Articles
Moldova's New Personal Data Protection Law: What Businesses Need to Do Before End of Summer
In late August 2026, Moldova's Law No. 195/2024 on the protection of personal data comes into force — the first major overhaul of data-handling rules in 15 years, bringing the country closer to the European GDPR standard. This isn't just a new act number: the underlying logic of business liability is changing, and the supervisory authority has already signaled it expects real compliance, not a paper privacy policy.
On July 10, Chișinău hosted the conference "A New Era for Data Protection: Implementing GDPR," attended by the National Center for Personal Data Protection, an EU delegation, and invited European experts. The presence of Max Schrems, one of Europe's most widely cited digital rights specialists, signals that the regulator is treating the subject seriously rather than as a formality.
| Before 2026 | From August 2026 |
|---|---|
| Law No. 133/2011 | Law No. 195/2024 |
| Formal existence of a privacy policy | Need to demonstrate actual compliance with procedures |
| Territory of Moldova | Also applies to foreign operators handling data of individuals in Moldova |
| Complaint-driven inspections | More proactive oversight by the National Center |
Who the law applies to
One of the key changes is the expanded territorial scope. The law applies not only to Moldovan companies but also to data operators outside the country, if their activity involves offering goods or services to people located in Moldova — regardless of whether those services are paid or free. This mirrors the logic of Article 3 of the GDPR: if you serve Moldovan clients remotely, the law applies to you just as it would to a local business.
Who falls under the new rules: any business that collects data from customers, employees, candidates, partners, or newsletter subscribers — regardless of industry or ownership structure.
What the regulator will actually check
The National Center for Personal Data Protection retains and expands its oversight powers: the right to access documents related to data processing, the right to inspect equipment and systems, and the right to issue violation reports.
Checklist: what to review before end of August
| # | What to do | Why it matters |
|---|---|---|
| 1 | Review contracts with counterparties | Data processing provisions are needed — from a standalone clause to a full data processing agreement (DPA) |
| 2 | Audit foreign services | CRM, email marketing tools, cloud storage, analytics, chatbots — the highest risk sits here |
| 3 | Decide on a DPO | Determine whether the company needs a dedicated data protection officer |
| 4 | Review HR and customer databases | The rules cover employee and candidate data just as much as customer data |
| 5 | Build a data map | Understand what data you hold, where it comes from, why, and how long it's retained — the foundation for everything else |
Why start now, not in August
Compliance built in advance costs a company less — and far less stress — than a rushed overhaul under the pressure of an inspection or a complaint. In practice, companies that leave preparation until the last minute most often run out of time precisely on point 5 — the data map, without which the other steps are done blind.
Our team conducts compliance audits against the new law and prepares the necessary contractual documents and internal policies. If you have a website, CRM, mailing lists, or an HR database, it's worth checking them now. Get in touch for a consultation.
Useful articles
Moldova's New Data Protection Law: Fines of Up to 2 Million Lei — How Businesses Can Protect Themselves. A Step-by-Step Guide
On August 23, 2026, Law No. 195/2024 on the protection of personal data comes into force in the Republic of Moldova — the national version of the European Regulation (EU) 2016/679, better known as the GDPR.
Moldova's Personal Data Protection Law Is About to Take Effect. We Audited Several Local Companies — Here's What We Found
Moldova is catching up with European data protection standards. On August 23, 2026, Law No. 195/2024 on Personal Data Protection — the local equivalent of GDPR — takes effect, with fines of up to 2,000,000 lei or 2% of annual turnover, whichever is higher (Article 88).
Registering an SRL (LLC) in Moldova: step-by-step guide and timelines in 2026
A limited liability company (Societate cu Răspundere Limitată, SRL) is the most common form of doing business in Moldova: the minimum share capital starts at 1 leu, the standard registration timeline is 24 hours, and the expedited timeline is 4 hours
Leave a request
