A concrete reason, in writing.
People’s safety, protecting property, preventing theft. “Just in case” is not a purpose. The purpose decides everything else: where the camera goes, what it sees and how long you keep footage (Art. 5).
Yes, an employer may film in the workplace. But Law No. 195/2024 has no article on cameras and none on monitoring employees: the rules come from the law’s general principles, from Articles 91–94 of the Labor Code, and from the practice of the National Center and the European Court. Below we have gathered them in one place, with the articles cited — what you need in writing, where you must never film, and the most common mistakes.
This page summarizes the text of Law No. 195/2024, the Labor Code and the practice published by the National Center for Personal Data Protection. It is not legal advice; for your specific situation, ask a lawyer.
None of them costs money or new equipment. All of them have to be written down before the cameras are switched on, not after the first complaint.
People’s safety, protecting property, preventing theft. “Just in case” is not a purpose. The purpose decides everything else: where the camera goes, what it sees and how long you keep footage (Art. 5).
For cameras, the usual basis is the employer’s legitimate interest (Art. 6(1)(f)), which has to be balanced against employees’ private life. A consent form signed by the employee does not replace a legal basis.
The sign says who is filming, why and how long footage is kept (Art. 13). Employees also receive the document about the cameras and sign that they have read it (Labor Code, Art. 91(h)).
Toilets, locker rooms, break rooms — no. Nor a camera pointed all day at one person’s desk, without a reason that justifies it.
The law gives no number. Set one yourself, write it into the document and delete automatically when it runs out. The longer the period, the better you have to explain why.
Continuous surveillance is not occasional, so it goes into the record of processing activities (Art. 30). Monitoring employees usually also requires an impact assessment (Art. 35).
The most common mistake is a form signed at hiring: “I agree to be filmed.” It looks like protection. In fact it moves the processing onto a legal basis that barely works between employee and employer.
The law defines consent as a freely given, specific, informed and unambiguous indication of wishes (Art. 4) and lets it be withdrawn at any time (Art. 7). An employee who depends on a salary cannot refuse freely, and if they withdraw consent tomorrow, the camera would have to be switched off. The settled interpretation of the GDPR, which Law No. 195/2024 transposes, is that between employee and employer consent is valid only in exceptional cases.
Article 6(1)(f) allows processing for the employer’s legitimate interest, unless the employee’s rights override it. In practice: write down why you need the camera, why a less intrusive measure is not enough and what limits you have set. Employees keep the right to object (Art. 21), and then you have to show compelling reasons.
The law has no list of forbidden rooms. The limits come from the data minimization principle (Art. 5(1)(c)) and from the practice of the Center and the European Court of Human Rights.
In 2026 the Center found a violation over four cameras installed in a school’s toilets, and recalled that such spaces are, in principle, incompatible with the right to private life.
The European Court accepted one in a well-known case, with reasonable suspicion of theft after significant losses and for a short period. As a working rule, a hidden camera on employees does not pass.
Recording conversations is far more intrusive than images and needs a separate justification. Many cameras ship with the microphone on — check it before you write that you do not record sound.
A camera that continuously watches one person’s workstation is the hardest to justify. Where cash or expensive goods are handled, the till or counter can be filmed; the person as the object of surveillance cannot.
From the corridor you may film the changing-room door, if needed, but not the inside.
Each row below is a situation we see at companies that have had cameras for years, installed before the new law.
The Center says explicitly that lengthy legal texts are not needed: a clear, direct message written in good faith is enough. What matters is that the documents exist before the cameras are switched on and tell the truth about them.
The employer’s identity and contact details, the purpose and legal basis, the legitimate interest pursued, who receives the footage, how long it is kept, the rights of the person filmed — access, erasure, objection — and the right to complain to the Center. The sign at the entrance can be short and point to the full notice.
Where the cameras are, what they see, why, who has access and how long footage is kept. Employees sign it when they are made familiar with it (point h), and data protection measures are developed together with them or their representatives (point j).
Companies with fewer than 250 employees are exempt, but not when the processing is not occasional. Cameras that record day after day are not occasional, so CCTV goes into the record even at a small company.
It is required for high-risk processing. The list the Center approved under the old law (Order No. 27/2022) required an assessment when two criteria are met — and employee monitoring usually combines both: systematic monitoring, and people in an unequal position toward whoever monitors them.
The Republic of Moldova answers to the European Court, and the courts and the Center draw on its case law when they assess employee monitoring.
The Grand Chamber set the criteria by which any workplace monitoring is judged: prior notice, how far the monitoring goes, the legitimate reason, whether less intrusive measures exist, the consequences for the employee, and the safeguards provided.
Cameras in a faculty’s lecture halls violated the teachers’ right to private life. The Court held that a lecture hall is part of professional private life, and that the surveillance did not meet the conditions of national law.
