Law No. 195/2024 on Personal Data Protection
Since 23 August 2026, Moldova’s Law No. 195 of 25 July 2024 on Personal Data Protection has introduced a modernized regulatory framework closely aligned with the EU General Data Protection Regulation (GDPR). Organizations operating in the Life Sciences sector must comply with strengthened requirements concerning the collection, processing, security and international transfer of personal data, particularly sensitive health and genetic information.
Our Experts Are Here To Help You!
Ensure your compliance with Moldova’s new Data Protection Law, in force since 23 August 2026.
Key Requirements:
- Appoint a Data Protection Officer (DPO) where core activities involve large-scale processing of special data, including health and genetic information (Article 37).
- Appoint a local Data Protection Representative (DPR) when established outside Moldova and offering goods or services to, or monitoring, individuals in Moldova (Article 27), unless established in the EEA or already represented there.
- Maintain records of processing activities (Article 30).
- Carry out data protection impact assessments (DPIAs) for processing likely to result in a high risk, including certain large-scale processing of health data (Article 35).
- Notify personal data breaches to the Data Protection Authority within 72 hours of awareness, unless the breach is unlikely to result in a risk to individuals (Article 33).
- Implement appropriate technical and organizational security measures, procedures for data subject rights, and safeguards for international data transfers.
How MyData-TRUST Can Support You:
- DPO designation and ongoing compliance support
- Assessment of local representation requirements and DPR arrangements
- ROPA preparation for clinical research, patient data, data sharing and international transfers
- DPIAs, risk assessments, data minimization, and secure retention and deletion procedures
- Incident response, breach notification and data subject rights workflows
- Data protection policies, contractual compliance and international transfer assessments
Why Compliance Matters for Life Sciences:
- Avoids administrative fines of up to MDL 2 million or 2% of annual turnover, whichever is higher
- Safeguards research participants and sensitive health and genetic data
- Limits regulatory investigations, corrective measures and restrictions on processing or transfers
- Protects your reputation and patient trust
Why Choose MyData-TRUST?
- Proven expertise in data protection for the Life Sciences industry
- Specialized support for pharmaceutical companies, CROs and healthcare organizations
- Experience supporting international clinical research and health data processing
- Compliance strategies aligned with Law No. 195/2024 and international standards, including the GDPR
Frequently asked questions
What is required for compliance with Moldova’s Data Protection Law?
Depending on the organization’s activities and applicable exemptions, key requirements include:
• DPO appointment in situations specified by the law
• Local DPR appointment for certain foreign organizations
• Records of Processing Activities (ROPA)
• DPIAs for high-risk processing activities
• Appropriate technical and organizational security measures
• Data breach notification and data subject rights procedures
• Appropriate safeguards for international data transfers
Does Moldova’s Data Protection Law apply to foreign Life Sciences companies?
Yes. Under Article 3 of Moldova’s Data Protection Law, organizations established outside the country are covered by the legislation when they offer goods or services to individuals located in Moldova or monitor their behavior within the country. Foreign pharmaceutical companies, CROs, and other Life Sciences organizations should assess whether their activities fall within the law’s territorial scope.
How does MyData-TRUST support compliance with Moldova’s Data Protection Law?
• DPO appointment and outsourced support
• Assessment of local representation requirements
• ROPA preparation and maintenance
• DPIAs and privacy risk assessments
• Data protection policies and contractual compliance
• Data breach response and data subject rights management
• International data transfer assessments
What are the risks of non-compliance with Moldova’s Data Protection Law?
• Administrative fines of up to MDL 2 million or 2% of annual turnover, whichever is higher, depending on the infringement
• Regulatory investigations and corrective measures
• Potential restrictions on processing or international data transfers
• Reputational damage and loss of patient trust
• Operational and financial consequences
Need more information about MyData-TRUST? Get in touch with our experts.
MyData-TRUST offers global coverage
