On 30 July 2026, the Parliament of the Republic of Moldova adopted, at second reading, the draft law on the protection of personal data processed for the purpose of preventing and combating crime, a legislative act transposing into national law Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA

       The adoption of this draft law represents an important step in the process of harmonising the legislation of the Republic of Moldova with European Union standards in the field of personal data protection and complements the regulatory framework established by Law No. 195/2024 on personal data protection, which is due to enter into force on 23 August 2026.

       The new legislation lays down specific rules on how the competent authorities – criminal investigation bodies, public prosecutors’ offices, courts and other authorised institutions – process personal data for the purposes of preventing or combating crime, investigating criminal offences, conducting criminal proceedings or enforcing sentences and security measures.

       In this regard, the law sets out clear obligations for the competent authorities concerning the lawfulness of processing, the restriction of data use to the purposes provided for by law, compliance with the principle of data minimisation, and the implementation of the technical and organisational measures necessary to ensure the security and confidentiality of such data.

       The draft was reviewed by representatives of the European Commission, who gave a positive opinion on the document and noted that, together with Law No. 195/2024 on personal data protection, it contributes to the consolidation of a modern regulatory framework aligned with European Union standards.

       The adoption of this law reaffirms the Republic of Moldova’s commitment to establishing an effective system for personal data protection in the field of law enforcement, in accordance with European standards and the objectives of the process of integration into the European Union.

       On July 29, 2026, the National Center for Personal Data Protection (NCPDP) organized a training session for representatives of the e-Governance Agency, with the aim of strengthening their professional capabilities regarding the application of personal data protection legislation.

       The event is part of the training activities conducted by the NCPDP for public authorities, designed to support the effective implementation of the provisions of Law No. 195/2024 on personal data protection and the development of institutional practices compliant with European standards in this field.

       The training covered the main obligations of controllers, the principles that must be observed in the data processing procedure, and the responsibilities of public institutions in ensuring the rights of data subjects. Additionally, the session addressed issues related to the implementation of appropriate technical and organizational measures for data protection, risk assessment, security incident management and the documentation of processing activities.

       The principles of “privacy by design” and “privacy by default” are particularly relevant to the e-Governance Agency. These principles involve integrating data protection measures right from the platform design stage and limiting access to data to authorized individuals only, as well as applying, by default, settings that provide the highest level of personal data protection.

       At the same time, participants analyzed examples and practical scenarios from their professional experience, addressing the main risks posed by the improper processing of personal data, as well as the measures needed to prevent and mitigate them. The interactive discussions provided an opportunity to clarify practical aspects regarding compliance with the principles of lawfulness, necessity and proportionality in the personal data processing procedure.

       By organizing such activities, the NCPDP continues to promote the development of professional competencies among public authorities and to support the uniform application of legislation in the field of personal data protection, thereby contributing to the consolidation of an institutional framework based on accountability, compliance and best practices.

       Approximately 70 representatives of the e-Governance Agency were trained during the event.

       Aware of the need to strengthen professional knowledge and skills in the field of personal data protection, as well as the importance of the uniform application of legal provisions in the activity of public authorities, on July 8, 2026, the National Center for Personal Data Protection (NCPDP), represented by the Director Victoria MUNTEAN and the National Social Insurance House (NSIH), represented by Deputy General Director Tatiana POPA, they signed the Training Plan in the field of personal data protection intended for employees within the structural subdivisions of NSIH.

       The main purpose of the Training Plan is to develop the professional skills of NSIH employees in the field of personal data protection, by deepening knowledge regarding data processing principles, the rights of data subjects and the legal obligations of controllers. At the same time, the trainings aim to strengthen the institutional capacity for correct and uniform application of legislation in the current activity, contributing to ensuring a high level of compliance with legal requirements.

       The training plan was developed and approved by mutual agreement and provides for the holding of training sessions within the structural subdivisions of NSIH, in a format adapted to the needs of the institution, emphasizing the practical aspects of the application of legislation on personal data protection.

       NCPDP attaches particular importance to strengthening inter-institutional collaboration, considering that the development of an organizational culture based on respect for the right to personal data protection is an essential element for increasing the level of compliance and for ensuring a responsible processing of personal data in the public sector.

