Free whiteglove setup from a ConsentStack Concierge

Moldovan DPL

Law No. 195/2024 on the Protection of Personal Data

Flag of MD
MoldovaOpt-inEuropeNational
Back to Regulations Guide

Key Facts

Effective Date
August 23, 2026
Enacted
July 25, 2024
Enforcing Authority
NCPDP (National Centre for Personal Data Protection)
Consent Model
Opt-in
Applies To
Any organization processing personal data of individuals in Moldova

Overview

Moldova enacted a comprehensive GDPR-aligned data protection law on July 25, 2024, and it has applied since August 23, 2026, after a two-year preparation period. It replaced the earlier Law 133/2011 and transposes the GDPR into Moldovan legislation, though the maximum penalty is capped at 1% of turnover rather than the GDPR's 4%.

What This Means for Your Website

  • Explicit consent is required before processing personal data of Moldovan visitors, including through cookies
  • The law has been in force since August 23, 2026
  • Data minimization and purpose limitation principles apply
  • Maximum penalties are up to 1 million Moldovan lei or 1% of annual turnover

Key Requirements

The NCPDP (National Centre for Personal Data Protection) is the independent enforcement authority. The law requires explicit consent for personal data processing, purpose limitation, data minimization, and provides standard data subject rights. Penalties cap at 1% of turnover, significantly lower than GDPR levels. Enforcement began August 23, 2026.

How ConsentStack Handles This

ConsentStack applies GDPR-aligned opt-in consent for visitors from Moldova.

Penalties

Up to 1 million Moldovan lei or up to 1% of annual turnover for companies.

Maximum Fine
MDL 1,000,000 aggregate
Revenue-based
1% of annual revenue

Key Requirements

  • Explicit consent before personal data processing including cookies
  • Data collected only for legitimate, specific, and stated purposes
  • Data minimization principle
  • NCPDP notification and cooperation requirements
  • Right to withdraw consent at any time

Notable Provisions

  • In force since August 23, 2026, after a two-year preparation period
  • Fully transposes GDPR into Moldovan law
  • Maximum penalty of 1% turnover (lower than GDPR 4%)
  • NCPDP established as independent enforcement authority

Other Europe Regulations

GDPREU + EEA
The GDPR sets the global standard for data protection, requiring explicit opt-in consent before processing personal data of EU/EEA residents. For websites, non-essential cookies must be blocked until visitors actively consent. Pre-ticked boxes and implied consent are invalid.
PECRUnited Kingdom
PECR is the UK's cookie-specific law, requiring consent before storing or accessing information on a visitor's device unless an exception applies. The Data (Use and Access) Act 2025 raised the maximum penalty from GBP 500,000 to GBP 17.5 million or 4% of global turnover and, from 5 February 2026, added exceptions for low-risk uses such as analytics that only improve your own site, which visitors must be able to refuse.
ePrivacy DirectiveEU + EEA
Article 5(3) of the ePrivacy Directive is the primary EU legal basis requiring cookie consent. It mandates prior informed consent before storing or accessing any information on a user's device, with narrow exceptions only for transmission necessity and explicitly requested services.
FDPAFrance
France has the most actively enforced cookie regime in Europe. CNIL issued 259 corrective decisions in 2025, with cookie-specific fines totaling EUR 486.8 million including EUR 325M against Google. A Refuse all button or Continue without accepting must appear on the first layer.
UK GDPRUnited Kingdom
The UK GDPR is the retained EU GDPR post-Brexit, with consent standards identical to the EU version. The UK adequacy decision was renewed December 2025, valid until December 2031. Combined with PECR, it forms the legal framework for cookie consent in the UK.
SI 336/2011Ireland
Ireland implements the ePrivacy Directive through SI 336/2011. The DPC is the lead supervisory authority for major tech companies headquartered in Ireland including Meta, Google, Apple, and Microsoft. Uniquely, cookie consent is limited to 6 months and must then be refreshed.

Frequently Asked Questions

Stay compliant with Moldovan DPL

ConsentStack helps you implement Opt-in consent for Moldova automatically.

Get started free