Working templates and tools for the GDPR and for Albanian Law 124/2024. Ask for what you need and we will send it.
Home / Compliance toolkit
Most data protection templates on the internet are written for one regime and then relabelled for another. That is a problem here, because Albanian Law 124/2024 is aligned with the GDPR but not identical to it — the article numbers differ, the deadlines for answering a rights request are a month shorter, and a processor must report a breach to its controller immediately, not merely without undue delay.
So we wrote each one twice: once against the GDPR, in English, and once against Law 124/2024, in Albanian. The tools do both and switch between them.
Single files that run in your browser. No installation, no account, and no internet connection required after you have them.
Build and maintain your record of processing activities. Switch between the two regimes and the required fields change with them — including the sub-processors field Albanian law states expressly for processors. Tells you which statutory fields each record is still missing.
Log every breach, run the two notification decisions, and watch the 72-hour clock. Prompts you for the reasons for delay if the deadline passes, because you have to give them.
Track access, erasure and other requests against the deadline that actually applies — one month and three under the GDPR, but 30 days and 60 under Albanian law. Warns you if an extension is recorded after the window to notify it has closed.
Screens whether an impact assessment is required at all, then walks the four sections the statute demands, with a risk register scored against harm to people rather than to the business. Tells you when high residual risk means you must consult the authority before you start.
The three-part test — purpose, necessity, balancing — with the weighing made explicit so the file shows reasoning rather than a bare conclusion.
How long each category is kept, counted from what, on whose authority, and who actually performs the deletion. Flags the three gaps that make a schedule indefensible, and warns when anonymisation is being used as a substitute for deletion.
Whether a transfer abroad is lawful, on which mechanism, and whether it needs permission first. The mechanism lists are genuinely different: under Albanian law ad-hoc contractual clauses require the Commissioner’s authorisation, so EU Standard Contractual Clauses do not simply carry over.
Whether you must appoint a data protection officer, and the record showing you asked — because the absence of one is itself something you may have to justify. Flags the publication and notification step that appointments usually miss.
Who else touches your controllers’ data, on whose authorisation, and under what contract. Under Albanian law this feeds a statutory record — neni 27(2)(c) expressly requires a processor to name its sub-processors in its record.
The measures you actually have, who owns each, and when each was last tested — because Art 32(1)(d) makes testing effectiveness an obligation, and “industry-standard measures” is not a description. Fills Annex 2 of a processing agreement.
Assess a supplier before it touches personal data: 25 questions with evidence recorded against each, critical questions that block approval on their own, and a recorded decision. Prints a clean questionnaire to send to the vendor. A signed contract is a promise; this is the reason to believe it.
Who has access, when they were inducted, when their refresher falls due, and whether they are bound to confidentiality. Flags leavers whose access removal was never recorded — and, under Albanian law, a confidentiality duty kept in a side letter when neni 30(1) wants it in the employment contract.
An annual walk through the whole programme — 41 requirements, each cited to the right article under the regime you pick, each marked against evidence. Every gap becomes an owned, dated action, and unresolved ones carry into next year’s audit with the date they were first found.
Fill them in your browser and print to PDF, or lift the text into your own documents.
Which Albanian article answers to which GDPR article, and the nine places the two genuinely differ. Built from the official text published by the Commissioner.
Controller-to-processor agreement covering every element of Article 28(3), with annexes for the processing details, security measures and sub-processors.
Covering all the required content, including the six items most notices leave out.
Kontratë kontrollues–përpunues, e shkruar sipas nenit 26 — jo e përkthyer nga GDPR.
Model njoftimi, përfshirë pjesën për të dhënat e marra jo nga subjekti dhe afatet 30/60 ditë.
Internal policy with a named owner against every responsibility, because a policy that allocates nothing only documents that you knew the obligations.
What to do in the first hour and the first day, who decides on notification, and what gets recorded whether or not you notify.
Politikë e brendshme me përgjegjës të emëruar, afatet 30/60 ditë dhe kërkesën e nenit 27 për dokumentim në formë të shkruar dhe elektronike.
72 orët e para, dy vendimet e njoftimit, dhe fakti që përpunuesi duhet të njoftojë “menjëherë” — standard më i rreptë se GDPR-ja.
For a controller or processor with no EU establishment caught by Art 3(2) — the obligation non-EU businesses miss most often, and one a regulator can check in a minute.
Allocating responsibilities where two parties jointly decide purposes and means — with a warning about the characterisation, since independent controllers need a different document entirely.
Për kontrollues ose përpunues të pavendosur në Shqipëri që u ofrojnë shërbime subjekteve këtu.
Ndarja e përgjegjësive kur dy palë i përcaktojnë bashkërisht qëllimet dhe mjetet e përpunimit.
Your data stays on your machine. The tools contain no network code at all — what you type is held in your own browser and in files you export yourself. Nothing reaches us, which is the only honest way to hand a privacy tool to someone.
A template is a starting point, not advice. Each one has to be adapted to what you actually do with personal data before you rely on it. If you would rather not do that alone, that is the work we sell.
