Articles
Moldova's New Personal Data Protection Law: What Businesses Need to Do Before End of Summer
In late August 2026, Moldova's Law No. 195/2024 on the protection of personal data comes into force — the first major overhaul of data-handling rules in 15 years, bringing the country closer to the European GDPR standard. This isn't just a new act number: the underlying logic of business liability is changing, and the supervisory authority has already signaled it expects real compliance, not a paper privacy policy.
On July 10, Chișinău hosted the conference "A New Era for Data Protection: Implementing GDPR," attended by the National Center for Personal Data Protection, an EU delegation, and invited European experts. The presence of Max Schrems, one of Europe's most widely cited digital rights specialists, signals that the regulator is treating the subject seriously rather than as a formality.
| Before 2026 | From August 2026 |
|---|---|
| Law No. 133/2011 | Law No. 195/2024 |
| Formal existence of a privacy policy | Need to demonstrate actual compliance with procedures |
| Territory of Moldova | Also applies to foreign operators handling data of individuals in Moldova |
| Complaint-driven inspections | More proactive oversight by the National Center |
Who the law applies to
One of the key changes is the expanded territorial scope. The law applies not only to Moldovan companies but also to data operators outside the country, if their activity involves offering goods or services to people located in Moldova — regardless of whether those services are paid or free. This mirrors the logic of Article 3 of the GDPR: if you serve Moldovan clients remotely, the law applies to you just as it would to a local business.
Who falls under the new rules: any business that collects data from customers, employees, candidates, partners, or newsletter subscribers — regardless of industry or ownership structure.
What the regulator will actually check
The National Center for Personal Data Protection retains and expands its oversight powers: the right to access documents related to data processing, the right to inspect equipment and systems, and the right to issue violation reports.
Checklist: what to review before end of August
| # | What to do | Why it matters |
|---|---|---|
| 1 | Review contracts with counterparties | Data processing provisions are needed — from a standalone clause to a full data processing agreement (DPA) |
| 2 | Audit foreign services | CRM, email marketing tools, cloud storage, analytics, chatbots — the highest risk sits here |
| 3 | Decide on a DPO | Determine whether the company needs a dedicated data protection officer |
| 4 | Review HR and customer databases | The rules cover employee and candidate data just as much as customer data |
| 5 | Build a data map | Understand what data you hold, where it comes from, why, and how long it's retained — the foundation for everything else |
Why start now, not in August
Compliance built in advance costs a company less — and far less stress — than a rushed overhaul under the pressure of an inspection or a complaint. In practice, companies that leave preparation until the last minute most often run out of time precisely on point 5 — the data map, without which the other steps are done blind.
Our team conducts compliance audits against the new law and prepares the necessary contractual documents and internal policies. If you have a website, CRM, mailing lists, or an HR database, it's worth checking them now. Get in touch for a consultation.
Useful articles
Marketing emails and cookies after Inteligo Media: what the EU Court of Justice actually decided
If your website sends customers emails with news, promotions or useful articles, this article explains when you can do that and when you need to ask for permission first.
European-Style Taxation: Moldova Changes the Rules for International Business
The Republic of Moldova has begun transposing European rules on direct taxation into its national legislation. On 22 September, the Government approved the relevant draft law. For most entrepreneurs, its provisions may still seem somewhat distant: some are due to take effect in 2027–2028, while others will apply only after the country joins the European Union. However, for companies with foreign shareholders, subsidiaries, loans or intellectual property, the changes may have very practical implications.
Legal Support for Businesses: Reliable Protection for Your Company
Businesses need legal counsel not only when a dispute has already arisen, a regulatory inspection has begun, or a business partner has breached an agreement. It is far more effective to identify and address legal risks before they become serious problems. That is why effective legal support is not about constantly dealing with consequences — it is about taking a systematic and proactive approach to risk management.
Leave a request
