On 4 August 2026, the National Centre for Personal Data Protection (NCPDP) organised the TAIEX expert mission entitled “Effective regulation of financial penalties. Setting fines”, aimed at strengthening institutional capacity regarding the application of corrective measures and administrative sanctions in the field of personal data protection.

       The event brought together experts from European Union Member States and representatives of the NCPDP, with the aim of supporting the national supervisory authority in preparing for the effective, consistent and proportionate exercise of its powers to impose corrective measures and administrative financial penalties, in the context of implementing the new regulatory framework for personal data protection.

       Given the need to implement Law No. 195/2024 on personal data protection, which will come into force on 23 August 2026 and which transposes the provisions of Regulation (EU) 2016/679 (GDPR), the NCPDP is strengthening its institutional capacities to carry out its new supervisory and enforcement powers.

       The main aim of the TAIEX expert mission was to facilitate the exchange of experience and European best practice regarding the conduct of inspections, the taking of evidence, the establishment of infringements, the application of corrective measures and the imposition of administrative fines, so that these are effective, proportionate and justified in accordance with European standards.

       The event’s agenda included thematic sessions dedicated to:

• the conduct of inspections and procedural stages, from the taking of evidence to the establishment of infringements;
• the application of corrective measures and the criteria for determining administrative fines;
• the assessment of aggravating and mitigating circumstances in the process of tailoring sanctions;
• ensuring the proportionality, consistency and legal soundness of sanctioning decisions;
• analysing case studies on the application of corrective measures and administrative sanctions;
• developing internal methodological tools for assessing infringements and justifying administrative decisions.

        During the working sessions, practical examples were presented regarding the organisation and conduct of investigations, the assessment of evidence and the justification of sanctioning decisions; specific scenarios were also analysed, enabling the exchange of experience and the identification of solutions applicable to the work of the NCPDP.

       Ms Agnieszka Giewon and Mr Bartłomiej Kohnke participated as international experts, presenting the experience and best practices of the Polish authorities regarding the application of corrective measures and administrative sanctions in the field of personal data protection. Through practical examples and case studies, the experts provided participants with a practical insight into the mechanisms for establishing infringements, tailoring sanctions and justifying administrative decisions, in accordance with European standards.

       The discussions highlighted the importance of developing internal procedures and methodological tools to ensure a uniform and consistent approach to the exercise of supervisory and sanctioning powers, thereby contributing to the strengthening of the NCPDP’s institutional capacity with a view to the implementation of the new legal framework.

       The TAIEX expert mission helped to strengthen the professional capacities of NCPDP specialists and to adopt European best practices regarding the application of corrective measures and administrative sanctions, thereby supporting the process of implementing Law No. 195/2024 on personal data protection.

       The NCPDP reaffirms its commitment to continuing its cooperation with European and international partners with a view to developing an effective and coherent supervisory system that ensures respect for individuals’ fundamental rights and freedoms in the context of the processing of personal data.

       The expert mission was organised and funded by the European Commission’s Technical Assistance and Information Exchange Instrument (TAIEX).

       On 31 July 2026, the National Centre for Personal Data Protection (NCPDP) organised an online training course on personal data protection for representatives of the National Office of Social Insurance (CNAS).

       The aim of the training was to help strengthen CNAS staff’s knowledge of the new requirements applicable to personal data protection, as established by Law No. 195/2024 on personal data protection, which ensures that the national regulatory framework is aligned with European standards in this area.

       The training covered the main obligations of data controllers, the principles applicable to data processing, and the responsibilities of public authorities and institutions in ensuring that the rights of data subjects are respected. Issues relating to the implementation of appropriate technical and organisational measures to ensure data security, the identification and management of risks, the notification of security incidents, and the recording and documentation of personal data processing operations were also discussed.

       At the same time, participants examined scenarios relevant to their activities, with a focus on the risks associated with the improper personal data processing and the measures to be taken to prevent and mitigate them. The interactive session provided clarification on practical aspects concerning the application of the principles of lawfulness, necessity and proportionality in the context of personal data processing operations.

