Data Protection on Your Business Website: What Changes on 23 August 2026

You have a contact form on your site. A Google Analytics tag. Maybe a newsletter sign-up or a customer account. Each of these collects personal data — name, email, phone, browsing behavior. And from 23 August 2026, how you collect and store it is no longer a formality but a clear legal obligation, with written rules and penalties.

On that date, Law No. 195/2024 on personal data protection takes effect, replacing the old Law 133/2011 and transposing the European GDPR into Moldovan legislation. Published in August 2024, the law allowed a 24-month transition period precisely so businesses could prepare. The deadline is approaching. This article isn't a legal treatise — it's about what you need to change concretely on your website to be in order.

This article is informational and does not constitute legal advice. For your business's specific situation, consult the National Center for Personal Data Protection (CNPDCP) or a lawyer.

What actually changes

Law 133/2011 had been in place for over a decade, but small businesses rarely applied it strictly. Law 195/2024 brings the European standard: clearer definitions, stronger rights for individuals, explicit obligations for those who collect data, and a penalty regime aligned with GDPR. The core idea stays simple: personal data doesn't belong to you, it belongs to the person. You merely process it — with a lawful basis and responsibility.

"Personal data" means any information about an identifiable person: name, email, phone, address, but also IP, cookie identifiers, or on-site behavior. If you can link a piece of information to a person, it's personal data — and it falls under the law.

What data your site collects (probably more than you think)

Most business owners underestimate how much they collect. A typical business site gathers data through:

• The contact form — name, email, phone, message.
• Web analytics — Google Analytics and ad pixels track behavior, often via cookies. See what it involves done right in our piece on web analytics with GA4.
• Newsletter / sign-up — emails and sometimes names. Here consent is essential, as we explained in the email marketing article.
• Customer account / online orders — delivery data, order history, sometimes billing details.
• Chat, quote forms, landing pages — any field where the user leaves their data.

Every collection point needs two things: a lawful basis to process the data and transparency toward the person about what you do with it.

Consent: how to ask for it correctly

Consent is the most visible lawful basis and the most commonly botched. Under the new rules, consent must be freely given, specific, informed, and unambiguous. In practice, on the site, that means:

• No pre-ticked boxes. The user must actively tick, not un-tick something already checked.
• A real cookie banner. Not just "we use cookies, OK." Analytics and marketing cookies must fire after the user accepts, with the option to refuse as easily as to accept. An "Accept" button with no equivalent "Reject" is no longer enough.
• Separate consent per purpose. Subscribing to a newsletter is not the same as accepting advertising cookies. Don't merge them into one checkbox.
• Easy withdrawal. The person must be able to unsubscribe or withdraw consent at any time, just as easily.

For analytics, this often means implementing a consent-based mode so tracking doesn't run before the visitor agrees. It's a technical change many ignore until it's too late.

The privacy policy: what it must contain

Every site that collects data needs a clear, accessible privacy policy — usually in the footer, next to the terms. Not text copied from another site, but one describing your business's reality. It should answer:

• Who you are — the operator's details (your business) and a contact for data matters.
• What data you collect — the concrete categories (name, email, order data, etc.).
• Why and on what basis — the purpose (answering a request, delivery, marketing) and the legal basis.
• Who you share it with — providers such as your payment processor, courier, email or analytics platform.
• How long you keep it — the retention period.
• What rights the person has and how to exercise them.

People's rights

The new law strengthens the rights any customer can ask of you. You must be ready to respond to:

• The right of access — "what data do you have about me?"
• The right to rectification — correcting inaccurate data.
• The right to erasure — "delete my data" (with legal exceptions, such as accounting obligations).
• The right to portability — receiving the data in a usable format.
• The right to object — to direct marketing, for example.

In practice, you need an internal process: who receives the request, how you verify identity, and how quickly you respond. It doesn't have to be complicated, but it has to exist.

Security is not optional

Data protection has a technical dimension too: you're obliged to keep data secure. A site without HTTPS, with weak passwords or no backups, not only risks an attack — it breaches the data-security principle. We detailed the measures in the guide on website security. In short: HTTPS everywhere, limited access to customer data, up-to-date patches, and backups. A reportable data breach triggers additional obligations, including notifying the authority within strict deadlines.

What to do on your site before 23 August 2026

A practical list, in a sensible order to work through:

• Inventory your collection. Note every place the site requests or records data: forms, analytics, pixels, newsletter, customer account.
• Update the privacy policy to reflect the reality above — not a generic template.
• Implement a proper cookie banner with equivalent accept/reject and tracking that fires only after consent.
• Clean up your forms. Ask only for the data you need (minimization), add a consent checkbox where appropriate, and a link to the privacy policy — including on campaign landing pages.
• Separate marketing consent from the rest, especially for email.
• Check security — HTTPS, backups, access.
• Prepare a rights process — how you answer an access or deletion request.
• Check registration obligations with the CNPDCP, if your activity requires them.

According to the CNPDCP, the authority overseeing the law's application, data processing must respect the principles of lawfulness, transparency, and minimization. For many businesses, compliance is a natural part of the broader business digitalization process — not a separate project, but a standard of any serious website.

What you risk if you ignore it

Beyond penalties — which under the new regime can be significant — the real risk is trust. A customer who finds out you used their data without telling them, or leaked it, doesn't come back. Compliance isn't only about avoiding a fine; it's a signal of seriousness that, in a small market like Moldova, matters.

Frequently asked questions

Conclusion

From 23 August 2026, data protection becomes a mandatory standard for any business website in Moldova, not a formality. The good news: for most businesses, compliance means a handful of concrete steps — an honest privacy policy, a correct cookie banner, forms that ask only for what's needed with clear consent, basic security, and a simple process for customer rights. Done in time, it's reasonable work. Left to the last minute, it becomes an emergency. And beyond the letter of the law, a website that treats data with respect earns the hardest resource to recover: the customer's trust.