extracted without authorization have been identified. These figures are preliminary and may be updated following further verification and the elimination of any potential overlaps.

       According to the notification submitted, as well as information publicly disclosed by the AGE, the potentially affected information includes the following categories of personal data:

• Identification data: first name, last name, personal identification number (IDNP), date and place of birth, and photograph;
• Family-related data: information concerning parents and children;
• Health and social protection data: insured person status, family doctor, social benefits, pensions and disability status;
• Property and economic activity data: driving licence, owned vehicles, and companies owned or managed;
• Financial and tax data: IBANs, tax liabilities and debts, and payment history through the government electronic payment service MPay.

       This list reflects the preliminary assessment of the potentially affected information and does not mean that all categories of personal data were extracted for each individual or through each of the services concerned.

       The unauthorized disclosure of personal data may expose data subjects to certain risks (such as identity theft, financial fraud, social engineering attempts and other forms of abuse). However, the occurrence of a personal data breach does not automatically mean that the affected data will be used for fraudulent purposes. The assessment of risks must be based on confirmed information and the findings of the competent authorities.

       Law No. 195/2024 on personal data protection establishes that personal data must be processed lawfully, fairly and transparently, for specified and legitimate purposes, and must be limited to what is necessary. Furthermore, controllers are required to ensure the accuracy of personal data and their security, including protection against unauthorized access and processing, through appropriate technical and organizational measures.

       In the event of a personal data breach, the controller is required to notify the Center without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The AGE has notified the Center of the reported incidents.

       Under the law, where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller must communicate the breach to the data subjects without undue delay. Where individual communication would involve disproportionate effort, public communication or another equally effective measure may be used. At this stage, it has been established that the AGE has taken steps to inform citizens through public communication channels.

       It should be noted that the Center does not manage databases or filing systems and is not empowered to ensure the security and confidentiality of personal data processed within such databases or systems. Under the applicable legal provisions, controllers operating databases or filing systems are required and responsible for implementing appropriate technical and organizational measures to ensure an adequate level of security.

       Within the limits of its legal powers, the Center supervises, monitors and investigates compliance with personal data protection legislation. In this case, the circumstances identified and the measures taken by the Center will be communicated publicly.

       To reduce the risk of fraud or misuse of personal data, the Center recommends that individuals:

• Remain vigilant when receiving suspicious phone calls, text messages or emails.
• Do not disclose passwords, authentication codes or other confidential information.
• Do not click on unsolicited links or authorize payments at the request of unknown individuals.
• Verify unusual requests by contacting the relevant institution or bank directly through official communication channels.
• Verify, using a previously known phone number, any message from someone close claiming to have changed their phone number or account.
• Do not react impulsively to alarming messages involving family members or urgent situations. Always verify the information first.
• Report any suspected unauthorized use of personal data or attempted fraud to the police, bank, the Center or the competent cybersecurity authorities, as appropriate.

       The Center reiterates the importance of protecting personal data and using electronic services with caution. In this regard, responsibility for the security of processed personal data rests with controllers, who must adopt appropriate measures to prevent unauthorized access and safeguard the rights of data subjects.

       Individuals who believe they may have been affected by the personal data breach in the context of the cyberattack targeting public digital services are entitled to contact the relevant controller for clarification and, where appropriate, to exercise their rights guaranteed under the Law No. 195/2024 on personal data protection.

       In view of the increasingly frequent reports of risks associated with the use of artificial intelligence (AI) highlighted at international level, the National Center for Personal Data Protection of the Republic of Moldova (NCPDP) draws attention to the need to safeguard privacy and personal data in the context of the use of these technologies.

       Although AI-based tools may facilitate everyday and professional activities, their use without appropriate precautionary measures may pose risks to information security and individuals’ rights. In this regard, the NCPDP issues the following recommendations for controllers and individuals.

       The NCPDP urges controllers to assess the risks associated with the implementation and use of AI systems, establish clear internal rules governing their use, and ensure that staff are adequately informed and trained.

       In the workplace, where employees use chatbots and digital assistants, such as ChatGPT or Copilot, to draft documents, respond to customer requests or summarize large volumes of files, clear restrictions must be established regarding the input of personal data or confidential and sensitive information into these tools, as such actions may expose organizations and data subjects to significant risks.

       Depending on the terms of use and the settings applied, personal data entered into such tools may be transmitted to the providers of these services and stored on their servers. In many cases, users are unaware of how this information is stored or used, while the individuals to whom the data relate may be unaware of or uninformed about such processing.

