SOLUTION / Personal data protection
Law 195/2024: the technical layer of conformance
Since 23 August 2026, Moldova's Law 195/2024 on personal data protection — the local equivalent of GDPR — has been in force. The documents — policy, register, contracts — are your lawyer's work. We do the other half: we read your database schema and code and bring the system to what those documents say. We never read the content of your data — only its structure.
This is for you if
- ·You hold a client base — a CRM, a site with forms, bookings, a newsletter — and the law now applies to you directly.
- ·Your lawyer has already prepared the documents, and what remains is making the system behave the way they say.
- ·You work with EU clients and have already heard the word GDPR from their lawyers.
- ·You do not know exactly where personal data lives in your systems — and would rather find out before the inspector does.
What you get
01
A technical data map
A record of processing derived from the actual database schema and code, not from a questionnaire. Plus a divergence map: what your documents declare — and what the system actually does, every line with a reference. The plan stays yours: fix it with us or with anyone.
02
A system that executes the documents
Expired data is deleted by a journalled job, not by a promise. Everything about one person — exported or erased in a single operation. Consent is journalled: who, when, for what, and which version of the text. Personal data is scrubbed from logs.
03
Upkeep
Systems change — the register must not fall behind. Checks re-run after changes, a living journal of automated deletions, and the regulator's clarifications reach you translated out of legalese.
What is not included
- ·Legal opinions, policies and contracts — that is a lawyer's work. We come in tandem with yours, or introduce you to those we work with.
- ·Representation before the CNPDCP.
- ·"Conformance certificates" — no such institution exists; whoever promises one is selling paper.
- ·A promise that there will be no fine — nobody can give one.
How it works
- 01
Contract before access
We sign a data-processing agreement before the first connection — from that moment we are accountable to you under the same rules we help you meet.
- 02
Reading structure, not data
Read-only access: schema, code and aggregates. Row content — clients, deals, correspondence — is never read. The journal of what we looked at is handed over with the report.
- 03
A report of observations
Every line is an observation with a reference to a table or code, not an accusation. A separate section holds the questions worth putting to your lawyer.
- 04
Fixes with demonstrable acceptance
Not "retention configured", but "the query returned this many expired rows — now zero, and here is the job that keeps it at zero".
What we need from you
- ·Read-only access to the database and repository — granted for the engagement, revoked when it ends.
- ·Your data documents, if any: policy, register, contracts. If there are none — we start with the map, and that is fine.
- ·Your lawyer's contact — or ask us to suggest one.
- ·An hour of the person who knows how your processes actually run.
How we know it worked
The record of processing matches the real database schema. Expired data is deleted by a job with a run journal. A person's request — export or erasure — executes as a single operation. And every one of these statements can be shown, not merely said.
How the cost is formed
The first step — the data map — has a fixed scope and a fixed price, named before we start. The scope of bringing the system into conformance becomes known from the map, and is fixed after it, not before.
Plainly
We went through this ourselves first: our own register, our journal of automated deletions and our report are built with the same method we offer you. The studio's methodology is open — you can read it before we ever talk.
Bounded scope · data content is never read · in tandem with your lawyer