• When the processing is based on the data subject’s consent for the processing of their personal data for one or more specific purposes, or when the data subject has given explicit consent for the processing of such personal data for one or more specific purposes, except where legislation provides that the prohibition in paragraph (1) cannot be lifted by the data subject’s consent, the Data Subject has the right to withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

• The Data Subject has the right to file a complaint with the National Center for Personal Data Protection (CNPDCP):

MD-2004, Chișinău, str. Serghei Lazo, 48
Phone: (022) 820 801
Anti-corruption phone line: (022) 811 807, (022) 820 801 Institutional information line
Email: centru@datepersonale.md

According to Law 195/2024

If the operator does not take action regarding the request of the data subject, the operator shall inform the data subject, without undue delay and within a maximum of one month from the receipt of the request, about the reasons for not taking action and about the possibility to file a complaint with the National Center and to initiate legal proceedings.

The designation of a representative by the operator or a person authorized by the operator does not affect the right to file a complaint with the National Center or to initiate legal proceedings against the operator or the person authorized by the operator.

The rights of data subjects regarding processing and the means of exercising these rights, including the right not to be subject to decisions based solely on automated processing, including profiling, in accordance with Article 22, the right to file a complaint with the National Center and to initiate legal proceedings in accordance with Article 74, as well as the right to obtain remedies and, where appropriate, compensation for the violation of mandatory corporate rules;

The data subject has the right to initiate legal proceedings under Article 74, as well as to request compensation under Article 76, if they consider that their personal data has been processed in violation of paragraph (1) of this Article.

Without prejudice to Articles 72 and 73, and without affecting alternative dispute resolution procedures, any data subject has the right to file a claim with the competent court if they consider that the rights they enjoy under this law have been violated as a result of the processing of their personal data without compliance with this law.

The data subject has the right to mandate an entity, organization, or non-profit association, which has been properly constituted in accordance with the law, whose statutory objectives are of public interest and which are active in the field of protecting the rights and freedoms of data subjects regarding the protection of their personal data, to file a complaint on their behalf, to exercise on their behalf the rights mentioned in Articles 72–74, as well as to exercise on their behalf the right to receive compensation referred to in Article 76, if this is provided for by the applicable legislation.

1. Any person who has suffered material or moral damage as a result of a violation of this law has the right to obtain compensation from the operator or the person authorized by the operator for the damage suffered.

2. Any operator involved in processing operations is liable for the damage caused by its processing operations that violate this law. A person authorized by the operator is liable for the damage caused by processing only if they have not fulfilled the obligations under this law specifically assigned to authorized persons or acted outside or contrary to the operator’s legal instructions.

3. The operator or the person authorized by the operator shall be exempt from liability under paragraph (2) if they prove that they are not in any way responsible for the event that caused the damage.

4. If several operators or several persons authorized by the operator, or an operator and a person authorized by the operator, are involved in the same processing operation and are liable under paragraphs (2) and (3) for any damage caused by the processing, each operator or authorized person is liable for the entire damage to ensure effective compensation of the data subject.

5. If an operator or a person authorized by the operator has fully paid, in accordance with paragraph (4), the compensation for the damage caused, that operator or authorized person has the right to request from the other operators or authorized persons involved in the same processing operation the recovery of the portion of the compensation corresponding to their share of liability for the damage, under the conditions established in paragraph (2).

6. Actions to exercise the right to recover compensation shall be submitted to the competent courts in accordance with the law.