       The use of AI tools without clear rules or without complying with legal requirements may lead to the unauthorized disclosure of personal data or other forms of unlawful processing. Depending on the circumstances, such an incident may constitute a personal data breach.

       To prevent such situations, controllers must clearly establish whether and under what conditions staff may use these tools, as well as which categories of information may be permitted or prohibited from being entered into them. It is also important to review the terms of use of these services and the safeguards provided by their providers, including those relating to data storage, retention and deletion.

       The use of AI tools must respect the right to personal data protection in accordance with the applicable legal framework, including the principles of lawfulness, transparency, data minimisation and security.

       Furthermore, the NCPDP recommends that individuals exercise the utmost caution when using AI tools and pay particular attention to the information they provide through these tools. The NCPDP draws attention to the following aspects:

• Protect personal and confidential information. Do not enter personal data from identity documents, medical or banking information, or other sensitive data into chatbots and other AI applications without first reviewing the terms of use and the safeguards provided for their protection.
• Review the terms of use of applications. Pay attention to the permissions granted and to how the information entered may be collected, stored, retained or reused.
• Exercise caution when dealing with suspicious messages and requests. Do not disclose personal data before verifying the identity of the person making the request through official channels.
• Verify the authenticity of information received. Messages, phone calls, images and audio or video recordings may be created or manipulated using AI, even if they appear to originate from people you know or representatives of institutions.
• Verify AI-generated information before using or sharing it. Such information may contain errors or misleading content. Cross-check the results against reliable sources, particularly when they concern specific individuals or situations.

       The NCPDP reiterates that the development and use of AI-based technologies must not undermine the right to privacy or the right to personal data protection. Data controllers must ensure compliance with legal requirements in the course of their activities, while individuals are encouraged to exercise vigilance when providing information through these technologies.

       Awareness, prevention and respect for the rights of every individual are essential to reducing the risks associated with the use of artificial intelligence.

       On 27 October 2026, the National Center for Personal Data Protection of the Republic of Moldova (NCPDP) organized an information session on personal data protection for employees of the Chamber of Commerce and Industry of the Republic of Moldova (CCI).

       The session aimed to strengthen employees’ knowledge and understanding of the new legislative provisions that entered into force on 23 August 2026, namely Law No. 195/2024 on personal data protection and Law No. 160/2026 on the protection of personal data processed for the purposes of preventing and combating crime.

       During the information session, several important topics were addressed, including: the principles relating to the processing of personal data; the rights of data subjects; data protection impact assessments (DPIA); prior consultation; the data protection officer (DPO); cross-border transfers of personal data; as well as the importance of ensuring an appropriate level of information security and confidentiality.

       Participants also had the opportunity to discuss practical issues related to the application of the legal provisions in their day-to-day activities.

       The training session was held at the CCI premises in a hybrid format, with the participation of 79 employees.

       On 26 October 2026, the National Center for Personal Data Protection of the Republic of Moldova (NCPDP) organized a training session on personal data protection for representatives of the National Institute of Justice (INJ).

       The training session aimed to familiarize INJ employees with the new legal provisions in the field of personal data protection and raise their awareness of the applicable requirements.

       During the training, several important topics were addressed, including: the principles relating to the processing of personal data; the legal bases for processing; the rights of data subjects and the obligations of controllers; data protection impact assessments; transfers of personal data to third parties; the confidentiality and security of personal data; as well as the management of personal data breaches.

       In addition, practical aspects specific to the INJ’s activities were examined, with a particular focus on compliance with personal data protection requirements in the performance of its institutional duties.

       The event was held at the premises of the INJ and attended by 20 employees of the institution.

       Such training activities contribute to strengthening the institutional culture of personal data protection and promoting the proper application of legal provisions in the activities of public and private authorities.

       On 21 October 2026, the National Center for Personal Data Protection of the Republic of Moldova (NCPDP) organized a training session on personal data protection for employees of the Ministry of Education and Research of the Republic of Moldova (MEC).

       The purpose of the training was to strengthen and develop the professional skills of MEC employees in the field of personal data protection through a practical, hands-on approach tailored to the specific activities carried out in the education and research sectors.

       The training focused on strengthening participants’ understanding of the fundamental principles governing the lawful and secure processing of personal data, the responsibilities of the MEC as a controller, and the need to ensure respect for data subjects’ rights.

