You filled out an online form. Left a phone number at a clinic. They asked for your IDNP for a subscription. All of this involves personal data — and most people don't know what happens to it.
In the Republic of Moldova, personal data protection is regulated by law. Here's what you need to know, whether you're an individual whose data is processed, or a company processing data.
What personal data is
Any information that identifies you directly or indirectly is personal data:
- Name and surname
- IDNP
- Address (home, workplace)
- Phone number and email
- Financial data (bank account, income)
- Biometric data (fingerprints, photos for identification)
- IP address and online browsing data
Some data is sensitive — health, religious beliefs, sexual orientation, political affiliation, genetic data. These have enhanced protection and can only be processed under very restrictive conditions.
Who can process your data
Processing means any operation: collection, storage, use, transmission, modification, deletion.
Anyone who processes personal data must have a legal basis. The most common legal bases:
- Your consent — you explicitly agreed (e.g., checked a box, signed a form)
- Contract performance — processing is necessary to deliver a service you requested
- Legal obligation — state institutions can process data based on law (e.g., tax authority, police)
- Legitimate interest — the company has a legitimate interest that doesn't violate your rights (e.g., fraud prevention)
Without a legal basis — processing is illegal. Simple.
Your rights as a data subject
The law gives you clear rights over your data:
1. Right to information
You must be informed who processes your data, for what purpose, on what legal basis, and to whom it may be transmitted. Without transparency — processing is irregular.
2. Right of access
You can request access to your data at any time: what they have, where they got it, who they shared it with. The controller must respond within 30 days.
3. Right to rectification
If data is incorrect or incomplete — you can request correction. It's your right, not a favor.
4. Right to erasure (right to be forgotten)
Under certain conditions, you can request deletion of your data. For example: data is no longer necessary for the purpose it was collected, or you withdraw consent and there's no other legal basis.
5. Right to portability
You can request your data in a structured format to transfer to another controller.
6. Right to object
You can object to processing based on legitimate interest or for direct marketing. No one can spam you without your right to say stop.
7. Right to withdraw consent
If you gave consent — you can withdraw it at any time. Just as easily as you gave it.
For companies: controller obligations
If you hold or process others' data — you have obligations:
- Have a legal basis for each processing
- Inform individuals about processing (clear privacy policy)
- Minimize data — collect only what's strictly necessary
- Secure data — technical and organizational measures against unauthorized access
- Retain data only as long as necessary — then delete
- Respond to requests from data subjects within 30 days
- Report breaches to the authority and affected individuals
Non-compliance can lead to significant fines. The National Center for Personal Data Protection (NCPDP) can impose sanctions.
Most common violations
- Collection without information — taking data without saying what they'll do with it
- Forced consent — can't refuse without losing the service (e.g., "if you don't accept, we don't sell")
- Data used for different purpose — collected for X, used for Y without consent
- Unauthorized transmission — your data given to third parties without consent
- Indefinite retention — data not deleted when no longer needed
- Weak security — data stored unencrypted, accessible
What to do if your data is abused
- Identify the controller — who processes the data?
- Request information — use your right of access to see what they have
- Request rectification or erasure — in writing, with proof of receipt
- If they don't respond or refuse — file a complaint with NCPDP
- If there's damages — you can seek compensation in court
The NCPDP complaint is free. The authority investigates and can impose sanctions. You don't need a lawyer to file a complaint.
Personal data in debt recovery
For us, as a recovery service, processing debtor data is essential — but strictly regulated:
- We process data only on legal basis (contract performance, legitimate interest in recovery)
- We collect only data relevant to recovery
- We don't publish, don't share with unauthorized third parties
- We delete data when no longer needed
- We respond to any access or erasure request
Debt recovery doesn't mean ignoring the debtor's rights. On the contrary — the correct procedure respects the law, because only that holds up in court.
Conclusion
Your personal data is yours. Not a gift to companies. Not a price for living in society. The law protects it — but protection works only if you know your rights and exercise them.
If you have questions about how we process data — or want to exercise a right — contact us. We're transparent and respect the law.