Almost any organization.
If you have customers, employees or partners who are individuals, you are already processing personal data. The size of the company does not matter.
A guide for businesses with surveillance cameras
Law 195/2024 and the cameras in your store. As of August 23, 2026, different rules apply.
Law No. 195/2024 on personal data protection entered into force on August 23, 2026, replacing Law No. 133/2011. It transposes Regulation (EU) 2016/679, known as the GDPR. If you film customers or employees, you are processing personal data — and you now have concrete obligations. Below, in brief and with article references, are the ones that affect an ordinary business.
This page summarizes the text of the law and materials from the National Center for Personal Data Protection. It is not legal advice; for your specific situation, ask a lawyer.
What changed
A new law, with obligations the old law didn’t have.
The law was published in the Official Gazette (Monitorul Oficial) No. 367-369, Article 574, on August 23, 2024, and entered into force two years after publication. Until then, Law No. 133/2011 applied. The new requirements that matter in practice are records of processing activities, data protection impact assessments (DPIAs), incident notification and the data protection officer.
Camera images too.
A video recording in which a person can be recognized is personal data. Cameras are not an exception to the law.
The National Center (NCPDP).
The National Center for Personal Data Protection receives complaints, carries out checks and imposes sanctions.
Obligations, article by article
What you need to have, in concrete terms.
The list below follows the articles of the law. It does not cover the whole text, only what affects an ordinary business with cameras, customers and employees.
The seven principles.
Lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability.
Any processing needs a legal basis.
Every processing operation must rest on at least one of the legal bases set out in the law. Without a legal basis, processing is unlawful, however useful it may be.
People have to know.
What data you collect, why, how long you keep it and what rights they have. The Center says explicitly that lengthy legal texts are not needed — a clear message written in good faith is enough.
Rights, with a one-month deadline.
Information, access, erasure and the rest. A request cannot be ignored: it must be recorded and answered within one month of receipt at the latest.
Record of processing activities.
The controller’s contact details, the processing activities and their purposes, the categories of data and of data subjects, the recipients, international transfers, the storage period and the measures taken.
Security, without expensive solutions.
Strong passwords, restricted access, backups, updates. The Center stresses that expensive solutions are not required — consistent care is.
Incidents: 72 hours.
In the event of a personal data breach, the Center must be notified within 72 hours. Preparing in advance matters more than reacting.
Your suppliers too.
An external accountant, an IT company, cloud services — if they touch the data, responsibilities are set out in a contract.
Data protection officer.
Mandatory in certain cases, including when the core activity consists of the systematic, large-scale monitoring of individuals. Where it is not mandatory, it is still recommended.
Keep in mindA data protection impact assessment (DPIA) is required for high-risk processing. If the assessment shows a risk you cannot mitigate on your own, the law requires prior consultation with the Center (Article 36).
The specific case
What the law means if you have surveillance cameras.
One thing needs to be said clearly here: Law No. 195/2024 has no article dedicated to video surveillance. There is no “cameras” chapter. The rules apply through the general provisions above, and that is important to know before you go looking for a text that doesn’t exist.
Don’t just film “for security” and leave it at that.
The purpose must be put in writing and must rest on a legal basis from Articles 6, 9 and 10. “That’s how it’s done” is not a legal basis.
A notice at the entrance.
Article 12 requires that the people being filmed know who is filming them, why, how long the images are kept and what rights they have. For customers, that means a visible notice at the entrance.
Their consent does not protect you.
An employee is in a relationship of subordination, so their consent is not considered freely given. The legal basis for workplace monitoring is built on other grounds, and this is the established interpretation under the GDPR, which the law transposes.
CCTV in operation
- Who is filming
- [Company name], [phone], [e-mail]
- Why
- [Purpose, for example the safety of customers and property]
- Legal basis
- [For example, the company’s legitimate interest]
- How long footage is kept
- [Number of] days
- Your rights
- Access to the footage, erasure, objection, and a complaint to the National Center for Personal Data Protection.
Full notice: [page address or “at the till”]
Sample sign
Short at the entrance, in full in the notice.
The sign says who is filming, why, how long the footage is kept and what rights the person filmed has, then points to the full notice. Fill in the bracketed fields with your company’s details. For your specific situation, ask a lawyer.
A detail that catches many companies off guard: if your core activity consists of the systematic, large-scale monitoring of individuals, Article 37 requires you to appoint a data protection officer. For an ordinary store with a few cameras, this does not apply; for a chain that monitors continuously, the question is worth putting to a lawyer.
For employees, all the rules — legal basis, signage, forbidden areas, sound, hidden cameras — are gathered on the page about video cameras in the workplace.
Where we come in
The same cameras, two different regimes.
Vizor is video analytics on the cameras you already have: it counts how many people come in, where they go, how long they wait at the checkout. What matters here is that you choose which legal regime you fall under, and that choice is reflected in what you have to document.
Numbers by zone and hour, with no identities.
By default, the system tracks silhouettes and produces numbers: how many came in, which zones they spent time in, how long the queue lasted. No one is identified, no profile is built and there are no per-person reports. You stay within the general obligations — legal basis, informing people, storage period, security.
Registered employees, recognized by face.
If you register employees in the system, they are recognized and their paths are linked to their names: hours, zones, time present. This takes you into individual monitoring, with everything it requires: a documented legal basis, a DPIA, informing each employee. A facial template is biometric data.
What we deliver and what we don’tWe deliver the tool and the technical documentation. The role of data controller and the legal liability remain yours — we cannot sign on anyone’s behalf that the processing has a legal basis.
If you don’t want the heavy regime, the answer is simple: leave employees unregistered. The system works the same for counting customers, conversion and queues — identity isn’t needed for any of them.
Sanctions
Fines, in two tiers.
Article 88 provides for two levels, and whichever is higher applies: the fixed amount or the percentage of turnover.
Up to MDL 1,000,000 or 1% of turnover.
For violations in the first category.
Up to MDL 2,000,000 or 2% of turnover.
For more serious violations.
Fines are phased in (Article 90(4)): in the first year from August 23, 2026, 10% of the fine set by the Center applies, 40% in the second year, and the full amount from the third year on.
- We are here23.08.2024The law is published in the Official Gazetteuntil then Law 133/2011 applies
- We are here23.08.2026The law comes into force10% of the fine imposed
- We are here23.08.2027Second year40% of the fine imposed
- We are here23.08.2028From the third yearthe full fine
As the Center puts it“Law No. 195/2024 is not about fines. It is about responsibility, precaution and clear rules.”
Read also
Related pages.
Video cameras in the workplace
What is allowed, where it is forbidden, what the sign must say and how long footage is kept, under Law 195/2024.
Read →Facial recognition time & attendance
Employee attendance from your existing cameras, with no readers and no cards.
Read →People counters: which type to choose
Infrared beam, 3D sensor or your existing cameras: what each one measures and what it costs.
Read →Video analytics for pharmacies
How many come in, how many are served at the counter and how long they wait. Real installations in pharmacies in Moldova.
Read →