       Furthermore, the training addressed the prevention of risks associated with the improper collection, use, disclosure and storage of personal data belonging to schood and university students, teaching staff, researchers and employees, with a view to ensuring the confidentiality, integrity and security of information processed in the performance of official duties.

       Following the training, MEC employees enhanced their knowledge of personal data protection and their respective responsibilities in processing such data, with a view to ensuring compliance with the applicable legislation and preventing cases of improper use or disclosure of personal data.

       The event was held at the premises of the MEC and attended by 52 employees.

       Today, 28 October 2026, the National Center for Personal Data Protection of the Republic of Moldova (NCPDP) organized a training session on personal data protection for employees of the National Single Emergency Line Service 112.

       The training aimed to strengthen the institution’s staff knowledge by ensuring the consistent and correct application of the new legal provisions, as well as preventing potential non-compliance in the processing of personal data.

       During the event, the main obligations of controllers, the fundamental principles relating to the processing of personal data, and the responsibilities of public institutions in safeguarding the rights of data subjects were presented. Furthermore, key aspects concerning the implementation of appropriate technical and organizational measures to protect personal data, risk assessment, the management of security incidents, and the documentation of processing activities were addressed.

       For employees of the 112 Service, the training provided an opportunity to clarify practical aspects related to handling emergency calls involving sensitive data, as well as to identify effective solutions for ensuring confidentiality in their day-to-day activities.

       At the end of the training session, participants had the opportunity to ask questions to the NCPDP trainer and discuss specific situations arising in the work of the emergency service.

       The event was organized for 28 representatives of the 112 Service.

       In light of the numerous requests received from citizens concerned about the possible impact on their personal data following the cyberattack on public digital services, we remind them that they have the right to obtain information and clarification regarding how their data has been affected and, where appropriate, to exercise the rights guaranteed under Law No. 195/2024 on personal data protection.

       The National Center for Personal Data Protection of the Republic of Moldova (hereinafter referred to as the Center) reiterates that the authorities take into account citizens’ concerns regarding personal data protection and access to public services. At the same time, determining the impact of the incident requires technical verifications and confirmation of the findings by the institutions involved, each acting within the scope of its respective powers. In this context, citizens will be informed about the restoration of services, the security measures taken, the confirmed results of the verifications, as well as the manner in which individuals whose data have been affected will be informed.

       Individuals who have noticed suspicious access to their personal data or who wish to obtain clarification regarding a possible impact on their data may contact the institution responsible for administering government electronic services – the e-Government Agency (AGE) – by submitting an electronically signed petition to office@egov.md or a paper petition bearing a handwritten signature. In this regard, individuals may request information concerning the reported access events, the institutions that carried them out, the purposes and legal bases indicated by those institutions, as well as any potential consequences of the incident for their personal data.

       Data subjects are advised to retain any notifications received, relevant screenshots indicating the date and time of the access events, as well as responses from the authorities or controllers contacted. This information may serve as evidence and may, where appropriate, be attached to a complaint submitted to the Center or to other proceedings aimed at safeguarding their rights and legitimate interests.

       We reiterate that the Center does not manage databases or filing systems and has no powers to administer them or to directly ensure the security and confidentiality of personal data stored therein.

       Under the law, responsibility for implementing appropriate technical and organizational measures to ensure an adequate level of data security belongs to data controllers. They are required to demonstrate that the processing activities they carry out comply with the provisions of Law No. 195/2024.

       Within the limits of its statutory powers, the Center supervises and monitors compliance with personal data protection legislation and investigates reported violations.

       In this regard, the Center has initiated an investigation to clarify the circumstances surrounding the incident and verify whether the entities involved in managing the information systems concerned have complied with their legal obligations. The findings established and the measures ordered by the Center will be communicated publicly.

       With regard to complaints submitted to the Center in connection with this incident, it should be noted that their examination and the formulation of a position on the merits of the issues raised will only be possible following the verification of the circumstances and the completion of the relevant investigation into the incident, resulting in a reasoned decision in each case concerning the compliance of the personal data processing operations.

       A complaint addressed to the Center may be submitted using the standard complaint form of the NCPDP, available on the website www.datepersonale.md under the section dedicated to complaints, or in paper form, bearing a handwritten signature. The use of the form is not mandatory; however, the complaint must meet the requirements set out in Article 79 of Law No. 195/2024. Where submitted electronically, the complaint must be electronically signed in accordance with the law, together with any documents and evidence that the complainant considers relevant in support of their complaint.

