Guide · Law 195/2024

What does Law 195/2024 require when you use a chatbot or record calls?

Law No. 195/2024 on personal data protection applies in the Republic of Moldova from 23.08.2026 and transposes the GDPR. For a chatbot or a voice agent, in practice this means: you tell the person who processes the data and why, you have a legal basis, you sign a contract with the platform provider, and you do not keep conversations longer than needed.

Write to us

Updated: 10.10.2026

In short

The direct answer

Your company is the data controller: you decide why and how conversations are used. The platform provider, for example us for aichat.md and Kallina, is the processor and needs a written contract with you (art. 28).

At the start of the conversation or call, the person must learn who you are, for what purpose you process the data, and where to find the privacy policy (art. 13). On a recorded call, the agent announces the recording from the start.

This page is a practical guide, not legal advice. For your specific situation, check with a lawyer or with the data protection officer.

Step by step

What to put in order before you launch the agent.

Set the purpose and the legal basis

Why you process the data: to answer a request, to book an appointment, to perform a contract. Each purpose needs a legal basis from art. 6.

Inform the person

A short message at the start of the chat or call, with a link to the privacy policy (art. 13).

Sign the contract with the provider

The processor contract contains what art. 28 requires: which data, for how long, which security measures, which sub-processors.

Decide how long you keep data

Conversations and recordings are not kept forever. Write down a retention period and set up automatic deletion.

Check where the data goes

Transfers outside the Republic of Moldova have their own rules (art. 44–49).

Prepare to answer requests

People can ask for access, correction or deletion. The answer must be given within one month at most (art. 12).

Common situations

What the law means for chatbots and for calls.

Call recording

Announce the recording at the start of the call and say why you record. Keep recordings only as long as you need them.

Clinics and health data

Health data is a special category (art. 9). The agent should not ask for more than is needed for an appointment.

Decisions made by AI

A person has the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects (art. 22). The agent proposes, a person decides.

Impact assessment

For high-risk processing, for example special data on a large scale, you carry out an impact assessment (art. 35).

Record of processing activities

Companies with fewer than 250 employees are exempt only if the processing is occasional, carries no risk and involves no special data (art. 30 para. 5). A chatbot that runs every day is not occasional.

Security incidents

A personal data breach is notified to the National Center for Personal Data Protection within 72 hours at most, where possible (art. 33).

Transfers

Where conversation data is stored.

Law 195/2024 does not treat sending data to European Economic Area states as an international transfer (art. 44 para. 2). For other states, one of the routes provided is the standard data protection clauses adopted by the European Commission (art. 46 para. 2).

Ask the provider where the AI model runs, where conversations are stored and which sub-processors it uses. The answer must be written in the contract, not just said.

Sanctions

What you risk if you ignore the law.

The law provides for fines imposed by the National Center for Personal Data Protection (art. 86–88), calculated partly based on turnover, as well as corrective measures. Read the exact caps in the official text of the law.

More concretely for a small company: one customer complaint can trigger an inspection, and the inspection asks for documents that you either have or do not have.

Plainly put

Where you need someone other than us.

For a legal opinion, a defense before the Center or drafting policies, you need a lawyer or a data protection officer. We do not give legal advice.
For a full impact assessment of high-risk processing, a consultant specialized in data protection has experience with the procedure.

What we do is the engineering part: an inventory of what the system actually collects, checking the page, and retention and deletion implemented as functions that run. To scan the public surface of a site, there is also ongdpr.md.

Questions

Frequently asked questions

Since when does Law 195/2024 apply?

Since 23.08.2026. It was published in the Official Gazette No. 367-369 of 23.08.2024 and entered into force after 24 months.

Do I need the customer's consent to use a chatbot?

Not always. The legal basis can also be the performance of a contract or a legitimate interest, depending on the purpose. Informing the person, however, is always required (art. 13).

Do I have to announce that the call is recorded?

Yes, the person must be informed. Kallina agents can announce the recording at the start of every call.

Who is liable if the platform provider makes a mistake?

The controller remains responsible to the customer, and the processor is liable for its own obligations. That is why the contract under art. 28 matters.

Can I use an AI model from the US?

Yes, with a transfer route provided by law, for example the standard clauses adopted by the European Commission (art. 46). Check what the provider's contract says.

What fines does the law provide for?

The fines are in art. 86–88 and also take turnover into account. Read the caps and the rules for applying them in the official text.

Sources

Where the facts on this page come from.

Do you want to know what your chatbot or website actually collects?

Tell us which systems talk to your customers. We reply the same working day, with what we can check technically.

Let's talk