As of 23 August 2026, the Republic of Moldova applies a new legal framework in the field of personal data protection – Framework Law No. 195/2024 on personal data protection and Law No. 160/2026 on the protection of personal data processed for the purposes of preventing and combating crime.

       The new legislation should not be viewed through the lens of fines. First and foremost, it is about responsibility, precaution and clear rules governing the processing of personal data.

       At the heart of this new legal framework are individuals and their rights.

       The Law is not intended to hinder the activities of organisations and institutions, nor to turn personal data protection into an administrative or financial burden. On the contrary, it establishes a set of rules that helps controllers understand what data they process, why they process it, how long they store it and how they should protect it.

       One of the key elements of the new Law is the principle of accountability. This means that controllers must know their processing activities, assess the associated risks, establish appropriate measures and put in place internal rules and procedures that reflect how personal data are managed.

       Compliance does not begin when a complaint, inspection or security incident occurs. Compliance begins with preventive measures. Law No. 195/2024 was adopted in July 2024 precisely to provide controllers with a two-year transition period, allowing sufficient time to adapt their processes and internal measures to the new legal requirements.

       Precaution is more important than reaction. Therefore, the new Law places a strong emphasis on risk prevention.

       Organisations should collect only the data they need, use them for clearly defined purposes and protect them appropriately. Simple measures, such as strong passwords, restricted access, system updates and employee training, can make a significant contribution to personal data protection.

       The Law does not require every organisation to have expensive solutions in place. What is needed is care, caution and consistently applied rules. Knowing what data you hold, why you use them and how you protect them is an essential first step towards compliance.

       At the same time, data subjects must be informed in a clear and accessible manner about the data being collected, the purposes of the processing, the retention period and the rights to which they are entitled.

       Personal data protection is an investment in trust.

       It is a tool through which an organisation can strengthen its credibility, reduce risks and demonstrate respect for the individuals whose personal data it processes.

       An organisation that manages personal data responsibly is better prepared to deal with potential incidents and can more easily gain the trust of its customers, employees, partners and citizens.

       It is important to understand that Law No. 195/2024 is not about fines.

       The Law establishes a framework of corrective measures and sanctions for breaches of the legislation; however, the finding of a violation does not automatically result in the imposition of a fine. Furthermore, the Law provides for the possibility of issuing recommendations, as well as a gradual mechanism and defined criteria for determining the amount of fines.

       A sanction is a mechanism for ensuring accountability, it is not the purpose of the Law, nor is imposing sanctions the objective or intention of the National Centre for Personal Data Protection. The objective is to ensure that personal data are processed lawfully, transparently, securely and responsibly.

       The Center reaffirms its role as a supervisory authority, as well as an institution that informs, provides guidance and supports society in applying the new rules.

       We make explanatory materials and guidance available to those interested in understanding and correctly applying the Law, regularly organise training sessions and events dedicated to the new legislation and promote an approach based on risk assessment and personal data protection.

       Law No. 195/2024 is not about imposing sanctions or fines.

       It is about responsibility, precaution and clear rules.

       And, above all, it is about people’s trust that their personal data are treated with care. 

       The video can be viewed by accessing the following link: (https://datepersonale.md/videogalerie )

       Today, 28 September, the National Centre for Personal Data Protection (NCPDP) organised a training session on personal data protection for representatives of the National Employment Agency (ANOFM).

       The aim of the session was to strengthen the professional capacities of ANOFM staff by familiarising them with the new legal provisions on personal data protection, as well as by raising awareness of the importance of complying with legal requirements in their professional activities.

       Particular attention was paid to the specific nature of ANOFM’s operations, an institution which, in carrying out its duties, processes a significant volume of personal data in the context of ensuring and managing the employment process.

       The training covered practical aspects relating to the collection, use, storage and transfer of personal data, access to information, and the need to implement appropriate measures to prevent unauthorised access to, disclosure of or misuse of such data.

       At the same time, participants had the opportunity to ask questions and get clarification on various aspects concerning the application of personal data protection rules in the processing of such data.

       Compliance with personal data protection requirements is an essential element of institutional activity, helping to ensure the confidentiality of information and to strengthen beneficiaries’ trust in the public services provided.

       The event was organised in a hybrid format, with 216 ANOFM staff members taking part.

       Today, 24 September, the National Centre for Personal Data Protection (NCPDP) organised a training session on personal data protection for representatives of the Customs Service (CS).

       The training aimed to strengthen the knowledge and competences of Customs Service staff regarding the protection and processing of personal data, in accordance with the applicable legal framework.

       The training session covered topics of importance to the institution’s work, including: the principles of personal data processing; the legal bases for processing; the rights of data subjects and the obligations of controllers; data protection impact assessments; transfers of personal data to third parties; the confidentiality and security of personal data; and the management of security incidents.

       At the same time, practical aspects specific to the activities carried out within the CS were analysed, with a focus on compliance with personal data protection requirements whilst performing their duties.

       The discussions also covered practical scenarios relating to the processing of personal data, the responsibilities of those involved in processing operations, and measures to ensure the confidentiality of personal data.

