GPS and worker monitoring in Албания: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Prior information to workers and legal basis (Law 124/2024, art. 13)

  Yesrequired

  The worker must be informed of the purposes and legal basis before data is collected; one of the bases under art. 7 is required (in practice, legitimate interest).

  Legge 124/2024 sulla protezione dei dati personali (in vigore dal 1 febbraio 2025)

• Prior notification to or authorisation by an authority before installation

  Nonot required

  The old notification/registration with the IDP was abolished by Law 124/2024; the controller keeps an internal record of processing activities.

  Legge 124/2024 sulla protezione dei dati personali (in vigore dal 1 febbraio 2025)

• Basis = legitimate interest, not consent

  Yesrequired

  The usual basis is legitimate interest (art. 7), not consent, which in the employment relationship can hardly be freely given.

  Legge 124/2024 sulla protezione dei dati personali (in vigore dal 1 febbraio 2025)

• Least intrusive means, specific purpose and minimal retention (IDP guideline)

  Yesrequired

  For the IDP, surveillance must use the least intrusive means, be justified by a specific need and with retention as short as possible; the person under surveillance must be informed.

  IDP, linea guida n. 03 del 30.04.2025 sulla videosorveglianza

• Impact assessment (DPIA) for systematic large-scale monitoring (art. 31)

  Yesrequired

  An impact assessment is required where the processing is likely to entail a high risk, including systematic large-scale monitoring.

  Legge 124/2024 sulla protezione dei dati personali (in vigore dal 1 febbraio 2025)

The procedure, step by step

1. 1

   Identify a valid legal basis (legitimate interest, art. 7) and keep the internal record of processing activities.

2. 2

   Inform workers before collecting data (art. 13).

3. 3

   Check for the least intrusive means and a specific purpose.

4. 4

   Carry out the impact assessment (DPIA) for systematic monitoring; consult the IDP if the residual risk remains high.

5. 5

   Configure the system with data minimisation and minimal retention.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Legge 124/2024 sulla protezione dei dati personali (in vigore dal 1 febbraio 2025)
• IDP, linea guida n. 03 del 30.04.2025 sulla videosorveglianza
• IDP (Garante albanese), pagina ufficiale
• IDP, sanzione EuroCom CX (videosorveglianza dei dipendenti)
• Regolamento UE 2016/679 (GDPR) - riferimento comparativo