Albania Law No. 124/2024 on Personal Data Protection

Albania's GDPR-aligned Law No. 124/2024 On Personal Data Protection, in force since 1 February 2025 and replacing Law 9887/2008: principles, lawful bases, consent (age 16 for online services), sensitive data and criminal records, 30-day responses to rights requests, access, erasure, the right to be forgotten including search engine delisting, restriction, portability, objection and automated decisions, accountability, privacy by design, a representative for foreign businesses, processor contracts, records of processing, security, 72-hour breach notification, confidentiality, impact assessments and prior consultation (in force 17 January 2027), DPOs, transfers under Commissioner adequacy decisions, clauses and binding company rules, journalism, research and direct marketing rules, the law enforcement regime of Part III, and fines up to ALL 2 billion or 4 percent of worldwide turnover. Built from the Commissioner's English version of the Law. It comprises 52 controls organised across 7 domains, and applies in Albania.