Data protection & privacy laws in Albania (2026)

In the first two months of 2026 the Albanian Data Protection Commissioner issued six administrative fines — triple the total imposed in all of 2025 — signalling a decisive shift from advisory to assertive enforcement under Law No. 124/2024. Sectors targeted include IT providers, call centres, travel agencies, and medical centres.

The Commissioner adopted Instruction No. 07/2025 governing personal data protection in written, electronic, and audiovisual media, repealing rules dating to 2010–2012 and introducing a modern framework that balances press freedom with privacy rights in line with GDPR principles.

The Commissioner adopted Guidance No. 05/2025 to operationalise Law No. 124/2024 in law enforcement contexts, aligning national practice with EU Directive 2016/680 (the Law Enforcement Directive) and clarifying conditions under which competent authorities may process data for public order and national security purposes.

The Commissioner published Decision No. 1 listing countries deemed to offer adequate data protection — including all EU/EEA states and EC-recognised third countries — allowing free transfers to those jurisdictions without additional safeguards such as standard contractual clauses.

Albania's new data protection law became operative, introducing data protection by design and by default, mandatory DPIAs, Data Protection Officers, GDPR-equivalent sanctions (up to ALL 20 million or 4 % of global turnover), and GDPR-aligned definitions for biometric, genetic, and health data; select articles have a two-year transition period.

Albania forwarded its instrument of ratification for the Amending Protocol to Convention 108 (CETS 223), becoming the 19th state to ratify the modernised treaty whose principles mirror core GDPR concepts; the ratification helped the protocol reach half the signatures needed for its own global entry into force.

Iranian cyber actors deployed ransomware and disk-wiping malware against Albanian government systems, shutting down e-government services and exfiltrating sensitive personal data including identities of intelligence officers; Albania severed diplomatic ties with Iran in September 2022 — the first country ever to expel a foreign mission solely over a cyberattack.

Albania's Parliament amended the 2008 data protection statute, expanding the definitions section and refining processing rules; this was the final substantive modification before the complete replacement in 2024, and left the framework without the key GDPR concepts of pseudonymisation, profiling, or data protection by design.

The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) — the first binding international data protection instrument — came into force for Albania, establishing foundational international obligations that shaped the 2008 domestic law.

Albania passed its inaugural data protection law, combining it with the right to information and placing oversight with the Ombudsman (Advocate of the People) rather than a dedicated authority; while rudimentary by later standards it established prior notification, consent requirements, and a personal data registry.