What Law 195/2024 actually changed
Law 195/2024 on the protection of personal data is Moldova's update to how businesses are allowed to collect, store and use visitor and customer data online. It brings local practice closer to the EU's GDPR: real consent before tracking, named legal grounds for processing, disclosed data recipients, and a supervising authority — the CNPDCP (Centrul Național pentru Protecția Datelor cu Caracter Personal) — that can act on complaints.
For most Moldovan business owners this is not an abstract legal question. It is a list of concrete things a website is either doing or not doing. Below is the checklist we use when we bring a site into compliance.
The practical checklist
- A real cookie banner. "Accept all", "Decline" and "Customize" need equal visual weight — no pre-ticked boxes, no dark patterns that make declining harder than accepting. The choice has to be reachable again later, typically from the footer.
- Nothing tracks before consent. Google Analytics, Meta Pixel, and any other analytics or ad script must not load until the visitor has actively agreed. Loading the script and asking forgiveness after is the single most common violation we see.
- Privacy, Cookies and Terms pages, in the languages you serve. If the site is bilingual RO/RU (or trilingual with EN), the legal pages need to be too — not just the homepage. Each should name the legal basis for processing, list the 7 rights of the data subject under the law, name who receives the data (hosting provider, email service, CRM, ad platforms), and disclose any transfer outside Moldova (Google, Meta, Telegram, and most cloud tools all count).
- A real footer. Legal entity name, IDNO (or equivalent registration number), physical address, and a dedicated contact for data requests — a
privacy@yourdomainmailbox is the norm, and it has to actually receive mail. - Consent checkboxes default to empty. Any form that leads to marketing contact, a newsletter, or data storage needs an unchecked consent checkbox, not one pre-ticked "for convenience".
- A breach procedure, even if you never use it. The law expects a defined process for notifying the CNPDCP and affected people within 72 hours of discovering a data breach. This lives off the website, but it has to exist.
- A processing register. An internal document listing what personal data you collect, why, where it is stored, and how long you keep it. Auditors and the CNPDCP can ask for this; most businesses have never written it down.
- A DPO assessment. Not every business needs a dedicated Data Protection Officer — but you need to have actually assessed whether yours does, based on the volume and sensitivity of data you process, and keep that assessment on file.
What happens if you skip this
Enforcement in Moldova is younger than in the EU, but the CNPDCP does investigate complaints, and a competitor, a disgruntled customer, or a routine audit can trigger one. The realistic cost is not usually the fine on day one — it is the scramble to retrofit compliance under a deadline, with a regulator already looking, instead of doing it calmly once.
A real example: Selekt Doors Moldova
In September 2026 we brought selektdoors.md, a premium interior-doors retailer, into compliance with Law 195/2024 alongside a UI refresh. That meant every item on the checklist above: an equal-weight cookie banner, GA4 gated behind analytics consent, bilingual RO/RU Privacy/Cookies/Terms pages naming the CNPDCP and the 7 subject rights, a compliant footer with IDNO and a working privacy@selektdoors.md address, an empty-by-default consent checkbox on the quote form, and the off-site paperwork — processing register, 72-hour breach procedure, processor checklist, and a DPO assessment (not required at their current scale). Read the full case study.
Getting your site compliant
Most of this is a focused one- to two-week project once we know what tracking and forms are already on the site: a consent system, updated legal pages in the languages you serve, a footer fix, and the internal paperwork the law expects. Book a call and we will tell you honestly whether your current site is compliant, and what it would take to get there.