Data & Privacy - Albania

Law No. 124/2024 repeals Law No. 9887/2008 and mirrors GDPR structure including definitions of pseudonymisation, profiling, data minimisation, and sub-categories of sensitive data (biometric, genetic, health, criminal). Certain provisions, including Data Protection Impact Assessment requirements and prior consultation with the Commissioner, are deferred to take effect within two years of publication (by January 2027).

The Commissioner for the Right to Information and Protection of Personal Data (IDP) is an independent public legal entity elected by the Albanian Assembly for a seven-year term. It issues binding guidance, conducts inspections, and imposes administrative fines.

Controllers must notify the IDP of data breaches within 72 hours and notify affected data subjects when risks are high. Controllers and processors outside Albania must appoint a local representative. The general registration obligation with the Commissioner has been abolished, but prior authorisation remains mandatory for high-risk processing activities.

Council of Ministers Decision No. 347 of 19 June 2025 created the Electronic Registry of Data Protection Officers, requiring designated DPOs to be registered with the state database, aligning Albania's governance infrastructure with EU standards.

Financial penalties mirror GDPR tiers: up to 1 billion Albanian Lek (or 2% of global annual turnover) for lower-tier violations, and up to 2 billion Albanian Lek (or 4% of global annual turnover) for the most serious infringements such as unlawful processing of special categories of data.

In the first two months of 2026 alone, the IDP issued six fines — three times the total issued in the entire preceding year — signalling a decisive shift to proactive enforcement. The IDP also issued binding guidance on CCTV/video surveillance (Guideline No. 03, April 2025) and law enforcement processing (Guidance No. 05/2025, July 2025).