The Grand Chamber accepted hidden cameras at a supermarket’s checkouts, but only because there was reasonable suspicion of theft after significant losses, the filming was short and limited to the checkout area. It is not a general permission.
Article 88 provides for up to MDL 1,000,000 or 1% of turnover for the controller’s obligations — records, security, impact assessment — and up to MDL 2,000,000 or 2% for principles, legal basis and people’s rights. Whichever is higher applies.
From August 23, 2026, only a tenth of the fine set by the Center applies (Art. 90(4)).
From the second year the law applies, the share rises to 40%.
From the third year, 100% of the fine set applies. This year is the cheapest moment to put things in order.
Vizor is video analytics on the cameras you already have. A manager’s questions — how many came in, how long they waited, where they walked — do not need anyone’s identity.
The system counts silhouettes and produces figures: how many came in, how long the queue lasted, which zones were avoided. No profile is built and there are no per-person reports. Figures leave the site, not images.
If you register employees in the system, they are recognized by face. A facial template is biometric data, where the rule is a ban and the exceptions are narrow (Art. 9). If all you need is for staff not to skew the customer count, this is not required.
What Moldova’s new personal data law requires from a business with cameras: legal basis, notice, records.
Read →Employee attendance from your existing cameras, with no readers and no cards.
Read →Conversion by hour, bypassed zones and checkout queues, in every store in the chain.
Read →Dock occupancy, blocked aisles and the zones nobody walks into.
Read →Yes, if you have a concrete, written purpose — people’s safety, protecting property, preventing theft — a legal basis under Article 6 of Law No. 195/2024, usually legitimate interest, and if employees are informed before the cameras are switched on. The law has no special article on cameras: the general principles apply, together with Articles 91–94 of the Labor Code and the National Center’s practice. For your company’s specific situation, ask a lawyer.
It is not the right answer. Consent must be a freely given indication of wishes (Art. 4) and can be withdrawn at any time (Art. 7), and between employee and employer its freedom is doubtful. The usual basis is the employer’s legitimate interest (Art. 6(1)(f)), weighed in writing. What the Labor Code requires is something else: that employees are made familiar, against signature, with the document on how their data is processed (Art. 91(h)).
In toilets, locker rooms, break rooms and any space meant for private life. The law does not list them, but the National Center considers them, in principle, incompatible with the right to private life, and in 2026 it found cameras installed in a school’s toilets to be a violation. A camera continuously pointed at one person’s workstation is also hard to justify.
Recording conversations is far more intrusive than images and needs a separate, written and balanced justification. Most sites do not have one, so the practical rule is: microphone off. Many cameras ship with the microphone switched on — check the setting before you write in the privacy notice that you do not record sound.
Only as a narrow exception. The European Court accepted one in López Ribalda v. Spain (2019), because there was reasonable suspicion of theft after significant losses, the filming was short and limited to the checkout area. As a working rule, a hidden camera does not pass; talk to a lawyer before taking such a step.
The law sets no number of days: it requires that footage not be kept longer than the purpose needs (Art. 5(1)(e)). Set the period by how long it takes to notice and report an incident, state it in the privacy notice and delete automatically when it runs out. As a benchmark, the inspections the Center has published show periods measured in days.
Article 13 requires: who is filming and how to contact them, the purpose and legal basis, the legitimate interest pursued, who receives the footage, how long it is kept, the rights of the person filmed and the right to complain to the Center. A sign that only says “Warning! CCTV in operation” is not enough — the Center found exactly this gap in a 2026 inspection. The sign can be short and point to the full notice.
No. The notification obligation was abolished back in 2021, and Law No. 195/2024 does not bring it back. Instead you have internal obligations: the record of processing activities (Art. 30), an impact assessment where the risk is high (Art. 35) and, if the assessment shows a risk you cannot reduce, prior consultation with the Center (Art. 36).
A recording can be evidence if it was obtained lawfully. But before any penalty you must request the employee’s explanation in writing (Labor Code, Art. 208), and a decision affecting them cannot rely solely on data obtained through automated processing or by electronic means (Art. 91(f)). Using footage for a purpose not stated in the privacy notice is the surest way to lose.
The Labor Code allows monitoring the volume and quality of work as a purpose (Art. 91(a)), but continuous surveillance of every person is hard to justify as proportionate and usually requires an impact assessment. Management questions — how many customers came in, how long they waited, where the queue formed — do not need anyone’s identity.
Article 88 provides for up to MDL 1,000,000 or 1% of turnover for the controller’s obligations, such as records or security, and up to MDL 2,000,000 or 2% for breaching the principles, the legal basis or people’s rights. Fines are phased in: in the first year after August 23, 2026, 10% of the fine set applies, 40% in the second, and the full amount from the third (Art. 90(4)).
We do not give legal advice. But we will tell you what can be measured on your cameras without tracking anyone, and reply within 24 hours, in writing.