A data protection impact assessment (DPIA) is carried out before starting processing that may result in a high risk to individuals' rights and freedoms, particularly where new technologies are used (Article 31(1)).
Entry into force
Articles 31 and 32 enter into force two years after the law's publication in the Official Gazette (Article 101(2)). The law was published in January 2025, so these duties become applicable in January 2027. Organizations planning new systems have good reason to prepare earlier.
When it is particularly required (Article 31(6))
- Systematic and extensive evaluation of personal aspects by automated processing, including profiling, on which decisions with legal or similar effects are based.
- Large-scale processing of sensitive or criminal data.
- Systematic monitoring of a publicly accessible area on a large scale.
The Commissioner draws up and publishes lists of the processing operations for which an assessment is required and those for which it is not (Article 31(7)).
What it contains (Article 31(3))
- A systematic description of the processing operations and their purposes.
- An assessment of the necessity and proportionality of the processing.
- An assessment of the risks to data subjects' rights and freedoms.
- The measures envisaged to address the risks.
Where a data protection officer has been appointed, the controller consults the officer during the assessment (Article 31(4)).
Prior consultation (Article 32)
If the assessment shows that, without mitigating measures, the processing would result in a high risk, the controller asks for the Commissioner's opinion before starting. The Commissioner replies no later than 60 days from receiving the request and may extend the deadline by no more than 45 days, depending on complexity.
This guide is for information and is not legal advice. It is based on the text of Law No. 124/2024 as published by the Commissioner. Last checked on 8 October 2026. Full text of the law (PDF, in Albanian)
