Moldova Law No. 195/2024, personal data breach notification

Article 33(1) requires the controller, in the case of a personal data breach, to notify it to the National Centre for Personal Data Protection without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and to accompany a later notification with reasons for the delay.

Article 33(2) requires the processor to notify the controller without undue delay after becoming aware of a breach.

Article 33(3) fixes what the notification must contain: the nature of the breach including, where possible, the categories and approximate number of data subjects and of personal data records concerned, the name and contact details of the data protection officer or other contact point, the likely consequences, and the measures taken or proposed to address it and mitigate its adverse effects.

Article 34(1) requires the controller to communicate the breach to the data subject without undue delay where it is likely to result in a high risk to the rights and freedoms of natural persons, in clear and plain language, and article 34(3) excuses that communication only where protective measures such as encryption render the affected data unintelligible, where subsequent measures make the high risk no longer likely, or where it would involve a disproportionate effort and a public communication of equal effect is made instead.

Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication 23 August 2024, so these provisions bind from 23 August 2026.