       By organising these training activities, the NCPDP is strengthening its role in supporting public authorities in developing the skills necessary for the correct application of personal data protection legislation, thereby helping to promote an institutional culture based on accountability, compliance and adherence to best practice.

       The training course was held online and was attended by 106 representatives of the National Office of Social Insurance.

       On 6 August 2026, the National Centre for Personal Data Protection (NCPDP) organised a new training course for individuals appointed by controllers or by processors to act as Data Protection Officers (DPOs).

       This initiative forms part of the NCPDP’s ongoing training programme and aims to consolidate the knowledge and develop the professional skills of those acting as DPOs, in the context of the implementation of the new regulatory framework for personal data protection.

       The training session covered topical issues relating to the status and duties of the Data Protection Officer, the conditions for appointment, independence in the performance of their duties, cooperation with the supervisory authority, as well as the responsibilities of controllers and processors in ensuring compliance with the relevant legislation.

       At the same time, participants had the opportunity to analyse practical examples and ask questions regarding the challenges encountered in their day-to-day work, with clarifications and recommendations provided on the application of the provisions of Law No. 195/2024 on personal data protection, which will come into force on 23 August 2026.

       By organising these training sessions, the NCPDP aims to support controllers and processors in implementing the legal requirements and in fostering an organisational culture based on respect for the right to personal data protection.

       The NCPDP will continue to carry out training and awareness-raising activities aimed at both Data Protection Officers and representatives of public authorities, the private sector and other categories of controllers, with a view to ensuring the uniform and effective application of legislation in the field of personal data protection.

       22 Data Protection Officers took part in the event.

       On 30 July 2026, the Parliament of the Republic of Moldova adopted, at second reading, the draft law on the protection of personal data processed for the purpose of preventing and combating crime, a legislative act transposing into national law Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA

       The adoption of this draft law represents an important step in the process of harmonising the legislation of the Republic of Moldova with European Union standards in the field of personal data protection and complements the regulatory framework established by Law No. 195/2024 on personal data protection, which is due to enter into force on 23 August 2026.

       The new legislation lays down specific rules on how the competent authorities – criminal investigation bodies, public prosecutors’ offices, courts and other authorised institutions – process personal data for the purposes of preventing or combating crime, investigating criminal offences, conducting criminal proceedings or enforcing sentences and security measures.

       In this regard, the law sets out clear obligations for the competent authorities concerning the lawfulness of processing, the restriction of data use to the purposes provided for by law, compliance with the principle of data minimisation, and the implementation of the technical and organisational measures necessary to ensure the security and confidentiality of such data.

       The draft was reviewed by representatives of the European Commission, who gave a positive opinion on the document and noted that, together with Law No. 195/2024 on personal data protection, it contributes to the consolidation of a modern regulatory framework aligned with European Union standards.

       The adoption of this law reaffirms the Republic of Moldova’s commitment to establishing an effective system for personal data protection in the field of law enforcement, in accordance with European standards and the objectives of the process of integration into the European Union.

       On July 29, 2026, the National Center for Personal Data Protection (NCPDP) organized a training session for representatives of the e-Governance Agency, with the aim of strengthening their professional capabilities regarding the application of personal data protection legislation.

       The event is part of the training activities conducted by the NCPDP for public authorities, designed to support the effective implementation of the provisions of Law No. 195/2024 on personal data protection and the development of institutional practices compliant with European standards in this field.

       The training covered the main obligations of controllers, the principles that must be observed in the data processing procedure, and the responsibilities of public institutions in ensuring the rights of data subjects. Additionally, the session addressed issues related to the implementation of appropriate technical and organizational measures for data protection, risk assessment, security incident management and the documentation of processing activities.

       The principles of “privacy by design” and “privacy by default” are particularly relevant to the e-Governance Agency. These principles involve integrating data protection measures right from the platform design stage and limiting access to data to authorized individuals only, as well as applying, by default, settings that provide the highest level of personal data protection.

       At the same time, participants analyzed examples and practical scenarios from their professional experience, addressing the main risks posed by the improper processing of personal data, as well as the measures needed to prevent and mitigate them. The interactive discussions provided an opportunity to clarify practical aspects regarding compliance with the principles of lawfulness, necessity and proportionality in the personal data processing procedure.

