Albania
◆Binding
Binds Controllers and processors generally, with no size, sector or turnover threshold and no public/private split, subject only to the law-enforcement carve-out. Art. 20 sits in Part II of the Law, which carries the GDPR; Part III (arts. 47-74) carries the Law Enforcement Directive and applies instead to competent authorities processing for the prevention, investigation, detection or prosecution of criminal offences, the execution of criminal penalties, and the protection against threats to public, defence and national security. The same body processing for an ordinary purpose — its own staff records, for instance — answers to art. 20 and not to art. 53. Hiring sifts, credit scoring, insurance pricing and automated benefit or eligibility decisions are the paradigm cases; a decision with a human materially in the loop falls outside art. 20(1), which reaches only decisions based «vetëm», solely, on automated processing, and the Law supplies no gloss on what degree of human involvement defeats that. Art. 21 permits the rights in arts. 13-20 to be restricted by law subject to the essence, necessity and proportionality test.. Art. 20 of Ligj nr. 124/2024 «Për mbrojtjen e të dhënave personale» is Albania's general automated-decision rule and it follows GDPR art. 22 with one drafting change that matters. Art. 20(1): «Subjekti i të dhënave ka të drejtë të mos jetë subjekt i një vendimi që bazohet vetëm në përpunimin automatik të të dhënave, përfshirë profilizimin, i cili shkakton pasoja ligjore ose pasoja të ngjashme të rënda mbi të.» The trigger is a decision resting solely on automated processing, profiling included, which causes legal effects or similar SERIOUS effects — «të rënda», grave or severe — where GDPR art. 22(1) says «similarly significantly affects him or her». The Albanian threshold is drafted in terms of the gravity of the effect rather than its significance, and the comparison to the legal-effects limb is retained. Art. 20(2) supplies the same three exits as GDPR art. 22(2): the decision is necessary for concluding or performing a contract between the data subject and the controller; it is authorised by a law to which the controller is subject and which itself lays down appropriate measures protecting the data subject's rights, freedoms and legitimate interests; or it rests on the consent of the person to whom the data relate. Art. 20(3) governs sensitive data: processing sensitive data for automated decisions requires the data subject's clearly expressed consent, or a legal provision in accordance with art. 9(2)(e), and in either case appropriate protective measures. Art. 20(4) is the safeguards clause and it is where the human-review right lives: in the cases of paras. 2 and 3 the controller applies appropriate measures to protect the data subject's rights, fundamental freedoms and legitimate interests, including the data subject's right to manual intervention by the controller — «ndërhyrje manuale nga ana e kontrolluesit» — to express their point of view and to contest the decision. Profiling is defined at art. 5(19) as any form of automated processing consisting in the use of data to evaluate certain aspects relating to a natural person, in particular to analyse or predict aspects concerning performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. The transparency side is separate and unconditional: arts. 13 and 14 both require the controller to inform the data subject of the existence and the logic of automated decision-making and profiling under art. 20(1) and (3) and, at least in those cases, of the significance and the envisaged consequences of that processing for the data subject.