       The signing of this Training Plan is part of the series of activities organized on the occasion of the 18th anniversary of the NCPDP, reaffirming the institution’s commitment to promote education in the field of data protection, to strengthen cooperation with public authorities and to contribute to the development of an institutional framework based on responsibility, transparency and respect for the fundamental rights of natural persons.

       On July 10, 2026, the National Center for Personal Data Protection (NCPDP) organized the National Conference „The new era of data protection in the Republic of Moldova: Implementation of GDPR”, an event dedicated to the private sector and the training of controllers for the application of the new regulatory framework in the field of personal data protection.

       The event took place at a defining moment for the European path of the Republic of Moldova, in the context of Law no. 195/2024 on personal data protection entry into force on August 23, 2026, a normative act that transposes into national legislation the General Data Protection Regulation (GDPR). The new law establishes a modern legal framework, applicable to both the public and private sectors, strengthening the protection of fundamental rights and contributing to the development of a digital economy based on trust, responsibility and transparency.

       At the opening of the conference, the Director of the NCPDP, Victoria MUNTEAN, highlighted the fact that the implementation of the new legislation represents one of the most important reforms in the process of harmonizing the Republic of Moldova legislation with the EU acquis and an essential step in strengthening a modern personal data protection framework, emphasizing that „personal data protection is no longer seen only as a legal obligation, but as an essential element of corporate governance, confidence and market competitiveness. Compliance with GDPR standards is a competitive advantage, contributing to strengthening the trust of customers and partners, facilitating cooperation with entities from the EU member states and creating favorable premises for investment and business development. The implementation of the new law must be seen not only as an obligation, but as an investment in the sustainable development of each organization.”

       The purpose of the event was to support the private sector in the preparation process for the application of Law no. 195/2024, by strengthening the level of compliance with the new legal obligations, clarifying the responsibilities of controllers, processors and data protection officers, promoting good European practices and facilitating the experience exchange with supervisory authorities experts of the EU member states.

       The conference agenda included a plenary session and four thematic panels dedicated to the main practical aspects of GDPR implementation. Within them, topics were addressed regarding the construction of the future of data protection in the Republic of Moldova, the obligations established by the new law, the exercise of the rights of data subjects, compliance mechanisms, the role of codes of conduct and certification in the field of data protection, as well as the mechanisms for investigation and legislation application in the practice of European supervisory authorities.

       During the conference, the representative of the NCPDP presented the main obligations introduced by Law no. 195/2024 on personal data protection, the calendar of its implementation and the expectations of the supervisory authority regarding the compliance of controllers and processors.

       The debates benefited from the contributions of renowned experts from the Council of Europe, the European Center for Digital Rights (NOYB), as well as the data protection authorities of Latvia, Malta, Italy and Slovenia, who presented the experience of the Member States in the GDPR application, examples of good practices and reliable solutions for the effective new legal requirements implementation.

       The conference was held in the context of marking 18 years of activity of the NCPDP, on which occasion the institution’s commitment to continue strengthening the national data protection system and to support conrollers through training activities, guidance and cooperation.

       The event highlighted the fact that the effective implementation of the new legal framework on data protection is an essential condition for the development of a competitive business sector, strengthening trust in the digital economy and facilitating cooperation with partners in the European Union.

       NCPDP reaffirms its commitment to continue the dialogue with the private sector, public authorities and international partners in order to ensure a coherent and effective application of Law no. 195/2024 on personal data protection, promoting a culture of compliance based on responsibility, transparency and respect for fundamental rights.

       The event was organized by the NCPDP, in partnership with the European Union Delegation in the Republic of Moldova, as well as with the project „Moldova is Europe – Support for integration into the EU”, financed by the European Union and the Kingdom of Denmark.

       NCPDP thanks all national and international experts, partners and participants for contributing to the success of the conference and for being involved in promoting a modern, efficient and European framework for personal data protection in the Republic of Moldova.

       On July 10, the National Center for Personal Data Protection (NCPDP) marks 18 years of activity, during which the institution has constantly strengthened its role as a national supervisory authority in the field of personal data protection and guarantor of respect for the fundamental right to private life.