       Through such initiatives, the NCPDP contributes to the development of the professional skills of representatives from public and private sector entities, with a view to promoting the responsible and fair processing of personal data.

       The event was organised for 32 customs officials.

       On 22–23 September this year, the National Centre for Personal Data Protection (NCPDP) organised a training course on personal data protection for representatives of the Superior Council of Prosecutors (SCP) and its subordinate bodies.

       The aim of the training course was to inform and familiarise SCP employees, as well as staff of the Council’s Secretariat and the Prosecutors’ Inspectorate with the new legal provisions in the field of personal data protection.

       The training covered the following key topics: the concept of personal data; the concept of personal data processing; the principles of personal data processing; the processing of special categories of data; the rights of data subjects; data storage periods; records of processing activities; data security and confidentiality measures; notification of security breaches; informing data subjects; data protection impact assessments; the transfer of information containing personal data to third parties, etc.

       At the end of the training session, participants had the opportunity to ask questions and discuss practical aspects regarding the application of legal provisions in the work of the SCP and its subordinate bodies.

       The event was held at the SCP headquarters and was attended by around 33 representatives.

       The National Centre for Personal Data Protection (NCPDP) organised a training course on personal data protection on 17 September this year for the representatives of the Agency for Intervention and Payments in Agriculture (AIPA).

       The aim of the event was to enhance the professional competences of AIPA staff regarding the new legislative amendments on personal data protection.

       The training session focused on the following key topics: the principles of personal data processing; the rights of data subjects; data protection impact assessments (DPIAs); prior consultation; the data protection officer (DPO); cross-border transfers of personal data; and other relevant topics.

       During the session, participants had the opportunity to consolidate their knowledge regarding the correct and effective application of legal provisions in the field of personal data protection, as well as to clarify practical issues encountered in their institutional activities.

       The NCPDP encourages public institutions to pay increased attention to compliance with the right to personal data protection and to ensure the continuous training of staff in this area.

       Such training activities contribute to the consolidation of an institutional culture based on accountability, legality and respect for the rights of data subjects.

       The event was organised at AIPA’s headquarters and attended by 35 people.

       On 30 September 2026, the National Centre for Personal Data Protection (NCPDP) organised a training session for representatives of the Court of Accounts of the Republic of Moldova (CCRM), with the aim of strengthening their knowledge in the field of personal data protection.

       The session aimed to familiarise the Court of Accounts’ staff with the new legal provisions on personal data protection, as well as to raise their awareness of the importance of complying with legal requirements in their professional activities.

       Among the main topics covered during the training were: the principles of personal data processing; the rights of data subjects and how to exercise them; ensuring data security and confidentiality; data protection impact assessments; and relevant aspects concerning the data protection officer, etc.

       At the same time, the practical challenges encountered in day-to-day personal data processing were discussed, with relevant examples and recommendations presented on implementing the necessary compliance measures in view of the application of the new legal provisions.

       The event was organised at the Court of Accounts’ headquarters, with 42 staff members from the institution in attendance.

       Such training activities help to strengthen the institutional culture regarding the personal data protection and to promote the correct application of legal provisions in the activity of public and private authorities.

       On 18 August 2026, the National Center for Personal Data Protection (NCPDP) organized a training course for employees of Chișinău-Gaz LLC, focusing on the application of the provisions of Law No. 195/2024 on personal data protection.

       The training aimed to strengthen employees’ knowledge and skills regarding the new legal requirements in the field of personal data protection, as well as to enhance their ability to properly identify and handle situations involving the processing of personal data in the course of their professional activities.

       The training covered the main provisions of Law No. 195/2024, with a focus on the principles relating to the processing of personal data, the legal bases for processing, the rights of data subjects, and the obligations of controllers. Other topics included providing information to data subjects, the processing of special categories of personal data, the disclosure of personal data to third parties, data retention periods, as well as the technical and organisational measures necessary to ensure the security of personal data.

       Participants showed particular interest in practical situations encountered in their day-to-day activities, including the collection and use of customer data, employees’ access to information, the disclosure of personal data to third parties, handling data subjects’ requests, and the actions to be taken in the event of a personal data breach.

       The interactive discussions and practical examples presented during the training enabled participants to clarify specific situations and gain a better understanding of how legal requirements should be implemented in their professional activities. The training also highlighted that personal data protection is the responsibility of all employees who, in the course of their duties, have access to such data.

       By organising this activity, the NCPDP continues its efforts to inform and raise awareness among organisations in the Republic of Moldova about the new legal requirements in the field of personal data protection, thereby contributing to strengthening compliance and promoting an organisational culture based on accountability and respect for the rights of data subjects.

       A total of 50 representatives of Chișinău-Gaz LLC were trained.

       On 17 August 2026, the National Center for Personal Data Protection (NCPDP) organized a training course for employees of the Central Municipal Clinical Hospital, aimed at strengthening the professional knowledge and skills of the institution’s staff in the field of personal data protection and supporting the proper application of the legal framework in the healthcare institution’s activities.