       It is important to contact the controller first in order to clarify the situation, as only the controller holds the information regarding the processing operations in which the data was accessed and the technical and organisational measures applied, and is therefore in a position to verify whether or not the individual’s data was affected by the incident. The information requested from the controller and the response received will be included in the complaint submitted to the Centre, helping to clarify the circumstances of the complaint.

       The Center will examine the submissions within the limits of its statutory powers, with a view to ensuring respect for the fundamental rights and freedoms of natural persons with regard to the processing of personal data.

       Furthermore, in relation to the matters brought to the Center’s attention, it should be noted that, pursuant to Article 74 of Law No. 195/2024, individuals who consider that their rights have been infringed as a result of the processing of personal data may bring an action before a court against the controller or the processor. This legal remedy is distinct from the procedure for examining complaints by the Center.

       The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine of 300,000 euros imposed by the French Data Protection Authority (CNIL) on EXTIA for infringements of Articles 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and 17 (Right to erasure (‘right to be forgotten’) of GDPR.

       In 2024, the CNIL received several complaints from former employees and candidates of EXTIA, a company specialising in information technology and engineering, concerning difficulties encountered in exercising their right to the erasure of personal data. In this context, and as part of the coordinated action on the right to erasure launched in 2025 at the initiative of the European Data Protection Board, the CNIL carried out an inspection of EXTIA in April 2025, identifying the lack of transparency and failure to respect the data subjects’ rights.

       Of the 265 erasure requests received by the company in 2024, most of which were submitted by candidades and, in some cases, former employees, more than three-quarters were not handled appropriately. Specifically, 12 requests were not examined, while 166 individuals were not informed of the action taken in response to their requests. Another 27 individuals were notified only after the statutory one-month deadline had expired, with delays extending to several months in some cases.

       In this context, the CNIL imposed an administrative fine of 300,000 euros on EXTIA, taking into account the seriousness of the infringements affecting data subjects’ rights, the number of individuals concerned and the fact that EXTIA had previously been reminded on two occasions of its obligations regarding personal data protection.

       The NCPDP, as the national supervisory authority for the processing of personal data, emphasises that controllers are responsible for ensuring respect for data subjects’ rights and for examining and responding to their requests within the time limits and under the conditions established by the applicable personal data protection legislation.

       The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the final decision adopted by the Irish Data Protection Commission (DPC) following an inquiry into the processing of personal data contained in paper records stored and retained in the external storage facilities of Ireland’s Health Service Executive (HSE).

       The inquiry was initiated on 24 May 2024 following two personal data breaches notified to the DPC in October and November 2023. In both cases, unauthorised individuals gained access to paper records kept in HSE storage facilities. The unauthorised access and the conditions in which the records were stored were also highlighted in videos published on social media.

       Following the inquiry, the DPC identified failings concerning the physical conditions of the facilities used by the HSE to store documents, as well as the measures implemented to ensure the integrity and security of documents containing personal data.

       In this context, the DPC imposed administrative fines totalling 645,000 euro on the HSE for infringements of Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject) of GDPR. The DPC also issued a reprimand and ordered a series of corrective measures to ensure the HSE’s compliance with personal data protection legislation.

       The NCPDP, as the national supervisory authority for the processing of personal data, emphasises the responsibility of controllers to implement appropriate technical and organisational measures to protect personal data throughout the entire storage period, including when records are archived or stored in external facilities.

       Today, 16 October 2026, the National Center for Personal Data Protection (NCPDP) continued to organise training sessions on personal data protection for representatives of the National Office of Social Insurance (CNAS). The session forms part of the Training Plan signed by the heads of the two institutions on 8 July and aims to familiarise CNAS employees with the new requirements established by Law No. 195/2024 on personal data protection.

       The training covered and examined the following topics: the concept of personal data; the concept of personal data processing; the principles relating to the processing of personal data; the processing of special categories of personal data; data subjects’ rights; data storage periods; records of processing activities; the role of the data protection officer (DPO); data security and confidentiality measures; notification of personal data breaches; communication of information to data subjects; data protection impact assessment; the disclosure of information containing personal data to third parties, etc.

       Participants also had the opportunity to clarify specific issues related to the CNAS’ area of activity, particularly the management of security incidents and employees’ responsibilities in the processing of personal data.

       The event was held online and attended by approximately 65 CNAS employees.