LexLint

The law for AI, agents, crawlers, and personal data

Law / Albania

Albania

privacy

Albania is not a General Data Protection Regulation (GDPR) jurisdiction. Its comprehensive personal data statute is Law No. 124/2024 On the Protection of Personal Data, in force since 31 January 2025 and repealing Law No. 9887/2008 the same date.

The law is closely modelled on the GDPR and the EU Law Enforcement Directive but carries its own numbering and gaps: primary text confirms biometric data, including facial images, as an explicit special category, a real adequacy-or-safeguards cross-border transfer regime, and a standalone civil damages right under Article 88. A breach notification deadline and the full lawful-basis and data-subject-rights chapters were not independently confirmed against primary text in this research pass.

7 instruments named 1 researched in detail As of 2026-08-24

Instruments

Each one links to its LexLint note, which carries what it requires and what it flags on.

Comprehensive regime

Law No. 124/2024 On the Protection of Personal Data

cite Law No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data, in force 31 January 2025 stage In effect since 2025-01-31 source Official statute PDF hosted by the Commissioner for the Right to Information and Personal Data Protection (idp.al), read in full through crawler infrastructure (174,136 characters, untruncated)

Law No. 124/2024 replaced the pre-General Data Protection Regulation (GDPR) Law No. 9887/2008 and, per IAPP, KPMG, ARS Firm and EY commentary, transposes GDPR-style lawful bases and controller and processor duties, though this research did not independently confirm the lawful-basis article against primary text.

Primary text confirms biometric data, including facial images, as an explicit special category, a real cross-border transfer regime requiring adequate protection or specific safeguards, and a standalone civil damages right under Article 88, separate from the administrative complaint route to the Commissioner for the Right to Information and Personal Data Protection.

A breach notification deadline and the full data-subject-rights response timeline were not located in this research; KPMG reports some articles phase in over up to two years from the effective date, without naming which.

What it asks of an app →

This summary covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted above and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.