The NCPDP is responsible for the enforcement of the Law on Personal Data Protection. The NCPDP is entitled to: 

• carry out checks;
• consider complaints from data subjects;
• require the submission of necessary information about personal data processing by the data controller;
• require the undertaking of certain actions according to the law by the data processor, including discontinuance of the processing of personal data;
• file court actions;  

Violation of personal data protection legislation may result in administrative liability.  The maximum administrative penalty that can be imposed, as at the date of this review, is MDL (Moldovan lei) 15,000 which is about EUR 780.

If the violation has led to material or moral damages, the violator may be required by the court to reimburse such damages. 

The NCPDP may also suspend or prohibit the processing of data if the rules on personal data protection are breached.

In addition to above, the New Data Protection Law introduces revised penalties for violations of data protection rules. Pursuant to the new legal provisions, infringements of statutory data protection norms may result in administrative fines of up to MDL 2,000,000 (approximately EUR 104,339), or, in the case of undertakings, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher.

These provisions are not yet in effect and will become enforceable as of 23 August 2026. 

The New Data Protection Law also establishes a transitional period concerning the application of penalty amounts. During the first three years following the entry into force of these provisions, the penalty amounts will be applied incrementally. The sanctions will gradually increase each year until they reach the maximum amounts specified above.