       By organizing such activities, the NCPDP continues to promote the development of professional competencies among public authorities and to support the uniform application of legislation in the field of personal data protection, thereby contributing to the consolidation of an institutional framework based on accountability, compliance and best practices.

       Approximately 70 representatives of the e-Governance Agency were trained during the event.

       Aware of the need to strengthen professional knowledge and skills in the field of personal data protection, as well as the importance of the uniform application of legal provisions in the activity of public authorities, on July 8, 2026, the National Center for Personal Data Protection (NCPDP), represented by the Director Victoria MUNTEAN and the National Social Insurance House (NSIH), represented by Deputy General Director Tatiana POPA, they signed the Training Plan in the field of personal data protection intended for employees within the structural subdivisions of NSIH.

       The main purpose of the Training Plan is to develop the professional skills of NSIH employees in the field of personal data protection, by deepening knowledge regarding data processing principles, the rights of data subjects and the legal obligations of controllers. At the same time, the trainings aim to strengthen the institutional capacity for correct and uniform application of legislation in the current activity, contributing to ensuring a high level of compliance with legal requirements.

       The training plan was developed and approved by mutual agreement and provides for the holding of training sessions within the structural subdivisions of NSIH, in a format adapted to the needs of the institution, emphasizing the practical aspects of the application of legislation on personal data protection.

       NCPDP attaches particular importance to strengthening inter-institutional collaboration, considering that the development of an organizational culture based on respect for the right to personal data protection is an essential element for increasing the level of compliance and for ensuring a responsible processing of personal data in the public sector.

       The signing of this Training Plan is part of the series of activities organized on the occasion of the 18th anniversary of the NCPDP, reaffirming the institution’s commitment to promote education in the field of data protection, to strengthen cooperation with public authorities and to contribute to the development of an institutional framework based on responsibility, transparency and respect for the fundamental rights of natural persons.

       On July 10, 2026, the National Center for Personal Data Protection (NCPDP) organized the National Conference „The new era of data protection in the Republic of Moldova: Implementation of GDPR”, an event dedicated to the private sector and the training of controllers for the application of the new regulatory framework in the field of personal data protection.

       The event took place at a defining moment for the European path of the Republic of Moldova, in the context of Law no. 195/2024 on personal data protection entry into force on August 23, 2026, a normative act that transposes into national legislation the General Data Protection Regulation (GDPR). The new law establishes a modern legal framework, applicable to both the public and private sectors, strengthening the protection of fundamental rights and contributing to the development of a digital economy based on trust, responsibility and transparency.

       At the opening of the conference, the Director of the NCPDP, Victoria MUNTEAN, highlighted the fact that the implementation of the new legislation represents one of the most important reforms in the process of harmonizing the Republic of Moldova legislation with the EU acquis and an essential step in strengthening a modern personal data protection framework, emphasizing that „personal data protection is no longer seen only as a legal obligation, but as an essential element of corporate governance, confidence and market competitiveness. Compliance with GDPR standards is a competitive advantage, contributing to strengthening the trust of customers and partners, facilitating cooperation with entities from the EU member states and creating favorable premises for investment and business development. The implementation of the new law must be seen not only as an obligation, but as an investment in the sustainable development of each organization.”

       The purpose of the event was to support the private sector in the preparation process for the application of Law no. 195/2024, by strengthening the level of compliance with the new legal obligations, clarifying the responsibilities of controllers, processors and data protection officers, promoting good European practices and facilitating the experience exchange with supervisory authorities experts of the EU member states.

       The conference agenda included a plenary session and four thematic panels dedicated to the main practical aspects of GDPR implementation. Within them, topics were addressed regarding the construction of the future of data protection in the Republic of Moldova, the obligations established by the new law, the exercise of the rights of data subjects, compliance mechanisms, the role of codes of conduct and certification in the field of data protection, as well as the mechanisms for investigation and legislation application in the practice of European supervisory authorities.

