The Information and Data Protection Commissioner’s Office in cooperation with the American Chamber of Commerce (AmCham), organized an informative forum with business representatives entitled “Enhancing Standards for Personal Data Protection in Albania – Implementation of the New Law: Challenges and Solutions for Businesses.”

In his address to the members of AmCham, Commissioner Dervishi emphasized that the new Law No. 124/2024 introduces a number of substantial innovations in the field of personal data protection. These developments have a direct impact on businesses in their roles as data controllers and processors, as they are now required to ensure full transparency regarding the manner in which they process and manage personal data.

“The new law provides enhanced protection for data subjects and clearly defines the rights and obligations of each data controller and processor. It expands individuals’ rights over their personal data, including the right to access and rectify data; the right not to be subject to automated decision-making; and the right to be forgotten, which obliges businesses and online platforms to delete data that is no longer necessary for the purposes for which it was originally collected,” Commissioner Dervishi stated.

He emphasized that businesses must take stronger measures to protect personal data against loss, unauthorized access, or misuse. Moreover, the law requires businesses to appoint a Data Protection Officer (DPO), who will be responsible for overseeing compliance with the law and ensuring that appropriate safeguards are implemented.

“Beyond legal obligations, it is essential that we all shift our approach to the protection of personal data. This is not merely a legal requirement, but a necessary practice to build trust between businesses and citizens. Personal data is a valuable asset, and its protection must be a priority for every organization,” Mr. Dervishi further underlined in his remarks.

The Commissioner also provided an overview of the extensive journey that led to the adoption of this law, highlighting that its drafting and finalization came as a response to European Union requirements within the framework of the integration process, as well as Albania’s own ambition to adopt legislation fully aligned with EU regulations and directives.

The Executive Director of the American Chamber of Commerce, Mr. Neritan Mullaj, stated:“The high level of participation in this event is a clear indicator of the strong interest from businesses in this important law. Furthermore, the law provides businesses with access to become more competitive within the international and European frameworks. On the other hand, it is a complex piece of legislation, which makes collaboration and dialogue with the Commissioner’s Office essential. We must raise awareness, as this will be a valuable law for our businesses.”

The Chief of Cabinet at the Commissioner’s Office, Ms. Besa Velaj—who also served as an expert in the drafting of the Personal Data Protection Law and its accompanying set of implementing bylaws—presented the methodology for calculating the level of administrative sanctions and discussed the challenges businesses face in aligning with the requirements of the European Union’s General Data Protection Regulation (GDPR).

Albana Karapanço, Chair of the Legal, Regulatory, and Intellectual Property Rights Committee of AmCham, expressed her satisfaction that the methodology for administrative sanctions was presented for the first time during this event, describing it as an opportunity to raise awareness and provide clarity through concrete examples of how regulatory tools will function in the implementation of the law.

Business representatives shared their opinions and recommendations regarding the implementation of the new legal package, and also expressed interest in continued collaboration with the Commissioner’s Office to ensure the full enforcement of the law and its secondary legislation. The Commissioner’s Office will maintain open communication with businesses and will continue to organize training sessions and additional discussion forums aimed at strengthening capacities and ensuring the comprehensive implementation of the new data protection law.