Plain-language analysis and practical how-to guides to help Albanian organizations get and stay compliant with Law 124/2024 and the GDPR it is aligned with.
Articles 12-21 of Law 124/2024 give individuals seven rights over their data, and Article 12 gives you 30 days to answer - extendable to 60 in total, but only with notice. What the deadline really covers, when you may refuse, and the three failures that cost companies the clock.
Read more →Article 27 of Law 124/2024 - the Albanian equivalent of GDPR Article 30 - requires a written register of processing activities. What a usable entry contains, a worked payroll example, and why the annual spreadsheet fails.
Read more →Article 31 of Law 124/2024, the Albanian equivalent of GDPR Article 35, requires a DPIA before high-risk processing. The triggers, how DPIA, PIA, VRA, TIA and SRA fit together, a worked HR example, and when prior consultation under Article 32 is the route.
Read more →Albania's Commissioner issued more fines in the first two months of 2026 than in all of 2025. What the law requires, what the fines have actually been for, and how the law, which is aligned with the GDPR, is being enforced in practice.
Read more →What has already happened under Law 124/2024, what is deferred to January 2027, and what is still coming. The dated sequence of instructions, the enforcement shift, and the most commonly misread part of the timeline.
Read more →When designating a Data Protection Officer (DPO) is mandatory, what the role actually does day to day, how independence is guaranteed, and when an external DPO makes sense - under Law 124/2024.
Read more →In November 2025, the Commissioner adopted Instructions No. 08 and No. 09, creating the regime for certification and data protection seals and marks under Law 124/2024. Here is how the mechanism works and what changes for Albanian controllers and processors.
Read more →