Law 195/2024 was adopted on 25 July 2024 and entered into force on 23 August 2026 — it replaces the earlier Law 133/2011 and brings the EU GDPR approach into Moldovan law.
The law sets two tiers of fines: up to 1,000,000 lei (or up to 1% of the company's annual turnover, whichever is greater) for less serious violations, and up to 2,000,000 lei (or up to 2% of turnover) for serious ones — including breaches of processing principles, consent requirements, data subject rights, and cross-border transfer rules. Tracking a visitor without consent falls into exactly this category.
Fines are phased in: 10% of the calculated amount in the first year after the law takes effect, 40% in the second year, and the full amount from the third year on. Right now is the first year — the moment to get your site in order while penalties are still reduced.
Compliance is checked and fines are imposed by the National Center for Personal Data Protection (CNPDCP). Before fining, the Center weighs the severity and duration of the violation, the number of people affected, whether it was intentional or negligent, and what corrective steps were taken — minor violations may get a warning instead of a fine.