In force since 1 February 2025. Art. 101(1): «Ky ligj hyn në fuqi 15 ditë pas botimit në Fletoren Zyrtare.» Publication in Fletorja Zyrtare nr. 9 was on 17 January 2025, so the Law entered into force on 1 February 2025. Art. 101(2) defers a closed list of articles — 29(3), 31, 32, 35, 36, 64, 65 and 67(2), (3) and (5) — to two years after publication, that is 17 January 2027; the deferred list covers the data-protection impact assessment at art. 31, prior consultation at art. 32, codes of conduct at art. 35 and monitoring bodies at art. 36, and it does NOT contain art. 20 or art. 53, both of which have applied since 1 February 2025. Art. 99(1) repealed Law no. 9887 of 10 March 2008 on the protection of personal data, as amended, on the same day, so the 2008 regime is superseded rather than supplemented; art. 99(2) keeps the sub-legal acts made under the 2008 Law alive until replaced, so far as they do not conflict. Art. 98 converts every reference to the 2008 Law in other legislation into a reference to this Law. Art. 100 is unusual and worth reading before relying on this row long term: on the date of Albania's accession to the European Union all provisions of this Law are repealed except those of Parts III and IV, so art. 20 is drafted to fall away in favour of the GDPR itself while art. 53 is drafted to survive. Supersession check, 27 August 2026: a query of the QBZ Alfresco repository for acts of type «ligj» whose text names Law 124/2024 returns the original, the corrigendum reprint and no amending act, and the QBZ act record for the Law carries no amending gazette reference, so art. 20 stands as enacted. Albania has no AI-specific statute in force and no published bill. A draft National AI Strategy 2025-2030 went to public consultation in 2025 and has not been adopted; the Digital Agenda 2022-2026 and a Council of Ministers decision on methodology and technical standards for the use of AI in public administration are policy instruments addressed to state bodies, not obligations on controllers, and formal drafting of an EU AI Act-aligned law is expected only on the accession timetable. Nothing is tracked as an obligation on that basis. The text relied on is the promulgated Law as published by the Qendra e Botimeve Zyrtare in Fletorja Zyrtare nr. 9, dated 17 January 2025, read end to end from the QBZ repository's own PDF at https://qbz.gov.al/alfresco/api/-default-/public/alfresco/versions/1/nodes/921d3810-ab2a-4e45-bdca-bef3a84b2721/content — 327,906 bytes, closing «Miratuar në datën 19.12.2024. Shpallur me dekretin nr. 5, datë 15.1.2025, të Presidentit të Republikës së Shqipërisë, Bajram Begaj.» The ELI cited as the source is the official QBZ permalink for the same act and is the human-facing citation; qbz.gov.al is an Angular single-page application that answers a 4,274-byte shell to every path, so a fetch of the ELI proves nothing — that is the shell, not rot, the same pattern as Serbia's pravno-informacioni-sistem.rs and Senegal's cdp.sn. QBZ also carries a corrected reprint, ligj-2024-12-19-124-korrigjuar.pdf, published 24 June 2025 under the consolidated ELI http://qbz.gov.al/eli/ligj/2024/12/19/124/cons/202506-24; it was downloaded and diffed against the original, and the text of arts. 20 and 53 is byte-identical in both, so the corrigendum does not touch either rule.
Stated maximum penalty — Up to 2,000,000,000 lekë, or in the case of a commercial company up to 4% of total global annual turnover for the preceding financial year, whichever is higher. Art. 94(2)(b) names the breach expressly and puts it in the Law's top band: administrative offences punished at that level include «shkeljet e të drejtave të subjekteve të të dhënave sipas neneve 12-20 të këtij ligji», which carries art. 20 on its face. The lower band at art. 94(1) is up to 1,000,000,000 lekë or 2% of global turnover, whichever is higher, and covers controller and processor duties under Chapter III of Part II. Art. 93(2) sets the GDPR art. 83(2) circumstances the Commissioner must weigh and allows the fine to be accompanied by or replaced with the corrective measures of art. 83(2)(a)-(f); art. 93(3) caps concurrent breaches arising from the same or linked processing operations at the amount set for the gravest of them. Art. 94(4) requires the Commissioner to issue an instruction, based on European Data Protection Board guidelines, on whether and to what extent these sanctions are imposed. Art. 95 gives the controller or processor an appeal against the fining decision. Supervision and enforcement sit with the Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale. Impact tier: all entities.