       During the conference, the representative of the NCPDP presented the main obligations introduced by Law no. 195/2024 on personal data protection, the calendar of its implementation and the expectations of the supervisory authority regarding the compliance of controllers and processors.

       The debates benefited from the contributions of renowned experts from the Council of Europe, the European Center for Digital Rights (NOYB), as well as the data protection authorities of Latvia, Malta, Italy and Slovenia, who presented the experience of the Member States in the GDPR application, examples of good practices and reliable solutions for the effective new legal requirements implementation.

       The conference was held in the context of marking 18 years of activity of the NCPDP, on which occasion the institution’s commitment to continue strengthening the national data protection system and to support conrollers through training activities, guidance and cooperation.

       The event highlighted the fact that the effective implementation of the new legal framework on data protection is an essential condition for the development of a competitive business sector, strengthening trust in the digital economy and facilitating cooperation with partners in the European Union.

       NCPDP reaffirms its commitment to continue the dialogue with the private sector, public authorities and international partners in order to ensure a coherent and effective application of Law no. 195/2024 on personal data protection, promoting a culture of compliance based on responsibility, transparency and respect for fundamental rights.

       The event was organized by the NCPDP, in partnership with the European Union Delegation in the Republic of Moldova, as well as with the project „Moldova is Europe – Support for integration into the EU”, financed by the European Union and the Kingdom of Denmark.

       NCPDP thanks all national and international experts, partners and participants for contributing to the success of the conference and for being involved in promoting a modern, efficient and European framework for personal data protection in the Republic of Moldova.

       On July 10, the National Center for Personal Data Protection (NCPDP) marks 18 years of activity, during which the institution has constantly strengthened its role as a national supervisory authority in the field of personal data protection and guarantor of respect for the fundamental right to private life.

       During these 18 years, the field of data protection experienced a significant evolution, determined by accelerated digital transformations, the exponential increase in the volume of processed data and the need to ensure a coherent and uniform application of the normative framework. In this context, the NCPDP has contributed to strengthening a culture of compliance and accountability in data protection, including by promoting the necessary balance between the right to the personal data protection, the right of access to information and freedom of expression.

       In exercising its legal mandate, as an autonomous, independent and impartial public authority, the NCPDP reaffirms its mission to ensure the protection of the fundamental rights and freedoms of natural persons, in particular with regard to the processing of personal data and cross-border data transfers.

       „In a context characterized by the acceleration of digitization processes and the widespread use of personal data in all sectors, data protection is becoming a structural element of trust and the democratic functioning of society. Respect for private life is a fundamental principle, with the value of legal and institutional guarantee. The entry into force, on 23.08.2026, of Law no. 195/2024 on personal data protection constitutes a major landmark in the consolidation of the national normative framework and in its alignment with European standards in the matter. The new legal framework strengthens data protection guarantees and contributes to strengthening trust in relations between individuals, public authorities and the private sector. In this sense, the NCPDP reaffirms its commitment to ensure the effective implementation and application of the new legal provisions, as well as to guarantee respect for the fundamental rights of the persons concerned, in a digital environment that is constantly transforming. The personal data protection remains an essential component of the rule of law and a democratic society, based on respect for private life and human dignity”, said Ms. Victoria Muntean, director of NCPDP.

The main achievements in the 18 years of activity

       During its 18 years of activity, the NCPDP has accumulated valuable experience and achieved significant progress, such as:

Harmonization of the national legislative framework

       One of the most important recent results of the institutional activity is the process of harmonizing the national legislative framework in the field of personal data protection, carried out in order to align it with the standards of the European Union and the Council of Europe and to ensure a high and effective level of protection of fundamental rights.

       In this context, a major progress, with a reference value for the development of the national data protection system, is the adoption of Law no. 195/2024 on personal data protection. This normative act transposes the provisions of Regulation (EU) 2016/679 (GDPR) and marks a decisive stage in the modernization and consolidation of the national legal framework in the field.

       The law establishes a consolidated legal regime for data protection, strengthens guarantees for data subjects and creates the conditions for a more coherent and effective application of European data protection principles. Its entry into force, on August 23, represents a reference moment in the evolution of the national personal data protection system and confirms the firm commitment of the Republic of Moldova to align with European standards.

