Albania's personal data protection law, explained.
A plain-language guide to Law No. 124/2024, topic by topic, with the article behind every rule.
Law No. 124/2024 “On Personal Data Protection” was adopted by the Albanian Parliament on 19 December 2024 and replaced Law No. 9887 of 2008. According to its own text, it is fully aligned with the EU General Data Protection Regulation (GDPR) and with Directive 2016/680.
The supervisory authority is the Information and Data Protection Commissioner. This guide covers the parts of the law that matter to companies and institutions; each page names the articles it is based on.
- to notify the Commissioner of a personal data breach (Article 29)
- 72 hours
- to reply to a data subject's request (Article 12)
- 30 days
- the age from which a minor can consent to online services (Article 8)
- 16 years
- of worldwide annual turnover, or ALL 2 billion: the highest fine (Article 94)
- 4%
Law 124/2024
The law, topic by topic
- Articles 3, 4, 5 and 25
Who Law 124/2024 applies to
Which organizations and which processing the law covers, inside and outside Albania.
Learn more - Articles 6, 7, 8 and 9
Principles and legal bases for processing
The seven principles, the six legal criteria, the rules on consent and sensitive data.
Learn more - Articles 12–20
Data subject rights
The eight rights every person has and the 30-day deadline for replying.
Learn more - Articles 22, 23, 26, 27 and 28
Obligations of controllers and processors
Accountability, the record of processing, contracts with processors and security measures.
Learn more - Articles 33 and 34
The data protection officer (DPO)
When one is mandatory, who can be appointed and what guarantees the law gives the role.
Learn more - Articles 31 and 32
Impact assessment (DPIA) and prior consultation
When an impact assessment is required, what it contains and when to consult the Commissioner.
Learn more - Article 29
Personal data breaches and the 72-hour notification
When and how the Commissioner is notified, what the notice contains and when affected people are told.
Learn more - Articles 39–42
International data transfers
When sending personal data outside Albania is allowed, and with what safeguards.
Learn more - Articles 83, 86, 88 and 92–95
Penalties, complaints and compensation
The two tiers of fines, how the Commissioner sets the amount, and what an affected person can do.
Learn more
Law 124/2024
Key dates
- 19 December 2024Adopted by Parliament.
- 15 January 2025Promulgated by Decree No. 5 of the President of the Republic.
- 17 January 2025Published in Official Gazette No. 9.
- February 2025Enters into force, 15 days after publication (Article 101(1)).
- January 2027Two years after publication, the postponed provisions enter into force: impact assessments and prior consultation (Articles 31 and 32), informing data subjects of breaches (Article 29(3)), and codes of conduct (Articles 35 and 36).
This guide is for information and is not legal advice. It is based on the text of Law No. 124/2024 as published by the Commissioner. Last checked on 8 October 2026. Full text of the law (PDF, in Albanian)
Let's talk about your next engagement.
Tell us about your engagement — we typically respond within one business day.