What Is Law No. 124/2024, "On Personal Data Protection"?
Albania’s operative domestic privacy statute is Law No. 124/2024, "On Personal Data Protection." It was adopted on 19 December 2024, published in Official Gazette No. 9/2025, and entered into force on 1 February 2025. The former Law No. 9887/2008 was repealed, while existing subordinate acts, decisions, authorizations, and qualifying international agreements continue temporarily where they do not conflict with the new law. The law is not yet fully operative. Article 101(2) delays Articles 29(3), 31, 32, 35, 36, 64, 65, and 67(2)/(3)/(5) until 17 January 2027. No separate post-enactment amending statute was located in the reviewed QBZ, parliamentary, or Commissioner materials. The Commissioner describes the law as fully approximating the GDPR and EU Police Directive for EU-integration purposes, but this is domestic legislative approximation, not direct GDPR application.
At a glance
- Full name
- Law No. 124/2024, "On Personal Data Protection"
- Short code
- Law 124/2024
- Jurisdiction
- Albania
- Enacted
- 2024
- Last major update
- Entered into force 1 February 2025; Articles 29(3), 31, 32, 35, 36, 64, 65, and 67(2)/(3)/(5) remain delayed until 17 January 2027; no separate post-enactment amending statute was located
- Regulator
- Information and Data Protection Commissioner
- Private right of action
- Limited
- Statutory citation
- Law No. 124/2024, "On Personal Data Protection"
Scope, who Law 124/2024 covers
Protected data
Data subject rights
Right to information about processing
Right of access, including a first copy free of charge
Right to rectification
Right to erasure under specified grounds and subject to exceptions
Right to be forgotten and conditional search-engine de-indexing on request
Right to restriction of processing
Right to data portability for consent- or contract-based processing of subject-supplied data
Right to object, including an unconditional objection to direct marketing
Safeguards concerning automated decision-making
Right to complain to the Commissioner
Notable features
The law closely approximates GDPR-style protections while remaining domestic Albanian law. Its principal currentness trap is the delayed commencement of specified provisions until 17 January 2027. The Albanian statutory text controls, while the Commissioner-hosted English translation is a reference aid only. Cross-border transfers use adequacy decisions, safeguards, and limited exceptions, including the Commissioner’s Decision No. 1/2025 framework.
Enforcement & penalties
Regulator: Information and Data Protection Commissioner
Penalties: Specified controller, processor, certification-body, and monitoring-body obligations may attract up to 1,000,000,000 lekë, or for a company 2% of worldwide annual turnover, whichever is higher. Breaches of processing principles, consent requirements, data-subject rights, international-transfer rules, Articles 43-46 obligations, cooperation duties, or Commissioner orders and restrictions may attract up to 2,000,000,000 lekë, or for a company 4% of worldwide annual turnover, whichever is higher. Proportionality, effectiveness, and deterrence factors apply under Articles 93-95.
Private right of action: The report identifies judicial-access and court-appeal routes rather than a general private damages action. If the Commissioner does not examine a complaint or report progress within 90 days, Article 87(2) provides a court-access trigger. Article 87 defers the appeal deadline against a Commissioner decision to administrative-litigation legislation, and no numeric deadline was located in the law itself.
Relevance to data brokers
Not located. No Albania-specific complaint or deletion route for data brokers, people-search sites, or public-record aggregators was found in the reviewed QBZ, parliamentary, or Commissioner materials. The general mechanisms are Articles 13-19 access, rectification, erasure, restriction, and objection; Article 16’s conditional search-engine de-indexing mechanism; the Article 86 Commissioner complaint; and Article 44’s balancing test concerning official documents and public information.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Is Albania’s privacy law fully in force?+
No. Law No. 124/2024 entered into force on 1 February 2025, but Articles 29(3), 31, 32, 35, 36, 64, 65, and 67(2)/(3)/(5) are delayed until 17 January 2027.
Can I complain to Albania’s data-protection Commissioner?+
Yes. Article 86 allows a data subject to complain to the Commissioner free of charge, electronically or by other means. No fixed complaint-filing or final merits-decision deadline was located in the law.
Does Albania have a dedicated data-broker deletion route?+
Not located. The reviewed materials identify only the general access, rectification, erasure, restriction, objection, search-engine de-indexing, and Commissioner complaint mechanisms.
Official sources & citations
Other international privacy regimes
Law 124/2024 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: