Albania’s data protection framework has been brought substantially closer to the European model. For a large processor this means a programme of work. For a company of twenty people it means a much smaller number of things, done properly.
First, know what you hold
You cannot protect or justify data you have not catalogued. Write down what personal data you hold, where it lives, who has access, why you have it and how long you keep it. Include the systems nobody thinks of: the CCTV recorder, the recruitment inbox, the spreadsheet on a manager’s laptop, the messaging groups used with customers.
This inventory is the foundation for everything else, and it is usually a day’s work.
Consent is not the default answer
A common mistake is treating consent as the basis for all processing. For much of what a business does — performing a contract, paying staff, meeting a legal obligation — consent is the wrong ground, and relying on it creates a problem, because consent can be withdrawn.
Identify the actual lawful basis for each processing activity. Reserve consent for the things that genuinely are optional, such as marketing, and make withdrawing it as easy as giving it.
Be able to produce these
If a question arrives, you should be able to show:
- Your record of processing activities.
- Your privacy notice, in language a customer can follow.
- Written arrangements with processors who handle data for you — payroll providers, IT suppliers, cloud services.
- A retention schedule, and evidence that deletion actually happens.
- A procedure for handling access requests and for reporting a breach within the required window.
Where the risk really sits
In practice, most incidents at this size are not sophisticated attacks. They are a departing employee with a copy of the customer list, an email sent to the wrong recipient, or an old system nobody decommissioned. Access control and deletion discipline prevent more harm than any policy document.