       During these 18 years, the field of data protection experienced a significant evolution, determined by accelerated digital transformations, the exponential increase in the volume of processed data and the need to ensure a coherent and uniform application of the normative framework. In this context, the NCPDP has contributed to strengthening a culture of compliance and accountability in data protection, including by promoting the necessary balance between the right to the personal data protection, the right of access to information and freedom of expression.

       In exercising its legal mandate, as an autonomous, independent and impartial public authority, the NCPDP reaffirms its mission to ensure the protection of the fundamental rights and freedoms of natural persons, in particular with regard to the processing of personal data and cross-border data transfers.

       „In a context characterized by the acceleration of digitization processes and the widespread use of personal data in all sectors, data protection is becoming a structural element of trust and the democratic functioning of society. Respect for private life is a fundamental principle, with the value of legal and institutional guarantee. The entry into force, on 23.08.2026, of Law no. 195/2024 on personal data protection constitutes a major landmark in the consolidation of the national normative framework and in its alignment with European standards in the matter. The new legal framework strengthens data protection guarantees and contributes to strengthening trust in relations between individuals, public authorities and the private sector. In this sense, the NCPDP reaffirms its commitment to ensure the effective implementation and application of the new legal provisions, as well as to guarantee respect for the fundamental rights of the persons concerned, in a digital environment that is constantly transforming. The personal data protection remains an essential component of the rule of law and a democratic society, based on respect for private life and human dignity”, said Ms. Victoria Muntean, director of NCPDP.

The main achievements in the 18 years of activity

       During its 18 years of activity, the NCPDP has accumulated valuable experience and achieved significant progress, such as:

Harmonization of the national legislative framework

       One of the most important recent results of the institutional activity is the process of harmonizing the national legislative framework in the field of personal data protection, carried out in order to align it with the standards of the European Union and the Council of Europe and to ensure a high and effective level of protection of fundamental rights.

       In this context, a major progress, with a reference value for the development of the national data protection system, is the adoption of Law no. 195/2024 on personal data protection. This normative act transposes the provisions of Regulation (EU) 2016/679 (GDPR) and marks a decisive stage in the modernization and consolidation of the national legal framework in the field.

       The law establishes a consolidated legal regime for data protection, strengthens guarantees for data subjects and creates the conditions for a more coherent and effective application of European data protection principles. Its entry into force, on August 23, represents a reference moment in the evolution of the national personal data protection system and confirms the firm commitment of the Republic of Moldova to align with European standards.

       At the same time, by Law 36/20.03.2026 and publication in the Official Gazette of the Republic of Moldova, the Protocol amending the Convention for the protection of individuals regarding the automated processing of personal data was ratified.

       The purpose of this Protocol is to modernize the international framework in the field of personal data protection, in order to ensure a high level of protection of the fundamental rights and freedoms of natural persons, especially the right to private life, in the context of technological developments and the globalization of data flows.

       Likewise, on 07/09/2026, the Parliament of the Republic of Moldova adopted in the first reading the draft law on personal data protection processed for the purpose of preventing and combating crimes.

       This normative act transposes Directive (EU) 2016/680 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, in national legislation and establishes specific rules for competent authorities (such as criminal investigation bodies and courts) that manage data in prevention, investigation or prosecution activities.

Monitoring and ensuring compliance

       NCPDP continuously exercises its legal mandate of supervision and control over the way in which public and private sector controllers process personal data, with the aim of ensuring compliance with the applicable normative framework and the effective protection of the fundamental rights and freedoms of data subjects.

       In exercising these powers, the authority uses specific supervisory and control tools, including: examining complaints submitted by data subjects; initiating and conducting controls; investigating reports received, including from public authorities.

       The surveillance activity reveals a constant trend of increasing the number of complaint addressed to the authority, which reflects both an increased level of awareness of rights by the persons concerned and the intensification of data processing in the public and private environment.

       From the perspective of content, the most frequent situations reported concern:

• Processing of personal data by means of video/audio surveillance systems;
• Processing of personal data in the absence of the consent of the data subject and/or the legal basis, including the processing of personal data from state information resources;
• Processing of personal data by disclosure on social networks;
• Realization of the rights of personal data subjects (information, access, intervention, opposition), etc.

