Moldova: how to exercise data rights after the public services cyberattack

Moldova’s data protection authority, the Centrul Național pentru Protecția Datelor cu Caracter Personal (CNPDCP), has published guidance for people worried that their personal data was affected by the cyberattack on digital public services. It matters because it turns a technical incident into a practical route for exercising rights.

What the authority has said

The CNPDCP reminds people that they are entitled to information on how their data may have been affected, and to exercise the rights under Legea nr. 195/2024 privind protecția datelor cu caracter personal (Law No. 195/2024 on personal data protection). It explains that assessing the impact requires technical checks and confirmation by the institutions involved, each within its own remit. People will be told when services are restored, what security measures were taken, what results are confirmed, and how those whose data was affected will be informed.

The Centre has also opened an investigation into how the incident occurred and whether the entities managing the systems met their legal obligations. It says it will publish its findings and any measures it orders.

Three routes for individuals

• First, the controller. Anyone who has noticed suspicious access can write to the Agenția de Guvernare Electronică (AGE), which runs the government electronic services, by electronically signed petition (office@egov.md) or on paper with a handwritten signature. They may ask about the accesses they flag, the institutions behind them, their purposes and legal bases, and the possible consequences for their data. The CNPDCP stresses that only the controller knows the processing operations and can check whether a person’s data was affected.
• Then, a complaint to the CNPDCP. The Centre’s form may be used (it is optional), but the complaint must meet Article 79 of Law No. 195/2024. The Centre warns that it can rule on the merits only once the investigation is complete, through a reasoned decision.
• Court action. Under Article 74 of the same law, anyone who believes their rights have been infringed may sue the controller or its processor. This is separate from the administrative complaint.

The CNPDCP advises keeping notifications, screenshots showing the date and time of accesses, and any replies received, as they may serve as evidence.

Who does what

The authority insists that it does not manage databases or directly secure them. That responsibility lies with controllers, who must apply appropriate technical and organisational measures and be able to demonstrate compliance. The Centre supervises and, where needed, investigates.

Our view at CEA Digital Law

At the Euro-American Committee of Digital Law - CEA Digital Law, we welcome an authority explaining in plain language whom to contact, in what order and with what evidence. That clarity reduces uncertainty in the first days of a crisis. The structure echoes the EU GDPR (access, complaint to the authority and judicial remedy), which makes comparison with other countries easier.

We suggest three ideas that countries in Europe, Latin America and the Caribbean, and Africa may wish to consider. First, public bodies should have a single contact channel and indicative response times ready before an incident occurs. Second, access logs should make it possible to answer precisely “who accessed, when and on what basis”. Third, communication with those affected should be proactive rather than dependent on each person asking.

Open questions remain: when affected individuals will be notified directly, how long the investigation will take, and how the data authority and cybersecurity bodies will coordinate. We will follow with interest the decisions the CNPDCP says it will make public.

Sources

• Centrul Național pentru Protecția Datelor cu Caracter Personal (CNPDCP)

CEA Digital Law