Albania
◆Binding
Binds Competent authorities only, and the Law defines the trigger by purpose rather than by institution. Part III of the Law (arts. 47-74) governs the processing of personal data by competent authorities for public or national security and for the prevention, investigation, detection or prosecution of criminal offences and the execution of criminal penalties, and art. 53 sits inside it. The division from art. 20 is by purpose: the same police force processing its own payroll answers to art. 20. Private controllers are outside art. 53 entirely, with one edge — a private body exercising delegated public powers for one of those purposes is a competent authority for these provisions. Art. 61 separately requires the controller's record of processing to carry information on the use of profiling where profiling is used, which gives the supervisor a documentary route into art. 53. Art. 100(1) repeals the whole Law on the date of Albania's accession to the European Union with the express exception of Parts III and IV, so art. 53 is one of the provisions drafted to survive accession; art. 100(2) keeps those provisions of the rest of the Law that Part III cross-refers to alive for competent-authority processing.. Art. 53 is the law-enforcement counterpart of art. 20 and, following art. 11 of Directive (EU) 2016/680, it is drafted as a prohibition on the authority rather than as a right the individual must invoke. Art. 53(1): «Ndalohet marrja e vendimeve të bazuara vetëm te përpunimi automatik, përfshirë profilizimin, të cilat sjellin pasoja ligjore negative për subjektin e të dhënave ose mund të ndikojnë ndjeshëm te subjekti i të dhënave, me përjashtim të rastit kur parashikohen shprehimisht me ligj, i cili parashikon masa të përshtatshme mbrojtëse për të drejtat e liritë themelore të subjektit të të dhënave dhe të drejtën që t'i sigurohet ndërhyrje manuale nga ana e kontrolluesit.» Three drafting choices matter. The effects limb is narrowed by «negative» — the legal consequences must be adverse — but widened by «mund të ndikojnë», so the prohibition bites on the capacity to affect the person significantly rather than on realised effect. There is no consent exit and no contract exit: the single way out is an express statutory basis that itself prescribes appropriate safeguards, and the floor for those safeguards is named in the article — the right to manual intervention by the controller. And unlike art. 20(4), the person is given no right here to express a view or to contest the decision; the enabling statute must supply whatever more it supplies. Art. 53(2) does two things: such decisions may not rest on sensitive data unless appropriate measures protecting the data subject's rights, fundamental freedoms and legitimate interests are in place, and — as a separate sentence — decisions under para. 1 that result in discrimination against natural persons on the basis of sensitive data are prohibited outright. Art. 53(3) then goes wider than any decision: «Profilizimi që sjell si pasojë diskriminimin e personave për shkak të të dhënave sensitive është i ndaluar.» That is a flat, exceptionless ban on profiling which results in discrimination on sensitive-data grounds — tied to no decision, to no effects threshold and to no «solely automated» qualifier, so it reaches profiling that merely feeds a human decision, and it admits no statutory override. It is the near-exact twin of art. 39(3) of Serbia's Personal Data Law, and the two are the only provisions of their kind in this dataset. Art. 52(2) makes the specific limits of art. 53(2) a condition on any processing of sensitive data by a competent authority.
In force since 1 February 2025 on the same art. 101(1) timetable as art. 20; art. 53 is not in the art. 101(2) list of articles deferred to 17 January 2027. Art. 101(1): «Ky ligj hyn në fuqi 15 ditë pas botimit në Fletoren Zyrtare.» Publication in Fletorja Zyrtare nr. 9 was on 17 January 2025, so the Law entered into force on 1 February 2025. Art. 101(2) defers a closed list of articles — 29(3), 31, 32, 35, 36, 64, 65 and 67(2), (3) and (5) — to two years after publication, that is 17 January 2027; the deferred list covers the data-protection impact assessment at art. 31, prior consultation at art. 32, codes of conduct at art. 35 and monitoring bodies at art. 36, and it does NOT contain art. 20 or art. 53, both of which have applied since 1 February 2025. Art. 99(1) repealed Law no. 9887 of 10 March 2008 on the protection of personal data, as amended, on the same