Outreach activities and training

       NCPDP has made significant progress in strengthening activities to promote personal data protection among the general public, by intensifying information, education and awareness actions at the national level.

       The institution continued the information and awareness campaign of the school community, organized street actions with different themes, as well as an extensive number of training sessions with physical presence, online and hybrid, addressed to a record number of entities.

       In this context, NCPDP also carried out the information campaign „Protect personal data: Be vigilant in the face of telephone fraud”, with the objective of informing citizens about the risks associated with telephone fraud and attempts to fraudulently obtain personal data. Activities included the development and distribution of information leaflets to the general public, informing citizens of the risks associated with telephone fraud, the main operating methods used by criminals and the necessary precautions to prevent unauthorized disclosure of personal data. The information materials provided practical recommendations on verifying the identity of interlocutors, avoiding the provision of sensitive information by telephone and using the official communication channels of public and private institutions.

National and international cooperation

       The dimension of national and international cooperation has been constantly strengthened, reflecting the commitment of the NCPDP to align with international standards and good practices in the field of personal data protection.

       In this sense, the institution actively participated in the plenary meetings of the European Data Protection Board (EDPB), as well as in the activities carried out under the auspices of the Council of Europe, contributing to the exchange of experience and the development of a convergent approach at European level in the field of data protection.

       The status of the Republic of Moldova as an observer within the EDPB represents an essential element of the process of approaching European Union standards, facilitating better integration in cooperation and coordination mechanisms at the European level.

       At the same time, during the reference period, cooperation relations were strengthened by signing 21 agreements at the national level and 10 international agreements with relevant authorities in Europe, contributing to the intensification of the exchange of best practices, to the strengthening of institutional capacities and to ensuring a more effective and coordinated intervention in the field of personal data protection.

Vision for the future

       NCPDP reconfirms its commitment to ensure a fair and proportionate balance between the protection of personal data and the other fundamental rights and freedoms guaranteed by the Constitution of the Republic of Moldova, in the context of technological developments and the intensification of digitization processes.

       In this sense, the institution will continue to strengthen its capacity for supervision, control and intervention, in order to ensure effective compliance with the normative framework and the protection of the rights of data subjects.

       At the same time, NCPDP will actively support controllers in the legislative compliance process, through guidance activities, training and promotion of good practices, thus contributing to increasing the general level of responsibility in the processing of personal data.

       The institution will also continue to promote a solid data protection culture based on transparency, accountability and respect for human dignity as essential elements of a modern administration and a democratic society.

       The protection of personal data is not only a legal obligation, but an essential condition for the functioning of a state of law and for maintaining trust in the relationship between citizens, public authorities and the private sector.

       On June 29, 2026, the National Center for Personal Data Protection (NCPDP) participated in a workshop titled “Digital Safety of Young People in the Context of European Standards and the Process of Accession to the European Union,” organized by the National Youth Council of Moldova (NYCM).

       The event brought together representatives of civil society, experts and national public authorities, with the aim of facilitating dialogue on the analysis of the legislative, institutional and policy framework in the field of digital safety for young people and women, in relation to relevant European standards, including the General Data Protection Regulation (GDPR), the Digital Services Act (DSA), and the Artificial Intelligence Act (AI Act).

       The discussions addressed topics related to the protection of minors and women in the digital environment, the harmonization of national legislation with the EU acquis, the strengthening of institutional protection mechanisms, as well as the identification of solutions and recommendations for the development of public policies compatible with European Union standards.

       The NCPDP representative participated as a speaker in the panel discussion titled “Regulatory and Supervisory Institutions: Institutional Capacity and Mechanisms for Strengthening Competencies,” intended for authorities with regulatory and supervisory responsibilities.

       During the panel, he delivered a presentation on the role of the supervisory authority in ensuring compliance with the regulatory framework for the personal data protection in the digital environment, highlighting the importance of consistently applying the principles of legality, transparency and security in the data processing process, and emphasizing that these are fundamental elements for maintaining trust in the digital ecosystem and for protecting the rights of data subjects.

