← Global Privacy Laws Research Library
Law No. 124/2024
Albania Law No. 124/2024 on Personal Data Protection
Prepared by Shubhank Suman · Last reviewed
CURRENT / IN FORCE (15 days after publication; some articles two years after publication)
- Legal character
- Statute
- Region
- Europe
- Approved
- 19 December 2024 (promulgated by Decree No. 5 of 15 January 2025)
What it covers
Albania's new data-protection law, stated to be fully aligned with the GDPR and with Directive (EU) 2016/680 on law-enforcement processing. It applies to controllers and processors established in Albania and to non-established controllers offering goods or services to, or monitoring, people in Albania. It covers principles, legal bases, data-subject rights, controller and processor duties, transfers, supervision, sanctions and a part on processing by competent authorities for criminal-law purposes.
Why it matters
It replaces Law No. 9887 of 2008 and brings Albania's regime into line with EU law ahead of EU accession, relevant to businesses serving people in Albania.
Refer to it when
Use it for GDPR-equivalent compliance in Albania, extraterritorial reach, law-enforcement processing, or the staged entry into force of specific articles.
AI, privacy and cybersecurity relevance
- AI: Low
- Privacy: Very High
- Cyber: Moderate
AI
LOW RELEVANCE
Applies to AI where personal data is processed, including automated decisions.
Privacy
VERY HIGH RELEVANCE
Comprehensive GDPR-aligned statute for Albania.
Cybersecurity
MODERATE RELEVANCE
Security and breach duties.
Applicability
Controllers and processors established in Albania, and non-established controllers targeting or monitoring people in Albania; competent authorities for criminal-law processing.
Current validity
CURRENT / IN FORCE. The supplied English text does not state the Official Gazette publication date, so the two-year date for the delayed articles should be checked. Read the official PDF on this page for the operative text.
Read first
Articles 3–4 (scope) → definitions and principles → rights → controller duties → transfers → Article 101.
Provisions / sections covered
Articles 3–4 – Material and territorial scope
Automated and filing-system processing; extraterritorial reach on GDPR lines.
Data-subject rights and controller duties
GDPR-aligned rights, accountability and processor rules.
Repeals
Law No. 9887 of 10.3.2008 is repealed on entry into force; some provisions are repealed on Albania's EU accession.
Article 101 – Entry into force
In force 15 days after publication; Articles 29(3), 31, 32, 35, 36, 64, 65 and 67(2), (3) and (5) apply two years after publication.
Subject-matter tags
- Data subject rights
- Automated decision-making
- Controller and processor
- Enforcement and penalties
- Surveillance
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.