Introduction
Implementation of the Personal Data Protection Law is linked to the Personal Data Protection Center’s (PDPC) capacity to manage the licensing system governing the collection, storage, and processing of personal data. The time limits for deciding license applications are particularly important because they determine how long companies must wait for a decision needed to meet one of the requirements for operating lawfully. Both the length of these time limits and the point at which they begin must therefore be clear. Procedures for reviewing applications and addressing outstanding requirements must also be properly regulated to ensure that data protection safeguards can be assessed and waiting periods are not extended indefinitely.
However, a comparison of Law No. 151 of 2020, its Executive Regulations and the Center’s guidelines reveals differences in how long the Center has to respond and what triggers the start of that period. It is also unclear how requests for additional documents affect the running of the time limit. These issues are especially significant because the Center’s silence results in deemed rejection of the application. Delayed decisions may also have consequences at license renewal or when the compliance grace period expires. A company may therefore bear the consequences of administrative delay despite having submitted its application and met its requirements. Yet that delay may not reflect a substantive assessment of whether the company provides adequate protection for personal data.
This paper examines how the time limits for deciding license applications are regulated, as the deadline on 1 November 2026 approaches, the consistency of the relevant provisions, and the consequences of the Center’s delays or refusal to respond. It is based on the view that effective data protection requires safeguards to ensure clarity and accountability in the exercise of regulatory authority, alongside rigorous assessment of license applications. It aims to propose measures to improve the way these time limits are defined and applied, and to protect the rights of data subjects and the legal position of license applicants.
The Legislative Framework for Personal Data Protection and the Compliance Grace Period
The Personal Data Protection Law No. 151 of 2020 was enacted to regulate the handling of electronically processed personal data. Within its scope of application, it defines the rights of data subjects and the obligations of those who collect, store, and process such data. The Law also established the Personal Data Protection Center, with regulatory and supervisory powers that include issuing the licenses and permits required for activities involving personal data. Obtaining a license therefore became a compliance requirement, alongside substantive obligations concerning lawful processing, data security, and enabling data subjects to exercise their rights (Articles 19 and 26 of the Law).
Although the Law required the competent minister to issue the Executive Regulations within six months of its entry into force, they were not issued until 2025. Ministerial Decree No. 816 of 2025, issuing the Regulations, was published on 1 November and entered into force the following day. The Regulations provided essential details for implementing the licensing system, including the categories of licenses and permits, their conditions and the required supporting documents. They also specified the fees and procedures for issuing and renewing licenses and permits. More than five years therefore elapsed between publication of the Law and the availability of its implementing framework, even though completing essential aspects of compliance depended on that framework (Article 4 of the Law’s promulgating provisions and Article 2 of the Decree issuing the Regulations).
Article 6 of the Law’s promulgating provisions requires those subject to the Law to bring themselves into compliance within one year of the issuance of the Executive Regulations. This involves reviewing data handling practices, meeting protection requirements and obtaining the licenses and permits required for the relevant activities. Effective use of this grace period therefore depends on clear requirements, the availability of application procedures and the Center’s capacity to decide applications. Companies can carry out some of the steps needed for full compliance themselves, while completing others depends on a decision from the Center. Licensing time limits and safeguards to ensure that they are observed are therefore central to assessing whether the Law is implemented fairly and effectively.
The Response Period under the Law, the Regulations and the Center’s Guidelines
Article 27 of the Personal Data Protection Law sets a time limit of no more than 90 days for deciding applications for licenses, permits and accreditations, starting from the submission of all required documents and information. It provides that an application is deemed rejected if no decision is made within that period. The legislature therefore linked the review period to the completeness of the application and specified the legal consequence of its expiry. This arrangement enables applicants to identify the maximum waiting period and establish when a deemed rejection arises that they can challenge. The time limit therefore directly affects a company’s legal position and when it can take action to protect its interests.
However, the Executive Regulations use different wording when setting out the procedures for legal persons to obtain licenses and permits. They require the Center to notify the applicant of approval or rejection within no more than 90 working days from the submission of all required data and documents. Failure to respond is treated as rejection of the application (Article 36, paragraph 3). Adding the word “working” extends the period by excluding non-working days from the calculation. Assuming a five-day working week, 90 working days amount to approximately 18 weeks, before allowing for public holidays.
This difference raises a question about the limits of the Regulations’ authority to implement the Law. Executive regulations should set out the procedures for applying a law without amending its provisions. Yet the Regulations use “90 working days” in place of the “90 days” specified in Article 27, extending the period by excluding non-working days. The more persuasive interpretation is to calculate the period in calendar days, which include holidays. This reading is supported by the legislature’s explicit use of “working days” when setting other time limits, including the period for responding to data subjects’ requests under Article 32. The extension introduced by the Regulations may therefore be viewed as potentially conflicting with the Law, which ranks higher in the legal hierarchy. Delegated authority to regulate the procedures for issuing licenses does not remove this concern, since the Law itself has set the time limit for deciding applications.
The Center’s guidelines introduce a third formulation. They provide for a decision within 90 days of receiving the application, without specifying working days or explicitly linking the start of the period to the submission of the required documents (section 3.2). The guidelines therefore match the Law in referring to 90 days but differ in identifying when the period begins. They do not resolve this uncertainty. They are an interpretative document that includes a disclaimer stating that it does not constitute a binding administrative or regulatory decision. The document cannot amend the Law or resolve a conflict between the Law and the Regulations merely by using different wording.
These different formulations create uncertainty about when a deemed rejection arises. A company may consider the period to have expired while the Center continues to calculate it in working days. Addressing this uncertainty requires correcting the relevant provision of the Regulations to bring it into line with the Law, and aligning the guidelines and electronic portal procedures on the same basis. A clear time limit is essential to holding the Center accountable for exceeding it and enabling license applicants to determine the status of their applications without having to bear the cost of a dispute over how the period itself should be calculated.
