Is GDPR applicable in Albania?

Transferring personal data to Albania and the New Law - what should you be aware of?

In an increasingly globalised world, the transfer of personal data to third countries has become an integral part of the activities of multinational companies. Albania has recently updated its regulations - passing the Law no. 124/2024 on “Personal data protection” (the “New Law”), published in the official gazette no. 9 dated 17 January 2025.

The New Law is fully aligned with the Regulation (EE) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”) and repeals the existing Law no. 9887 dated 10.03.2008.

The New Law aims to bring the Albanian legal system in line with the requirements of the GDPR, which is an important step towards greater security and transparency in data processing.

What are the most crucial changes pursuant to the New Law? What should you know as a data protection officer (DPO)?

• Improved security standards – the New Law requires the implementation of appropriate technical and organisational measures, which minimises the risk of breaches, leaks or unauthorised access to data.
• Obligation to perform risk assessments – the New Law obliges companies to systematically perform risk assessments in relation to data transfer and processing, allowing potential risks to be quickly detected and eliminated.
• Data Protection by Design and Data Protection by Default – the New Law introduced the principes of Data Protection by Design and Data Protection by Default, which require entities to integrate data protection measures into every stage of their operations.
• Enhanced transparency and documentation - the New Law provides for consistent documentation requirements (e.g. keeping a record of breaches, DPIAs) and an obligation to monitor data transfer processes, which create an environment conducive to greater transparency. Businesses, including DPOs, can therefore operate on a more standardised and transparent basis.
• Guarantees of data subjects‘ rights - the New Law ensures that individuals’ rights (e.g. access to data, right of rectification, erasure) are fully respected.
• Supervision and sanctions - Albania has put in place a supervisory system that ensures continuous monitoring and enforcement of compliance, making the data transfer process safer and more transparent. An extensive system of supervision by the relevant authorities ensures that all entities comply with the New Law and violations result in sanctions, increasing the overall level of security.

What does this mean for businesses considering transferring personal data to Albania?

• Revised legal framework - Albania has introduced detailed data protection legislation (the New Law) that is compatible with European standards, including the GDPR. This means that data transfer procedures can be carried out in compliance with the applicable law, without the necessity to create complex security mechanisms.
• Legality of data transfer - Albania, as a GDPR-compliant country, now allows for safe and legal data transfer, eliminating the risk of sanctions or penalties resulting from inconsistencies.
• Protecting the company's interests - the New Law provides an adequate level of data protection, which therefore protects companies from potential legal and financial consequences.
• Trust and credibility - by transferring data to Albania, you benefit from a market that meets the criteria of international standards, which increases the security of your business and the trust of your customers.
• Ability to benefit from the Albanian market - Albania is a rapidly growing market and its harmonised regulations open up a wide range of opportunities to work with local partners and customers, while maintaining full compliance with regulations.