
The new GDPR compliant data protection act (Law no. 124/2024, "On the protection of personal data") was published today in the Albanian Official Gazette.
The Law no. 124/2024 will come into effect as from the 1 February 2025, which is 15 (fifteen) days after its publication in the Official Gazette.
There will be a 2 (two) years delay from the effective date regarding the entry into force of certain provisions dealing with (i) the mandatory Data Protection Impact Assessments and relevant prior consultations with the Commissioner for the Right to Information and the Protection of Personal Data (the "Authority"), (ii) the notification of data breaches to the data subjects, (iii) codes of conduct and the accredited bodies to monitor their compliance.
Decisions and authorizations issued by the Authority before the entry into force of the Law no. 124/2024 will remain valid as long as they do not conflict with the provisions of the new act.
International agreements involving the transfer of personal data to third countries or international organizations, concluded before the entry into force of Law no. 124/2024, which are compliant with the previous data protection act, shall remain in force until they are amended, replaced or denounced.
The Law no. 124/2024 requires the Council of Ministers to approve, within 3 months from its entry into force, the organization structure of the Authority and the compensation of its staff.
New act requires the Authority to approve, within 3 months from its entry into force, the new secondary legislation on a number of matters, as required under the Law no. 124/2024.
Kommentare