Cybersecurity Policy Report, New Privacy Law to Take Effect in Albania, (Jan 28, 2025)

By Tony Foley

Albania’s new data protection law, which was approved last month, was published in the Official Journal of Albania on Jan. 16. The law replaces the country’s prior privacy law from 2008, and most of its provisions will enter into force 15 days after its publication.

The Law on Protection of Personal Data No. 124/2024 of Dec. 19, 2024, is designed to align the country’s privacy and data protection provisions with those contained in the European Union’s General Data Protection Regulation. The text of the law may be accessed from this webpage, but is available only in Albanian. However, a machine translation of the bill text reveals that the bill is similar in context and scope to other implementing legislation enacted by other EU countries. Specifically, the law applies to controllers and processors established in Albania, as well as controllers and processors not established in the country that provide goods or services to Albanian data subjects or monitor the conduct of such subjects.

The law implements a variety of privacy principles, including legality and transparency, legitimate purposes for processing, data accuracy, data minimization and limited retention, integrity and confidentiality, and accountability. It specifies the conditions under which data subjects may consent to processing and the required elements of valid consent, including the need for express consent to processing of sensitive data.

Data subjects are granted rights common in most privacy laws, including the right to know what information about them is being processed and to access the information, rights to correction and deletion, the right to be forgotten, the right to object to or restrict data processing, the right to data portability, and the right not to be subject to automated decision making.

In addition, the law places obligations on data controllers, like implementing technical and organizational measures in line with privacy by design and default, ensuring contracts with third-party processors obligating them to adhere to the law’s requirements, notifying personal data breaches within 72 hours unless a breach is unlikely to result in a risk to affected data subjects, appointing a data protection officer (DPO), and carrying out data protection impact assessments (DPIAs) under specified conditions. Cross-border data transfer requirements, in line with requirements enacted by other EU countries, also are included.

With respect to enforcement, data subjects have the right to file a complaint with the Information and Data Protection Commissioner (IDP) if a controller or processor fails to respond to a request to exercise their rights under the law. The rights and responsibilities of the IDP are outlined, and fines for violations are established that can go as high as 2 billion Albanian lekë ($21 million) or up to 4% of a company’s global revenue.

As noted above, the new law will take effect 15 days after publication, but some provisions, including the requirement to conduct a DPIA and provisions regarding prior consultations with the IDP, will take effect two years after publication.

News: InternationalLegislation DataPrivacy DataBreach GDPR