Who Law 124/2024 applies to

Law No. 124/2024 applies whenever personal data is processed wholly or partly by automated means. It also applies to non-automated processing where the data forms part of a filing system or is intended to form part of one (Article 3(1)).

The only exclusion is processing by natural persons for personal or household purposes (Article 3(2)). The size of the organization is not a criterion: the law applies equally to a bank, a clinic, an online shop or a public institution.

Controller and processor

• A controller is the natural or legal person, or public authority, that alone or jointly with others determines the purposes and means of the processing (Article 5(8)).
• A processor is whoever processes personal data on behalf of the controller (Article 5(18)), for example a payroll, hosting or call-center provider.

The distinction matters because most obligations fall on the controller, while the processor acts on the controller's instructions and under a written contract.

Territorial scope

• Controllers and processors established in Albania, whether or not the processing takes place in Albania (Article 4(1)(a)).
• Controllers outside Albania that offer goods or services, paid or free, to people who are in Albania (Article 4(1)(b)).
• Controllers outside Albania that monitor people's behavior, as far as that behavior takes place in Albania.

Representative in Albania

A controller or processor abroad that falls under the law because it offers services or monitors behavior appoints a representative established in Albania and notifies the Commissioner of the representative's identity in writing (Article 25(1)).

This duty does not apply to public authorities, nor where the processing is occasional, does not involve sensitive or criminal data on a large scale and is unlikely to result in a risk to people's rights and freedoms (Article 25(2)).