       At the same time, the need to strengthen the institutional capacities of supervisory authorities was emphasized, including through the development of monitoring tools, increasing the efficiency of control mechanisms and intensifying inter-institutional cooperation. In the context of the rapid development of digital services and the growing volume of processed data, the essential role of a proactive approach in preventing risks and ensuring compliance with applicable legal provisions was underscored.

       By participating in this workshop, the NCPDP reaffirms its commitment to promoting respect for the right to personal data protection and to developing public policies aligned with European Union standards in the digital sphere.

       On June 17, 2026, the National Center for Personal Data Protection (NCPDP) participated in an inter-institutional working meeting organized by the Electoral Council of Telenești District Electoral Constituency No. 34, attended by representatives of local public authorities and the district’s deconcentrated and decentralized services.

       The event took place as part of the post-election information, cooperation and analysis activities carried out by the Central Election Commission in collaboration with the public authorities involved in organizing and conducting electoral processes. The purpose of the meeting was to identify any difficulties encountered during the electoral processes, analyze existing practices and formulate proposals aimed at improving the regulatory framework and electoral procedures.

       One of the central topics on the agenda concerned the compilation and updating of voter rolls in compliance with personal data protection requirements, as well as issues related to the processing of voter data by registrars of the State Voter Registry and election officials in the performance of their duties.

       During the session, the NCPDP representative presented the main provisions of national legislation on the protection of personal data applicable to electoral processes. At the same time, practical aspects were addressed regarding ensuring the legality of data processing, compliance with the principles of confidentiality and security, as well as the measures necessary to prevent unauthorized access to the information contained in the voter rolls.

       Participants had the opportunity to ask questions and discuss practical situations encountered in their work, with emphasis placed on the importance of uniformly applying personal data protection rules at all stages of the electoral process. Furthermore, best practices were promoted to help strengthen citizens’ trust in how the competent authorities manage their personal data.

       The event was attended by 55 representatives of local public authorities, decentralized and deconcentrated services, as well as other stakeholders involved in electoral processes at the local level.

       By participating in such activities, the NCPDP reaffirms its commitment to supporting public authorities in the proper application of personal data protection legislation and to contributing to the strengthening of an institutional culture based on respect for individuals’ fundamental rights and freedoms.

       On July 3, 2026, the National Center for Personal Data Protection (NCPDP) conducted a training course for employees of the Police Inspectorate in Strășeni, as part of the implementation of the 2026 Training Plan for the subdivisions of the General Police Inspectorate, approved by the head of the NCPDP and the General Police Inspectorate on January 28 of this year.

       This activity is part of the joint efforts undertaken by the two institutions to strengthen the professional capacities of police employees in the field of personal data protection and to promote the correct and uniform application of legislation in their day-to-day activities.

       The objective of the training was to develop participants’ practical skills regarding the lawful processing of personal data in the performance of their official duties, as well as to foster an institutional culture based on accountability, integrity and respect for individuals’ fundamental rights.

       The session addressed key issues regarding:

• the basic principles of personal data processing;
• the legal grounds for data processing in the activities of law enforcement agencies;
• the rights of data subjects and the obligations of controllers;
• the technical and organizational measures necessary to ensure data security;
• handling requests for the provision of personal data;
• analyzing practical cases and identifying solutions that comply with legal provisions.

       At the same time, participants discussed specific situations encountered in their professional activities, highlighting the risks associated with improper data processing and ways to prevent them. The interactive dialogue helped clarify practical aspects regarding the application of the principles of lawfulness, necessity and proportionality in the processing of personal data.

       Among the main conclusions of the training are the need to integrate the principle of data protection into the day-to-day activities of PI Strășeni employees, the implementation of appropriate security measures to protect the information handled and the reinforcement of each employee’s responsibility to respect the rights of data subjects.

       The NCPDP will continue to implement the training program for the subdivisions of the General Police Inspectorate, contributing to the development of institutional practices that comply with national and European standards in the field of personal data protection.

       By strengthening inter-institutional cooperation and promoting ongoing training, the NCPDP aims to increase compliance with relevant legislation and strengthen citizens’ trust in how public authorities process and protect their personal data.

       During the event, 52 representatives of the Strășeni Police Inspectorate were trained.

