What we look at
- The homepage and up to 6 pages inside the site
- The privacy policy and the company details: name, IDNO, address, email, phone
- Forms that ask for a name, a phone number or health details
- What the page loads by itself: analytics, pixels, fonts, maps
- On a shop: the pay button, the 14 days, VAT
Adapting a site to Law 195/2024
The law has been in force since 23 August 2026. In Chișinău we build sites and rework ones that are already live: the privacy page, the company details, the forms. If there is a shop, we look at the distance order separately.
The check on this page is free. It reads the public pages. It is not a letter from CNPDCP. If the site needs fixing, that is our work.
Personal data: what a person should see before sending the form
Law 195/2024 has applied since 23 August 2026. It replaced Law 133/2011 and brought in the GDPR rules. It applies when a form, a server log, a cookie or a pixel relates to a living person.
Consent is only one of six legal bases. A “call me back” request, with a name and a phone number, can rest on the steps before a contract. It does not need an “I agree to the policy” box. The link to the policy still sits by the form. A newsletter, analytics and ads the page can open without do need consent. A box ticked in advance and silence are not consent: the law asks for a clear action. Saying no has to be as easy as saying yes.
For an online service offered directly to a child, the child can consent alone from the age of 14, when consent is the basis you chose. Younger children need a parent. A diagnosis, symptoms and medical images do not rest on the general line “I agree to the policy”.
Before sending, the person should see who you are, why you take the data, on what basis, who receives it, whether it leaves the country, how long you keep it, and what they can ask for: access, correction, deletion, restriction, objection, portability, and a complaint to the Centre. You answer a request within a month. If there are many requests, or they are hard, the time can be extended by two more months, and the person is told about the extension within the first month.
The Centre’s fine, Article 88, is up to 1,000,000 MDL or 1% of the previous year’s turnover for organisation, and up to 2,000,000 MDL or 2% for principles, consent, rights and transfers. The higher sum applies. In the first year from 23 August 2026 the applied fine is 10% of the calculated amount, 40% in the second year, and the full amount from the third year. A missing IDNO is outside that ceiling.
When you don’t need a cookie banner
The law does not say “put a banner on every site”. Writing to a visitor’s phone or computer, Law 241/2007 Article 62³, needs a clear explanation and consent. The exception is what the service they asked for cannot work without: the session, form protection, remembering the cookie choice.
If the page itself loads Google Analytics, the Meta Pixel, Hotjar, Google Fonts or a map, the request leaves before any click. Then the choice comes before the load, and Decline is no harder to find than Accept. If there are no such scripts, the report says a banner is not required. An ordinary link does not call the other server until someone clicks it.
The IDNO, address, email and phone, where people can find them
Law 284/2004, Article 12, says the site must always show the name and legal form, the IDNO, the legal address, the email and the phone number. Letter (c) names the address, the email and the phone in one line. The details are in Romanian. Another language may be added. Law 8/2016, Article 5, asks again for the address and phone when you sell to a consumer at a distance.
If the work needs a licence, publish the number, the term and who issued it. For a regulated profession, the title and the professional body. The VAT code, if you are a payer. The price, the discounts and whether tax is included. Whether delivery is included and what it costs. The phone and website of the consumer-protection agency. How to pay, and how long the offer lasts.
The old controller registration number came from repealed Law 133/2011. It is no longer published. Before an online order, Article 21 asks for the technical steps, whether you keep the contract, how to fix a mistake, and in which languages it is concluded. Article 23: confirmation goes out without delay. Article 22: a commercial email only if the person agreed beforehand.
An online shop and the 14 days
Law 8/2016 covers distance orders. Before the offer binds the buyer, you show the main features, the name in Romanian and the IDNO, the address and phone, the total price with taxes, payment, delivery, the deadline, the 14 days, the model withdrawal form and the legal guarantee. If there is no right to withdraw, you say so. The information is in the state language. You can add other languages.
The button says plainly that the order means payment: “Comandă cu obligație de plată”, “Cumpără acum”, “Plătește acum”, or an equally clear phrase. If it does not, the buyer does not have to pay. At the start of checkout, delivery limits and payment methods are visible. Confirmation goes by email, no later than delivery.
Withdrawal lasts 14 calendar days, and no reason is required. If you never mentioned the period, it stretches by 12 months after the original 14 days. The money comes back within 14 days. A “call me back” request with no cart is not this order. Then we don’t look for the button or the 14-day period.
Email advertising
Law 62/2022, Article 26: a page that carries advertising shows the company details, the IDNO, the administrator’s name, the postal address and the email. Email advertising, including ads that follow behaviour, only after a clear yes. Withdrawal is free and takes effect within 72 hours.
Law 241/2007, Article 62¹¹, leaves a narrow exception. An address collected when you sell your own product may be used for similar products of yours, if you offer an opt-out at collection and in every message, and the person did not refuse at the start.
What we can’t see from the outside
The processing record, contracts with processors, an impact assessment and the 72-hour notice procedure are not on the public page. Neither is whether someone ticked a newsletter in their inbox. If the report is silent about them, that does not mean they are fine, and it does not mean the papers are missing. We don’t score 0 to 100. We don’t write “you are in breach” and we don’t calculate a fine. For your own case, ask a lawyer. The Centre’s site is datepersonale.md.
Questions
Do you bring a site in line with Law 195/2024?
The pages, yes: the policy, the footer and the forms. This check does not say the site complies with the law. We are a web studio in Chișinău, not the CNPDCP.
Do I need a cookie banner if I have no Analytics?
No. A banner is needed when the page itself loads analytics, ads, fonts or maps before the person chooses. Without those requests, the report does not ask for one.
Do I tick a box on a name-and-phone form?
Not if the person only asks for a call back. A box is for newsletters and marketing, and it starts empty. A link to the policy still sits by the form.
Why does a site need an IDNO and a phone number?
Law 284/2004, Article 12(c), requires the name, the IDNO, the legal address, an email and a phone number, always easy to find and in Romanian. The phone number is named in the same line as the address and the email.
What fine does Law 195/2024 set?
Up to 1,000,000 MDL or 1% for organisation duties, and up to 2,000,000 MDL or 2% for principles, consent, rights and transfers. The higher sum applies. In the first year, 10% of the calculated fine is applied, 40% in the second, and the full amount from the third. A missing IDNO is outside that.
Is the report a CNPDCP decision?
No. It is what shows on the public pages. For your own situation, ask a lawyer. The Centre’s site is datepersonale.md.