GPS and worker monitoring in Moldova: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Valid legal basis and information to workers (Law 133/2011 + Labour Code art. 91-94)

  Yesrequired

  The monitoring of workers (video, internet and, by extension, GPS) is governed by Law 133/2011 and the Labour Code (art. 91-94); workers must be informed about who accesses the data and what data is collected.

  Legge n. 133/2011 sulla protezione dei dati personali

• Prior notification or registration with an authority before installing

  Nonot required

  The obligation to notify/register data systems with the CNPDCP was abolished on 10 January 2022 and replaced by an impact assessment carried out by the controller.

  DLA Piper, protezione dei dati in Moldova (DPIA, registrazione abolita)

• Basis = consent or legitimate interest

  Yesrequired

  The processing is based on consent or another basis, including the legitimate interest of the controller (unless the rights of the data subject prevail).

  DLA Piper, protezione dei dati in Moldova (DPIA, registrazione abolita)

• Minimisation and purpose limitation; no excessive tracking outside working hours

  Yesrequired

  The principles of data minimisation and purpose limitation apply; continuous GPS tracking or tracking outside working hours is disproportionate.

  CNPDCP, guida sull'installazione e gestione della videosorveglianza

• Impact assessment (DPIA)

  Yesrequired

  Since 2022 the controller must carry out an impact assessment (which has replaced registration), describing the intended processing, the purpose and the legitimate interest.

  DLA Piper, protezione dei dati in Moldova (DPIA, registrazione abolita)

The procedure, step by step

1. 1

   Identify a valid legal basis (consent or legitimate interest).

2. 2

   Inform workers about what data is collected and who accesses it.

3. 3

   Carry out the impact assessment (DPIA) before activating the system.

4. 4

   Apply data minimisation and purpose limitation.

5. 5

   Configure the system: no continuous tracking or tracking outside working hours.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Legge n. 133/2011 sulla protezione dei dati personali
• CNPDCP, guida sull'installazione e gestione della videosorveglianza
• CNPDCP, presentare un reclamo
• DLA Piper, protezione dei dati in Moldova (DPIA, registrazione abolita)
• Regolamento UE 2016/679 (GDPR) - riferimento comparativo