🔑 New Obligations for Data Controllers and Data Processors
The new Law No. 124/2024 introduces significant obligations for data controllers and processors, including:
- Implementation of appropriate technical and organizational measures to ensure lawful and secure data processing, such as data pseudonymization, data minimization, and other security measures;
- Application of the principles of Data Protection by Design and by Default;
- Mandatory notification of personal data breaches to the Commissioner for the Right to Information and Protection of Personal Data within 72 hours of becoming aware of the breach and, where required, notification of the affected data subjects;
- Carrying out a Data Protection Impact Assessment (DPIA) before initiating processing operations that are likely to pose a high risk to the rights and freedoms of individuals;
- Prior consultation with the Commissioner where high-risk processing is envisaged;
- Appointment of a Data Protection Officer (DPO) where required by law;
- Ensuring continuous compliance with the provisions of the law;
- Adoption of Codes of Conduct to promote compliance;
- The possibility of obtaining certification from accredited certification bodies as evidence of compliance with the legal requirements.
🌍 International Transfers of Personal Data
Personal data may be transferred outside the Republic of Albania only where the receiving country or international organization ensures an adequate level of data protection or where appropriate legal safeguards for the transfer are in place, in accordance with the law.
⚖️ Sanctions
Failure to comply with personal data protection obligations may result in administrative fines of up to ALL 1 billion or 2% of the company’s total worldwide annual turnover, whichever is higher.
For more serious infringements, including violations of the fundamental principles of data processing, infringement of data subjects’ rights, or unlawful international data transfers, fines may reach ALL 2 billion or 4% of the company’s total worldwide annual turnover, whichever amount is higher.
For further information or assistance with compliance, feel free to contact us.