       On June 18, 2026, the National Center for Personal Data Protection (NCPDP) organized a training course for representatives of the Western Regional Directorate of the General Inspectorate of Border Police (GIBP) The event was held in accordance with the 2026 Training Plan for the subdivisions of the General Inspectorate of Border Police, approved and signed by the leadership of the NCPDP and the GIBP on January 28, 2026.

       The purpose of the training was to strengthen participants’ awareness of the proper application of the regulatory framework governing the protection of personal data, taking into account the specific nature of the GIBP’s activities, which involve the processing of a significant volume of personal data in the exercise of its duties to control and monitor the state border. At the same time, the training aimed to promote an institutional culture based on respect for the principles of legality, confidentiality, integrity and security of personal data.

       The session addressed relevant topics, including the fundamental principles of personal data processing, the conditions for lawful processing, the rights of data subjects, the obligations of controllers, technical and organizational security measures, as well as procedures for reporting and managing security incidents. In addition, aspects related to data processing in the context of state border controls, the use of information systems, the exchange of information between competent authorities, and compliance with the principles of necessity and proportionality in the data processing process were analyzed.

       Particular emphasis was placed on identifying and preventing risks associated with unauthorized access to information containing personal data, as well as its unauthorized disclosure and misuse; practical examples and recommendations were presented to help strengthen compliance and accountability in the professional activities of GIBP employees.

       The session also included interactive discussions and the examination of practical situations encountered in the participants’ day-to-day work, providing an opportunity to clarify practical issues and identify solutions that comply with the requirements of personal data protection legislation.

       The NCPDP appreciates the interest and involvement of the representatives of the Western Regional Directorate of the General Inspectorate of Border Police and reaffirms its commitment to supporting public institutions in the process of implementing and complying with national and European standards in the field of personal data protection.

       During the event, 140 representatives of the Western Regional Directorate of the General Inspectorate of Border Police were trained.

       On June 16, 2026, the National Center for Personal Data Protection (NCPDP) – in collaboration with the General Inspectorate of Border Police (GIBP) – launched the information and awareness campaign “Protect Your Personal Data: Be Vigilant Against Telephone Fraud,” held at the Leușeni Border Crossing Point. The campaign aims to raise public awareness of the risks associated with telephone fraud and the importance of personal data protection.

       The information and awareness-raising initiative was carried out with the active involvement of the Personal Data Protection Department within the General Inspectorate of the Border Police (GIBP). As part of the campaign, travelers were provided with informational materials and practical recommendations on how to identify fraud attempts and prevent the unauthorized disclosure of personal data.

       Participants were informed that, recently, there has been an increase in cases where unknown individuals contact citizens via phone calls and, under various pretexts, request that they disclose personal data. In most cases, scammers pose as representatives of banks, law enforcement agencies, public authorities, telecommunications companies, or other well-known entities, attempting to obtain information such as first and last names, national ID numbers, home addresses, bank details or other confidential information.

       During the campaign, citizens were warned that providing such information to unauthorized persons can lead to the fraudulent use of personal data, unauthorized access to bank accounts, compromised financial security and other consequences that may affect the rights and legitimate interests of the data subject.

       NCPDP representatives emphasized that any request for the disclosure of personal data must be treated with the utmost caution. It is essential for data subjects to verify the identity of the caller and the authenticity of the request before providing any information that allows for their direct or indirect identification. At the same time, citizens were urged not to provide personal data over the phone to unknown individuals, to hang up on suspicious calls and to verify information exclusively through the official channels of the institutions in question.

       Furthermore, participants were reminded that personal data obtained by misleading individuals may subsequently be used for illegal purposes. In this context, the NCPDP reiterated that the use of personal data without a legal basis constitutes a violation of personal data protection legislation and may result in administrative or criminal liability, as applicable.

       The campaign took place in an interactive setting, offering citizens the opportunity to ask questions and receive practical recommendations on the measures needed to protect personal data and prevent the risks associated with telephone fraud.

       As part of their inter-institutional collaboration, the NCPDP and the GIBP will continue to conduct activities to inform and raise public awareness about personal data protection, promoting responsible behavior and effective measures to prevent the fraudulent use of personal information.

       In this regard, the NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of every citizen to ensure the protection of personal data, as the security and confidentiality of such data must be a priority.