Recently, the Albanian Data Protection Commissioner issued Instruction No. 4, dated 30 April 2025, “On Personal Data Protection and Security Measures in Direct Marketing” (“Instruction”). Adopted pursuant to Law No. 124/2024 “On the Protection of Personal Data,” the Instruction marks a notable step in the implementation of Albania’s modernised data protection regime, which is now fully aligned with the EU General Data Protection Regulation (GDPR).
This new regulation provides much-needed clarity and structure for both public and private entities acting as data controllers or processors engaging in direct marketing. It applies to a wide range of marketing activities, including email campaigns, SMS communications, call centres, and other forms of promotional outreach, especially those involving personal profiling or third-party data sourcing.
Under this Instruction, direct marketing is defined broadly as any communication directed at an identifiable individual to promote goods, services, memberships, or donations. What makes this particularly impactful is that the scope also extends to preparatory activities by the advertiser or a third party, meaning that even the planning phase of a campaign involving personal data is now clearly regulated.
An essential element of the new framework is the requirement for a clearly defined legal basis when processing personal data for direct marketing. While controllers may rely on their legitimate interest to justify such processing, this is permitted only when it does not override the rights and freedoms of the individual. In all other cases, particularly where sensitive data, profiling, or third-party sources are involved, the controller must obtain the data subject’s explicit and informed consent.
Particular attention is given to children’s data, with the Instruction categorically stating that individuals under the age of 18 benefit from heightened protection. Any data collection targeting minors, such as participation in contests or receipt of promotional materials, must be accompanied by verifiable parental or guardian consent. Furthermore, marketing content must be age-appropriate, transparent, and easy to understand, reflecting the unique vulnerabilities of this audience.
Transparency is a core theme throughout the Instruction. Data subjects must be clearly informed at the time of data collection, or within one month if the data comes from other sources, about who is collecting their data, for what purpose, and their full rights under the law. This includes the unqualified to object to direct marketing, which, once exercised, obliges the controller to immediately cease all related data processing.
The Instruction also reinforces the principle of purpose limitation. Data collected for direct marketing must not be repurposed unless the new use is compatible, lawful, and communicated in advance to the data subject. Any further processing must respect the original context in which the data was collected and avoid introducing additional risks to the individual’s privacy.
Security obligations are equally emphasised. Data controllers and processors must adopt appropriate technical and organisational measures to safeguard personal data, considering the sensitivity of the information, the risks involved, and current technological standards. Where third-party processors are engaged, the controller remains fully responsible for ensuring that equivalent safeguards are in place and observed.
By replacing outdated guidance, this Instruction sets a clear and modern standard for lawful direct marketing in Albania by marking a shift toward greater transparency, accountability, and respect for individual rights.
The information in this document does not constitute legal advice on any particular matter and is provided for general informational purposes only.
