Plain-language analysis and practical how-to guides to help Albanian organizations get and stay compliant with Law 124/2024 and the GDPR it is aligned with.
In 2025 the Commissioner ran 15 health-sector investigations: 8 dental clinics, 7 medical laboratories. What Instruction 02/2025 requires under Law 124/2024 and the GDPR, and how a clinic proves it.
Read more →Instruction No. 03 of 30 April 2025 governs CCTV under Law 124/2024 and is sanctioned under Art. 94. The written decision almost nobody has, 72-hour retention, the 75% rule for residential buildings, and why an access request freezes deletion.
Read more →Not one publicly reported sanction under Law 124/2024 turns on sophisticated processing. Missing registers, absent processor contracts, images published without consent. Why basic failures are the ones inspections find, and why any count of fines is a floor rather than a total.
Read more →Handing data to a vendor does not hand over the responsibility. What Art. 26(3) of Law 124/2024 requires in a processing agreement, the Albanian equivalent of GDPR Art. 28(3), plus due diligence, sub-processors and the transfer question most registers miss.
Read more →Cookies are the one compliance gap anyone can see from outside. Transparency against consent under Art. 8 of Law 124/2024 and GDPR Art. 7, what Instruction 04/2025 adds, essential against non-essential, and why tracking surfaces drift.
Read more →Law 124/2024 asks you to demonstrate compliance, not only to comply. Why siloed programmes fail at the seams, how the Albanian article numbers differ from the GDPR ones, and what a compliance score has to be built from to count as evidence.
Read more →Articles 12-21 of Law 124/2024 give individuals seven rights over their data, and Article 12 gives you 30 days to answer - extendable to 60 in total, but only with notice. What the deadline really covers, when you may refuse, and the three failures that cost companies the clock.
Read more →Article 27 of Law 124/2024 - the Albanian equivalent of GDPR Article 30 - requires a written register of processing activities. What a usable entry contains, a worked payroll example, and why the annual spreadsheet fails.
Read more →Article 31 of Law 124/2024, the Albanian equivalent of GDPR Article 35, requires a DPIA before high-risk processing. The triggers, how DPIA, PIA, VRA, TIA and SRA fit together, a worked HR example, and when prior consultation under Article 32 is the route.
Read more →Albania's Commissioner has moved from guidance to sanctions, and the reported fines are for basic failures rather than technical ones. What the law requires, what the fines have actually been for, and how the law, which is aligned with the GDPR, is being enforced in practice.
Read more →What has already happened under Law 124/2024, what is deferred to January 2027, and what is still coming. The dated sequence of instructions, the enforcement shift, and the most commonly misread part of the timeline.
Read more →When designating a Data Protection Officer (DPO) is mandatory, what the role actually does day to day, how independence is guaranteed, and when an external DPO makes sense - under Law 124/2024.
Read more →In November 2025, the Commissioner adopted Instructions No. 08 and No. 09, creating the regime for certification and data protection seals and marks under Law 124/2024. Here is how the mechanism works and what changes for Albanian controllers and processors.
Read more →