The protection of personal data in the electoral process in the Republic of Moldova remains a vulnerable area, according to a report by EPDE member Promo-LEX Association. The report highlights risks that could affect both election integrity and citizens’ rights, particularly in the context of the 2024–2025 electoral cycles and ongoing alignment with European standards.

The study examines the practices of parliamentary political parties, the Central Electoral Commission (CEC), and the National Center for Personal Data Protection (Centrul Naţional pentru Protecţia Datelor cu Caracter Personal al Republica Moldova – CNPDCP). It identifies documented cases of large-scale data misuse, including transfers abroad and the use of digital tools to collect personal data, while noting that institutions are insufficiently prepared to prevent such risks.

Significant shortcomings were found among political parties, including weak legal compliance, poor understanding of data protection principles, and problematic practices such as unclear privacy policies and informal data storage. While the CEC has taken steps to improve data security, it has not conducted required impact assessments. The NCPDP, meanwhile, is described as largely reactive, with limited proactive oversight and slow case handling.

Overall, the study points to a gap between the scale of risks and institutional preparedness. Although the legal framework is being aligned with EU standards, implementation remains weak.

Promo-LEX recommends strengthening institutional capacities, improving transparency, conducting impact assessments, and focusing on prevention. Political parties are urged to adopt clear data protection rules and appoint data protection officers, while closer cooperation between the CEC and CNPDCP is also advised. Parliament is called on to clarify legislation and enhance oversight mechanisms.

The report is also available in Romanian.