       At the same time, by Law 36/20.03.2026 and publication in the Official Gazette of the Republic of Moldova, the Protocol amending the Convention for the protection of individuals regarding the automated processing of personal data was ratified.

       The purpose of this Protocol is to modernize the international framework in the field of personal data protection, in order to ensure a high level of protection of the fundamental rights and freedoms of natural persons, especially the right to private life, in the context of technological developments and the globalization of data flows.

       Likewise, on 07/09/2026, the Parliament of the Republic of Moldova adopted in the first reading the draft law on personal data protection processed for the purpose of preventing and combating crimes.

       This normative act transposes Directive (EU) 2016/680 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, in national legislation and establishes specific rules for competent authorities (such as criminal investigation bodies and courts) that manage data in prevention, investigation or prosecution activities.

Monitoring and ensuring compliance

       NCPDP continuously exercises its legal mandate of supervision and control over the way in which public and private sector controllers process personal data, with the aim of ensuring compliance with the applicable normative framework and the effective protection of the fundamental rights and freedoms of data subjects.

       In exercising these powers, the authority uses specific supervisory and control tools, including: examining complaints submitted by data subjects; initiating and conducting controls; investigating reports received, including from public authorities.

       The surveillance activity reveals a constant trend of increasing the number of complaint addressed to the authority, which reflects both an increased level of awareness of rights by the persons concerned and the intensification of data processing in the public and private environment.

       From the perspective of content, the most frequent situations reported concern:

• Processing of personal data by means of video/audio surveillance systems;
• Processing of personal data in the absence of the consent of the data subject and/or the legal basis, including the processing of personal data from state information resources;
• Processing of personal data by disclosure on social networks;
• Realization of the rights of personal data subjects (information, access, intervention, opposition), etc.

Outreach activities and training

       NCPDP has made significant progress in strengthening activities to promote personal data protection among the general public, by intensifying information, education and awareness actions at the national level.

       The institution continued the information and awareness campaign of the school community, organized street actions with different themes, as well as an extensive number of training sessions with physical presence, online and hybrid, addressed to a record number of entities.

       In this context, NCPDP also carried out the information campaign „Protect personal data: Be vigilant in the face of telephone fraud”, with the objective of informing citizens about the risks associated with telephone fraud and attempts to fraudulently obtain personal data. Activities included the development and distribution of information leaflets to the general public, informing citizens of the risks associated with telephone fraud, the main operating methods used by criminals and the necessary precautions to prevent unauthorized disclosure of personal data. The information materials provided practical recommendations on verifying the identity of interlocutors, avoiding the provision of sensitive information by telephone and using the official communication channels of public and private institutions.

National and international cooperation

       The dimension of national and international cooperation has been constantly strengthened, reflecting the commitment of the NCPDP to align with international standards and good practices in the field of personal data protection.

       In this sense, the institution actively participated in the plenary meetings of the European Data Protection Board (EDPB), as well as in the activities carried out under the auspices of the Council of Europe, contributing to the exchange of experience and the development of a convergent approach at European level in the field of data protection.

       The status of the Republic of Moldova as an observer within the EDPB represents an essential element of the process of approaching European Union standards, facilitating better integration in cooperation and coordination mechanisms at the European level.

       At the same time, during the reference period, cooperation relations were strengthened by signing 21 agreements at the national level and 10 international agreements with relevant authorities in Europe, contributing to the intensification of the exchange of best practices, to the strengthening of institutional capacities and to ensuring a more effective and coordinated intervention in the field of personal data protection.

Vision for the future

       NCPDP reconfirms its commitment to ensure a fair and proportionate balance between the protection of personal data and the other fundamental rights and freedoms guaranteed by the Constitution of the Republic of Moldova, in the context of technological developments and the intensification of digitization processes.

       In this sense, the institution will continue to strengthen its capacity for supervision, control and intervention, in order to ensure effective compliance with the normative framework and the protection of the rights of data subjects.