       The training course forms part of the NCPDP’s efforts to inform, train and raise awareness among institutions about the importance of personal data protection and takes place in a particularly important context: on 23 August 2026, Law No. 195/2024 on personal data protection enters into force, strengthening the national legal framework and aligning it with European standards in this field.

       During the event, the main provisions of the new legal framework were presented and discussed, including the principles relating to the processing of personal data, the legal bases for processing, the rights of data subjects, and the obligations of controllers. Particular emphasis was placed on the specific aspects of processing data concerning health, given their particularly sensitive nature and the need to ensure an appropriate level of protection.

       Participants also discussed the confidentiality and security of patients’ data, the prevention of unauthorized access to and disclosure of information, the secure transmission of data, the management of security incidents, as well as the role and responsibilities of the Data Protection Officer (DPO). The topics covered were complemented by practical examples and concrete situations relevant to the day-to-day activities of a healthcare institution.

       The training highlighted that, in the healthcare sector, personal data protection is not merely a legal obligation, but also an essential component of respecting patients’ privacy, dignity and rights. Every employee who processes or has access to personal data plays an important role in preventing their unauthorized disclosure, loss or misuse.

       Among the key takeaways from the training were the need for a responsible approach to personal data at every stage of processing, restricting access to personal data based on the duties and responsibilities of authorized persons, paying particular attention to appropriate security measures, and promptly reporting any potential security incidents. At the same time, continuous staff training represents an important tool for preventing risks and strengthening an institutional culture focused on personal data protection.

       Through this activity, the NCPDP reaffirms its commitment to supporting public and private institutions in understanding and properly applying personal data protection rules, thereby contributing to a high level of protection of individuals’ rights and freedoms.

       A total of 60 representatives of the Central Municipal Clinical Hospital participated in the training.

       On 14 August 2026, the National Centre for Personal Data Protection (NCPDP) held a new training course on personal data protection, aimed at employees of the National Office of Social Insurance (CNAS).

       The training forms part of the implementation of the Training Plan on personal data protection for CNAS staff, signed by the head of the NCPDP and the CNAS on 8 July 2026, with the aim of strengthening staff members’ knowledge and professional skills, as well as ensuring the correct and uniform application of legal provisions in the institution’s activities.

       The aim of the course was to strengthen the abilities of CNAS staff regarding the lawful, fair and transparent processing of personal data, as well as to contribute to a better understanding of the responsibilities assigned to staff in the process of collecting, using, storing and transferring data.

       Training is important for the work of the CNAS, given the volume and nature of the personal data processed in the course of the institution’s duties and in the provision of social services. Compliance with data protection requirements helps to ensure the lawfulness of internal processes, prevent security incidents and protect the rights and freedoms of data subjects.

       The training covered the main principles applicable to the processing of personal data, the conditions for lawful processing, the rights of data subjects and the obligations of controllers. Issues relating to ensuring data confidentiality and security, staff responsibility in the processing activity, risk prevention and the management of situations that may affect the security of personal data were also addressed. Particular emphasis was placed on the new provisions of Law No. 195/2024 on personal data protection, which will come into force on 23 August 2026, as well as on the need for institutional preparation for their implementation.

       The course was delivered online, with 95 staff members from the CNAS’s regional offices taking part. Delivering the training in this format ensured the participation of a large number of the institution’s representatives and facilitated their access to the information and recommendations provided by specialists in the field.

       By continuing the training sessions set out in the Cooperation Plan, the NCPDP and the CNAS are strengthening their cooperation with a view to developing staff’s professional skills and ensuring the proper implementation of the new legal framework on personal data protection.

       On 13 August 2026, the National Centre for Personal Data Protection (NCPDP) organised a TAIEX expert mission entitled ”Cross-border transfers of personal data to third countries or international organisations”, aimed at strengthening institutional capacity in the field of international data transfers.

       The aim of the mission was to explore in greater depth the implications and challenges associated with cross-border transfers of personal data, with a focus on data protection, the application of the European legal framework and the identification of the mechanisms necessary to ensure lawful and secure transfers.

       The event brought together representatives from the NCPDP, the General Inspectorate of Police and the General Inspectorate of Border Police, providing a forum for dialogue, the exchange of experience and best practice regarding the application of the rules on international data transfers.

       During the mission, issues were discussed regarding the criteria for classifying an operation as a data transfer, the practical application of the GDPR within the European Union, the role of data protection authorities, and the challenges associated with the implementation of Chapter V of the GDPR. At the same time, the risks associated with cross-border transfers, data security measures, transfer standards and mechanisms, adequacy decisions and other recognised instruments were analysed, along with case studies and practical examples.

       Mr Matej Sironic, an adviser on personal data protection at the Information Commissioner’s Office of the Republic of Slovenia, participated as a European expert and presented european experience and best practices in the field of international data transfers.

       The mission helped to strengthen the participants’ professional capacities and to draw on European experience with a view to implementing Law No. 195/2024 on personal data protection, which will come into force on 23 August 2026.

       The NCPDP reaffirms its commitment to continuing to cooperate with its european and international partners with a view to strengthening an effective system for personal data protection.

       The expert mission was organised and funded by the European Commission’s Technical Assistance and Information Exchange Instrument (TAIEX).