Moldova

MD · MDA · Europe

5 regulators · 11 laws & regulations · 8 obligations · 23 enforcement actions

Obligation	Timing	Regulator	Arises from	Source
All industries
Lawful basis, notice and data subject rights	Ongoing	CNPDCP	—	source
Law 195/2024 requires a lawful basis for processing (Art. 6(1)(a)-(f)), transparent information to individuals (Arts. 12-14) and responses to rights of access, rectification, erasure, restriction, portability, objection and automated decisions (Arts. 15-22). Controllers in certain cases must designate a data protection officer (Arts. 37-39). The law applies from 23 August 2026 according to the Centre.
Personal data breach notification	Deadline Within 72 hours of becoming aware, where possible	CNPDCP	—	source
Art. 33 of Law 195/2024 requires the controller to notify the Centre without undue delay and where possible within 72 hours of becoming aware of a breach, unless it is unlikely to risk individuals' rights and freedoms; late notices need a reasoned explanation. Processors notify the controller without undue delay, and Art. 34 covers informing affected individuals.
Whistleblowing channel and protection from retaliation	Ongoing	—	—	source
Art. 9(2) of Law 122/2018 requires the employer to approve procedures for internal examination and reporting of disclosures of illegal practices, following a model set by the Government. Art. 7(2) allows written, online or telephone submission, and Art. 18(1) makes failure to ensure disclosure within the entity a disciplinary or misdemeanour matter. Art. 18(5) puts the burden of proving that measures were unrelated to the disclosure on the employer.
Banking
AML record retention	Retention period 5 years after the end of the relationship or the transaction	NBM	Legea nr. 308/2017 privind prevenirea și combaterea spălării banilor și finanțării terorismului (Law No. 308 of 22 December 2017 on preventing and combating money laundering and terrorist financing)	source
Art. 9(1)-(2) of Law 308/2017 and item 87 of NBM Regulation 200/2018 require records to be kept for 5 years after the business relationship ends or the occasional transaction is carried out. The Service or supervisors may require an extension, which for banks cannot exceed 5 years (Regulation 200/2018, item 89).
Customer due diligence (KYC/CDD)	At onboarding + ongoing (annual / 2-yearly / 3-yearly review by risk)	NBM	Legea nr. 308/2017 privind prevenirea și combaterea spălării banilor și finanțării terorismului (Law No. 308 of 22 December 2017 on preventing and combating money laundering and terrorist financing)	source
Law 308/2017 sets standard due diligence (Art. 5), risk assessment (Art. 6), simplified (Art. 7) and enhanced measures (Art. 8), politically exposed persons (Art. 8-1) and beneficial ownership. NBM Regulation 200/2018 requires verification before the relationship starts (item 34), review every year for high-risk, two years for medium-risk and three years for low-risk customers (item 39), and bars opening or continuing a relationship where due diligence cannot be completed (item 46).
Outsourcing approval and notification by banks	Deadline Prior approval for material outsourcing; notifications within 10 working days	NBM	Regulation on outsourcing the bank's activities and operations, approved by Decision of the Executive Board of the National Bank of Moldova no. 46 of February 26, 2020	official
Item 19 requires the NBM's prior approval before outsourcing a material activity, and item 56 applies this to material ICT outsourcing. After outsourcing, the bank notifies the NBM within 10 working days with the contract (item 38) and changes to key information within 10 working days (item 37); incidents or significant changes in outsourcing risk are notified within 5 working days (item 40). Item 59(13) requires a cloud-specific risk assessment.
Suspicious transaction reporting to the Service	Deadline Immediately; special report within 24 hours of identifying the suspicion	SPCSB	Legea nr. 308/2017 privind prevenirea și combaterea spălării banilor și finanțării terorismului (Law No. 308 of 22 December 2017 on preventing and combating money laundering and terrorist financing)	source
Art. 11(1) of Law 308/2017 requires entities to inform SPCSB immediately of suspicious activities, transactions or assets, with the special form submitted within 24 hours of identifying the act. Item 85(1) of NBM Regulation 200/2018 repeats the immediate, no-later-than-24-hours rule for banks.
Payments & Fintech
ICT incident reporting by payment service providers to the NBM	Deadline Initial notice same or next working day; intermediate 3 days; final 20 days	NBM	Regulamentul privind cerințele minime pentru gestionarea riscurilor aferente tehnologiei informației și comunicațiilor, securității informației și continuității activității (Regulation on minimum requirements for ICT risk management, information security and business continuity), Decision No. 29 of 12 February 2025	official
Point 81 of the ICT regulation requires an initial notification of incidents affecting critical functions by the end of the working day (point 81.1), and for significant functions or payment services by the next working day (81.2). An intermediate report follows within 3 days (81.3) and a final report within 20 days of the initial notice (81.4).
No obligations match these filters.