       At the same time, NCPDP will actively support controllers in the legislative compliance process, through guidance activities, training and promotion of good practices, thus contributing to increasing the general level of responsibility in the processing of personal data.

       The institution will also continue to promote a solid data protection culture based on transparency, accountability and respect for human dignity as essential elements of a modern administration and a democratic society.

       The protection of personal data is not only a legal obligation, but an essential condition for the functioning of a state of law and for maintaining trust in the relationship between citizens, public authorities and the private sector.

       On June 29, 2026, the National Center for Personal Data Protection (NCPDP) participated in a workshop titled “Digital Safety of Young People in the Context of European Standards and the Process of Accession to the European Union,” organized by the National Youth Council of Moldova (NYCM).

       The event brought together representatives of civil society, experts and national public authorities, with the aim of facilitating dialogue on the analysis of the legislative, institutional and policy framework in the field of digital safety for young people and women, in relation to relevant European standards, including the General Data Protection Regulation (GDPR), the Digital Services Act (DSA), and the Artificial Intelligence Act (AI Act).

       The discussions addressed topics related to the protection of minors and women in the digital environment, the harmonization of national legislation with the EU acquis, the strengthening of institutional protection mechanisms, as well as the identification of solutions and recommendations for the development of public policies compatible with European Union standards.

       The NCPDP representative participated as a speaker in the panel discussion titled “Regulatory and Supervisory Institutions: Institutional Capacity and Mechanisms for Strengthening Competencies,” intended for authorities with regulatory and supervisory responsibilities.

       During the panel, he delivered a presentation on the role of the supervisory authority in ensuring compliance with the regulatory framework for the personal data protection in the digital environment, highlighting the importance of consistently applying the principles of legality, transparency and security in the data processing process, and emphasizing that these are fundamental elements for maintaining trust in the digital ecosystem and for protecting the rights of data subjects.

       At the same time, the need to strengthen the institutional capacities of supervisory authorities was emphasized, including through the development of monitoring tools, increasing the efficiency of control mechanisms and intensifying inter-institutional cooperation. In the context of the rapid development of digital services and the growing volume of processed data, the essential role of a proactive approach in preventing risks and ensuring compliance with applicable legal provisions was underscored.

       By participating in this workshop, the NCPDP reaffirms its commitment to promoting respect for the right to personal data protection and to developing public policies aligned with European Union standards in the digital sphere.

       On June 17, 2026, the National Center for Personal Data Protection (NCPDP) participated in an inter-institutional working meeting organized by the Electoral Council of Telenești District Electoral Constituency No. 34, attended by representatives of local public authorities and the district’s deconcentrated and decentralized services.

       The event took place as part of the post-election information, cooperation and analysis activities carried out by the Central Election Commission in collaboration with the public authorities involved in organizing and conducting electoral processes. The purpose of the meeting was to identify any difficulties encountered during the electoral processes, analyze existing practices and formulate proposals aimed at improving the regulatory framework and electoral procedures.

       One of the central topics on the agenda concerned the compilation and updating of voter rolls in compliance with personal data protection requirements, as well as issues related to the processing of voter data by registrars of the State Voter Registry and election officials in the performance of their duties.

       During the session, the NCPDP representative presented the main provisions of national legislation on the protection of personal data applicable to electoral processes. At the same time, practical aspects were addressed regarding ensuring the legality of data processing, compliance with the principles of confidentiality and security, as well as the measures necessary to prevent unauthorized access to the information contained in the voter rolls.

       Participants had the opportunity to ask questions and discuss practical situations encountered in their work, with emphasis placed on the importance of uniformly applying personal data protection rules at all stages of the electoral process. Furthermore, best practices were promoted to help strengthen citizens’ trust in how the competent authorities manage their personal data.

       The event was attended by 55 representatives of local public authorities, decentralized and deconcentrated services, as well as other stakeholders involved in electoral processes at the local level.

       By participating in such activities, the NCPDP reaffirms its commitment to supporting public authorities in the proper application of personal data protection legislation and to contributing to the strengthening of an institutional culture based on respect for individuals’ fundamental rights and freedoms.