The framework
Albania regulates personal data through Law No. 124/2024 on Personal Data Protection, supervised by the Information and Data Protection Commissioner.
For advertisers the consent posture matters most, and Albania sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Law No. 124/2024 on Personal Data Protection
Albania replaced its 2008 statute with a GDPR-aligned law adopted in December 2024, with obligations phasing in through 2025 and beyond; another accession-driven convergence with EU rules.
Marketing and advertising
GDPR-aligned bases and consent standard. In practice that means consent before tracking or marketing outreach, documented well enough to show a regulator.
Cross-border transfers
Transfer rules follow the GDPR model of adequacy, appropriate safeguards and narrow derogations.
Enforcement and penalties
The 2024 law substantially increased fines. A ceiling means little until the authority uses it, so its docket is the better guide.