Law No. 124/2024 "On Personal Data Protection" aligns Albania with the General Data Protection Regulation (GDPR) of the European Union (EU). Many companies were relieved to learn that they no longer need to notify the Commissioner of their data processing. But the new law asks for more, not less: instead of a form, the company must itself be able to prove that it complies with the law. Fines can reach up to 2 billion lek or 4% of global annual turnover.
These are the obligations we most often see overlooked:
1. Record of processing activities (RoPA). It replaces notification. It shows what data you process, why, for how long and to whom you disclose it. The Commissioner can request it at any time.
2. Data processing agreements (DPAs). The external accountant, the cloud provider, the payroll or security company process data on your behalf. You need a written agreement with each of them, with the content the law requires.
3. Data breaches. An email sent to the wrong person or a lost laptop can be a breach that must be notified to the Commissioner within the short deadline set by the law, and sometimes also to the persons affected. The procedure must be ready before a breach happens.
4. Data protection impact assessment (DPIA). Large-scale use of cameras, biometric data or employee monitoring requires a prior risk assessment.
5. Transfers abroad. Cloud services and software that store data outside Albania require a legal basis for the transfer.
6. Privacy notices. Clients, employees and job applicants must be informed clearly and in good time.
7. Data protection officer (DPO). Mandatory for public authorities and for entities that systematically monitor individuals on a large scale or process sensitive or criminal-offence data on a large scale.
Where to start. A short check of these seven points quickly shows where the company stands. For call centres and information technology (IT) firms working for EU clients, the client contract often already requires GDPR standards; Albanian law makes them an obligation in Albania as well.