Article 19 of the 2024 Law provides that the processing of personal data is subject to prior authorisation issued by the Personal Data Protection Authority. Article 27 of the Draft Decree provides for 3 types of authorisations:

• prior notice,
• prior declaration and
• prior authorisation.

Further, Article 39 (1) provides that the controller or processor shall keep a physical or digital register of the processing operations carried out under his/her responsibility. 

The register shall contain the following information: 

• the name and contact details of the controller and, where applicable the name of the processor
• the purposes of processing data
• a description of the categories of data subjects and personal data
• the categories of recipients to whom the personal data have been or will be disclosed
• documents attesting to the existence of appropriate safeguards or the number of the authorization issued by the Personal Data Protection Authority