Personal Data Protection for Companies: What to Prepare by 2026
By Vladislav Mocanu
CEO, Managing Partner
15.06.2026
Personal data protection is no longer a formal annex to a website or a document copied from the internet. For companies, it is becoming a real area of legal, operational and reputational risk.
In the Republic of Moldova, the new Law No. 195/2024 on personal data protection is expected to enter into force on 23 August 2026. Until then, the current framework remains applicable, but companies that wait until the last month to prepare risk treating a time-consuming compliance process superficially.
In the Republic of Moldova, the new Law No. 195/2024 on personal data protection is expected to enter into force on 23 August 2026. Until then, the current framework remains applicable, but companies that wait until the last month to prepare risk treating a time-consuming compliance process superficially.
What must be understood from the start
Compliance is not just a privacy policy on a website. It means knowing what data is collected, why it is collected, on what legal basis, to whom it is disclosed, how long it is kept, how it is secured and how the company responds to data subject requests.
Common risks in companies
In practice, many companies collect more data than necessary, fail to distinguish clearly between controller and processor roles, do not have adequate contracts with suppliers, use consent incorrectly, do not control employee access to data and lack procedures for security incidents.
What should be prepared
The first step is mapping data flows: clients, employees, candidates, visitors, website users, partners and suppliers. The company should then review privacy policies, information notices, processor agreements, internal procedures, access rules, retention periods, technical and organisational measures and mechanisms for responding to requests.
Why it matters for business
Data protection is not only about sanctions. Partners, investors and clients increasingly ask how data is managed. A company that can demonstrate compliance inspires trust and reduces the risk of delays in audits, transactions, procurement or international cooperation.
Conclusion
Preparation for the new legal framework should start early. The documents must reflect the company’s real activity, not consist of generic forms.
Mocanu Legal assists companies with compliance analysis, drafting data protection documentation and structuring internal procedures tailored to their actual operations.
Compliance is not just a privacy policy on a website. It means knowing what data is collected, why it is collected, on what legal basis, to whom it is disclosed, how long it is kept, how it is secured and how the company responds to data subject requests.
Common risks in companies
In practice, many companies collect more data than necessary, fail to distinguish clearly between controller and processor roles, do not have adequate contracts with suppliers, use consent incorrectly, do not control employee access to data and lack procedures for security incidents.
What should be prepared
The first step is mapping data flows: clients, employees, candidates, visitors, website users, partners and suppliers. The company should then review privacy policies, information notices, processor agreements, internal procedures, access rules, retention periods, technical and organisational measures and mechanisms for responding to requests.
Why it matters for business
Data protection is not only about sanctions. Partners, investors and clients increasingly ask how data is managed. A company that can demonstrate compliance inspires trust and reduces the risk of delays in audits, transactions, procurement or international cooperation.
Conclusion
Preparation for the new legal framework should start early. The documents must reflect the company’s real activity, not consist of generic forms.
Mocanu Legal assists companies with compliance analysis, drafting data protection documentation and structuring internal procedures tailored to their actual operations.
