As part of the gradual implementation of sublegal acts under Law No. 124/2024 “On the Protection of Personal Data”, which fully aligns with the EU General Data Protection Regulation (GDPR), the Albanian Data Protection Commissioner has issued Decision no. 1, titled “On the determination of countries that ensure an adequate level of personal data protection” (“Decision no.1”).
This new decision provides a list of countries deemed to offer adequate protection for personal data. As a result, personal data may be transferred from Albania to these jurisdictions without requiring additional safeguards, such as standard contractual clauses or explicit consent from the data subject. Although Decision No. 1 formally repeals a previous decision with the same subject matter, it does not introduce substantive changes to the criteria or the list of countries considered adequate.
The countries recognised as adequate include all EU and EEA member states, where the GDPR is directly applicable. In addition, the list covers countries that are parties to the Council of Europe’s Convention 108, provided they have implemented domestic data protection laws and have functioning independent supervisory authorities. Also included are third countries that have received a formal adequacy decision from the European Commission, confirming that their legal framework ensures a comparable level of data protection.
The full list of recognised countries is set out in an annexe to Decision no. 1, offering a clear reference for organisations seeking to verify whether a particular jurisdiction qualifies for unrestricted data transfer. The decision is available on this link.
The information in this document does not constitute legal advice on any particular matter and is provided for general informational purposes only.
