Law No. 124/2024, international data transfer

Law No. 124/2024, Arts. 39-42 (international data transfer)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 31 January 2025.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Transfer personal data outside Albania only where the destination country, territory, sector or international organization has been found by the Commissioner to ensure an adequate level of protection, or where you provide an appropriate safeguard such as binding company rules, standard contractual clauses, or a Commissioner approved code of conduct or certification mechanism.
Absent an adequacy decision or safeguard, transfer personal data abroad only on a listed condition such as the data subject's informed and explicit consent to the transfer after being told its risks, contractual necessity, or an important public interest, and never repetitively or beyond a limited number of data subjects when relying on the legitimate-interests fallback.
Recognize or enforce a foreign court or administrative decision compelling you to transfer or disclose personal data only where it rests on an international agreement, such as a mutual legal assistance treaty in force with Albania.
Where the Commissioner approves binding rules for a group of companies, confer enforceable rights on data subjects, apply the general processing principles internally, and accept liability in Albania for another group member's breach of the rules abroad.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 39 permits transferring personal data to a third country or an international organization, and any further onward transfer, only where the data receives adequate protection at the destination or a specific safeguard covers that transfer.

Article 39(2) permits recognizing or enforcing a foreign court or administrative decision that compels a transfer or disclosure of personal data only where it rests on an international agreement, such as a mutual legal assistance treaty in force with Albania.

Article 40 lets the Commissioner declare a country, territory, sector, or international organization adequate, weighing its data protection legislation, its rule of law and human rights record, its national security and criminal law regime, the existence of an effective independent supervisory authority, and its international commitments, and Article 40(4) requires the Commissioner to monitor and revise that finding over time.

Article 41 lets a controller or processor transfer personal data absent an adequacy decision where it provides an appropriate safeguard, such as a legally binding instrument between public authorities, Commissioner approved binding company rules, a Commissioner published data protection standard, or a code of conduct or certification mechanism carrying binding commitments from the recipient.

Article 41(3) allows a transfer absent both an adequacy decision and a safeguard only on a listed condition, including the data subject's informed and explicit consent to the transfer after being told its risks, contractual necessity, or an important public interest, and Article 41(4) confines a further fallback transfer to one that is not repetitive and concerns only a limited number of data subjects.

Article 42 lets the Commissioner approve binding rules for a group of companies that confer enforceable rights on data subjects, apply the general processing principles internally, and make the Albanian group member liable for another member's breach of the rules abroad.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics

Read the law

Official statute PDF hosted by the Commissioner for the Right to Information and Personal Data Protection (idp.al)
read in full (169,825 characters, untruncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app