Around 1 million euros in sanctions for 3 companies, the law on personal data protection begins to be implemented

2026-06-16 07:20:17, Aktualitet CNA

Around 1 million euros in sanctions for 3 companies, the law on personal data

After an intensive period of information, training and awareness-raising on the obligations arising from Law No. 124/2024 “On the Protection of Personal Data”, the supervisory authority seems to have entered a new phase of its activity, where the focus is shifting from education and orientation towards effective implementation of the law.

Administrative procedures recently completed by the Office of the Commissioner for the Right to Information and Personal Data Protection have led to the imposition of administrative sanctions with a total value of approximately 1 million euros on 3 companies, the highest level of administrative measures imposed to date by the institution.

Sanctions have been imposed on entities operating in the construction and pharmaceutical sectors, after finding violations of the legislation in force on the protection of personal data.

This development comes at a time when Albania is implementing one of the most important laws of recent years in the field of personal data protection. Law no. 124/2024, has brought new accountability standards for any public or private entity that collects, stores, uses or processes personal data.

Since the adoption of the law, the Commissioner's Office has conducted a considerable number of information and awareness-raising activities, with representatives of business, public institutions, technology professionals, information security and personal data protection officers.

Consultation tables, trainings, meetings with interest groups have been organized and, in parallel, guidelines, instructions and orientation materials have been published with the aim of creating a more complete understanding of the new legal obligations.

Under these conditions, according to experts in the field, non-compliance with legal obligations can no longer be justified by lack of information or uncertainty about the requirements of the law. The period of adaptation to the new legal framework is considered to have already passed and entities that process personal data are expected to have taken the necessary organizational, technical and administrative measures to guarantee compliance.

Observers in the field consider the imposition of these sanctions as a clear signal that the protection of personal data cannot be treated as a formal or secondary obligation. On the contrary, it constitutes a direct legal responsibility, the non-compliance of which brings concrete administrative and financial consequences.

The latest decisions are considered one of the strongest signals given to date to the market regarding the implementation of Law No. 124/2024. Although the Commissioner's Office has previously exercised its supervisory and sanctioning powers, the magnitude of the administrative measures imposed in these cases represents the highest level of sanctions applied so far by the authority. In this context, it is becoming increasingly clear that the supervisory mechanisms will not be limited to recommendations or advisory measures.

As in European Union countries, where data protection authorities exercise their powers through effective controls and sanctions, an approach is being consolidated in Albania that aims to truly guarantee respect for individuals' rights and strengthen the culture of compliance with the law. /Monitor.al