day, so the 2008 regime is superseded rather than supplemented; art. 99(2) keeps the sub-legal acts made under the 2008 Law alive until replaced, so far as they do not conflict. Art. 98 converts every reference to the 2008 Law in other legislation into a reference to this Law. Art. 100 is unusual and worth reading before relying on this row long term: on the date of Albania's accession to the European Union all provisions of this Law are repealed except those of Parts III and IV, so art. 20 is drafted to fall away in favour of the GDPR itself while art. 53 is drafted to survive. Art. 53 is new law rather than a re-enactment: the repealed Law no. 9887/2008 had a single automated-decision provision and no prohibition addressed to law-enforcement bodies, and nothing resembling the art. 53(3) discriminatory-profiling ban. Supersession check, 27 August 2026: no amending act to Law 124/2024 is recorded in the QBZ repository and the corrigendum reprint of 24 June 2025 leaves art. 53 byte-identical. Albania has no AI-specific statute in force and no published bill. A draft National AI Strategy 2025-2030 went to public consultation in 2025 and has not been adopted; the Digital Agenda 2022-2026 and a Council of Ministers decision on methodology and technical standards for the use of AI in public administration are policy instruments addressed to state bodies, not obligations on controllers, and formal drafting of an EU AI Act-aligned law is expected only on the accession timetable. Nothing is tracked as an obligation on that basis. The text relied on is the promulgated Law as published by the Qendra e Botimeve Zyrtare in Fletorja Zyrtare nr. 9, dated 17 January 2025, read end to end from the QBZ repository's own PDF at https://qbz.gov.al/alfresco/api/-default-/public/alfresco/versions/1/nodes/921d3810-ab2a-4e45-bdca-bef3a84b2721/content — 327,906 bytes, closing «Miratuar në datën 19.12.2024. Shpallur me dekretin nr. 5, datë 15.1.2025, të Presidentit të Republikës së Shqipërisë, Bajram Begaj.» The ELI cited as the source is the official QBZ permalink for the same act and is the human-facing citation; qbz.gov.al is an Angular single-page application that answers a 4,274-byte shell to every path, so a fetch of the ELI proves nothing — that is the shell, not rot, the same pattern as Serbia's pravno-informacioni-sistem.rs and Senegal's cdp.sn. QBZ also carries a corrected reprint, ligj-2024-12-19-124-korrigjuar.pdf, published 24 June 2025 under the consolidated ELI http://qbz.gov.al/eli/ligj/2024/12/19/124/cons/202506-24; it was downloaded and diffed against the original, and the text of arts. 20 and 53 is byte-identical in both, so the corrigendum does not touch either rule.
Stated maximum penalty — No fine ceiling is stated for this article, and that gap is on the face of the Law rather than a gap in this research. Art. 92 states generally that breaches of the Law by controllers or processors are punished with administrative sanctions in accordance with the following articles of the chapter, and art. 93(1) then directs the Commissioner to impose sanctions «për shkeljet e këtij ligji, sipas pikave 1, 2 dhe 3, të nenit 94» — that is, according to the enumeration in art. 94. That enumeration is drawn entirely from Part II and from the Commissioner's own orders: art. 94(1) covers arts. 8(6) and 11 and Chapter III of Part II, certification bodies under arts. 37-38 and monitoring bodies under art. 36(3); art. 94(2) covers the principles at arts. 6-9, data-subject rights at arts. 12-20, third-country transfers at arts. 39-42 and the duties at arts. 43-46; art. 94(3) covers non-cooperation with the Commissioner and breach of an order, temporary or definitive processing limitation or suspension of data flows issued under art. 83(2)(b), at up to 2,000,000,000 lekë or 4% of global turnover. None of those items reaches Part III, so a breach of art. 53 attracts no article-specific fine tier; what remains against a competent authority is the Commissioner's corrective powers, the art. 83(2)(b) orders whose breach IS fineable at the top band under art. 94(3), and the individual's remedies under Part V, including the art. 90 right to have the Commissioner review the lawfulness of a competent authority's response and the processing behind it, and the art. 91 preliminary limitation order. The same structural gap exists in Serbia, where art. 95(1)(19) is written around a decision producing legal consequences and does not obviously reach the standalone art. 39(3) profiling ban. Impact tier: public sector.