Albanian DPL

Overview

Albania enacted a comprehensive GDPR-aligned data protection law on December 19, 2024, incorporating both the GDPR and the EU Law Enforcement Directive. This is one of the most GDPR-aligned laws outside the EU/EEA, with penalties matching GDPR levels at up to 4% of global turnover.

What This Means for Your Website

• Consent must be freely given, informed, and explicit for processing personal data of Albanian visitors
• Direct electronic marketing requires prior, explicit, informed consent with an easy opt-out mechanism
• Controllers must maintain documented proof of consent
• Penalties match GDPR scale: up to 4% of global turnover or ALL 2 billion
• Some provisions are phased in over two years from the January 2025 effective date

Key Requirements

The IDP (Information and Data Protection Commissioner) enforces the law with GDPR-scale penalties in two tiers: up to ALL 1 billion or 2% of turnover (Tier 1) and up to ALL 2 billion or 4% of turnover (Tier 2). The law requires documented proof of consent and clear withdrawal mechanisms. As an EU candidate country, Albania's strong alignment with EU standards is part of the accession process.

How ConsentStack Handles This

ConsentStack applies GDPR-compliant consent standards for Albanian visitors, meeting the law's requirements for explicit consent and documented proof of consent.