Cyber Law at Albania
Albania has recently strengthened its cybersecurity and data protection legal frameworks, aligning them with European Union standards and enhancing national resilience against digital threats.
Cybersecurity Framework
Law No. 25/2024, titled "On Cybersecurity," was enacted to bolster the security of networks and information systems in Albania. This legislation mandates that all public and private entities operating critical or important information infrastructures—such as those in energy, transport, banking, health, and digital infrastructure—comply with specific cybersecurity measures. Key obligations include:
Registering critical infrastructures with the National Authority for Cybersecurity (AKCESK).
Establishing a Computer Security Incident Response Team (CSIRT) within the organization.
Implementing risk management measures and reporting significant cybersecurity incidents to the Authority.
Cooperating with national and international entities on cybersecurity matters.
Non-compliance can result in administrative fines ranging from 200,000 to 10,000,000 Albanian Lek, with potential criminal sanctions for severe violations.
This law is a significant step in Albania's commitment to EU integration and its proactive approach to cybersecurity.
Personal Data Protection
In January 2025, Albania promulgated Law No. 124/2024 "On the Protection of Personal Data," aligning with the EU's General Data Protection Regulation (GDPR). This law governs the processing and protection of personal data within Albania and extends its reach to foreign entities processing data of Albanian residents. It introduces several key provisions:
Enhanced rights for data subjects, including the right to access, rectification, erasure, restriction of processing, data portability, and objection.
Obligations for data controllers and processors to conduct Data Protection Impact Assessments (DPIAs) and consult with the Data Protection Commissioner when necessary.
Mandatory reporting of data breaches within 72 hours.
Implementation of "Data Protection by Design and by Default" principles.
Severe penalties for non-compliance, with fines up to 1 billion Albanian Lek (approximately EUR 10 million) or 2% of global annual turnover for entities, whichever is greater.
These measures aim to enhance data security and align Albania's data protection laws with international standards.
International Cooperation
Albania has also signed the Second Additional Protocol to the Convention on Cybercrime, becoming the 36th state to do so. This protocol facilitates enhanced international cooperation in cybercrime investigations and the disclosure of electronic evidence, including direct cooperation with service providers and law enforcement agencies across borders.
These legislative developments position Albania as a proactive participant in global cybersecurity and data protection efforts, reinforcing its commitment to safeguarding digital infrastructure and personal data.
RELATED Blog
0 comments