When the Time Limit Begins: Receipt of the Application or Submission of the Required Documents
The effectiveness of the time limit for deciding a license application depends on whether its starting point can be identified and proved. Under the Law, the 90-day period begins when all required documents and information have been submitted. The Executive Regulations follow the same approach for applications by legal persons (Article 27 of the Law and Article 36 of the Regulations). Simply filing an incomplete application therefore does not start the period. However, both provisions leave uncertainty about how to prove that the requirements have been met and how long the Center may take to check that the file is complete and notify the company of any missing items. Without this clarity, an application may remain pending before the time limit for deciding it has even begun.
By contrast, the Center’s guidelines calculate the response period from the date the application is received (section 3.2). The phrase “receipt of the application” can be understood to mean receipt of a complete application, since the preceding section asks for all necessary information and documents to be attached. However, this interpretation does not remove the need to distinguish between proof of filing and proof that the application requirements have been met, particularly when the electronic portal accepts an application but additional requirements emerge during its review. Acceptance of a document upload or allocation of an application number establishes that an application has been submitted. It does not necessarily establish that the legal and technical requirements have been met.
Clarifying when the time limit begins requires distinguishing between the date the application requirements are actually met and the date the Center acknowledges this. The more persuasive interpretation is that the period begins on the date the last required document or item of information is submitted, provided this can be proved. On this reading, its start does not depend on a later date set by the Center for issuing a notice of completeness. The provision links the time limit to completion of the requirements and does not make its start conditional on that notice. Administrative delay in reviewing the file should therefore not, in itself, postpone the start of the period. Complete documentation does not mean that its contents have been approved. During the decision-making stage, the Center can still assess whether the documents are adequate and the conditions for granting a license have been met.
To make this distinction work in practice, a clear list of requirements must be published for each license category, and the documents submitted and their submission dates must be recorded. A short time limit must also be set for the initial review and for notifying the company of any missing items, with an explanation of the basis for requesting them. The notice of completeness should specify the date on which the requirements were met and the expected date on which the time limit for deciding the application will expire. Applicants should also be able to challenge an assessment that their file is incomplete. This would make the starting point verifiable and open to review, and reduce the scope for keeping applications pending without a specific justification for not starting the period for deciding them.
Requests to Supplement Applications and Their Effect on the Decision Period
The Law allows the Center to request additional data, records or documents to decide a license application. It also allows the Center to request additional data protection safeguards if the protection described in the submitted documents is found to be inadequate. This power enables the Center to assess the company’s ability to meet its obligations, particularly when the technical review reveals risks whose scope was unclear when the application was submitted. However, the provision does not expressly state how these requests affect the time limit for deciding the application, or set out detailed rules for suspending the period, resuming it or restarting it. The Regulations and the Center’s guidelines repeat this power to request that applications be supplemented, without resolving its effect on the calculation of the period.
Analyzing this issue requires distinguishing between remedying a deficiency that existed when the application was submitted, clarifying a document already provided, and implementing an additional safeguard required by the technical assessment. In the first case, the absence of a document already publicly identified as required may prevent the period from beginning at all. A subsequent request for clarification does not, in itself, show that the application was incomplete when filed. A request for stronger safeguards reflects a conclusion the Center reached during its review. Treating every additional request as grounds for restarting the entire period therefore allows repeated extensions of the wait and may make the maximum time limit ineffective in limiting the overall waiting period.
The power to request information should not, in itself, create an unrestricted power to restart the period. At the same time, a rigorous assessment requires the Center to obtain the information it needs, with clarity about the company’s responsibility for delays in providing it. The effect of requests to supplement an application therefore needs to be expressly regulated. The rules must respect the time limit set by the Law, identify cases where an application was incomplete from the outset, and distinguish those cases from subsequent review procedures. Any rules allowing the period to be suspended after it has begun must have a sufficient legal basis. The power to request documents cannot be assumed to give the Center the power to suspend the period.
In practice, a request to supplement an application should specify what is required, explain why it is necessary, and state the basis for requesting it. It should set a reasonable time limit for responding and explain how the request affects the calculation of the decision period. Missing items that can be identified through a routine review should be grouped in a single request. Reasons should be given for any subsequent request, and the date of the company’s response should be recorded. These measures would make it possible to examine the source of delays and distinguish the time spent providing outstanding information from the time the Center spends reviewing it, while upholding data protection requirements.
The Center’s Silence and the Deemed Rejection of License Applications
Once all required documents and information have been submitted, a license application is deemed rejected by operation of law if the period for deciding it expires without a decision (Article 27). This means that the Center’s silence has a legal consequence without an express decision. It does not, however, reveal the reasons for rejection or whether the application has undergone a substantive assessment. The period may expire because of delays in review or difficulties with internal procedures, despite the file being complete. Deemed rejection should therefore not be treated as evidence that the company’s data protection safeguards are inadequate. Nor can silence be treated as approval allowing the company to carry out the activity for which it has sought a license.
Treating silence as rejection makes it possible to identify a legal outcome that the license applicant can challenge, rather than leaving the applicant waiting indefinitely. However, this protection remains limited because the company bears the burden of challenging a rejection without knowing its reasons, and may have to go to court to secure an actual review of its application. This burden increases when the parties disagree about the date the documentation became complete or how the period should be calculated. A dispute over whether deemed rejection has arisen then precedes any dispute over its lawfulness. The appropriate route and timing for a legal challenge must therefore be determined through a careful examination of the facts of the application, the correspondence exchanged and the applicable procedural rules.
Deemed rejection should not be interpreted as relieving the Center of its duty to act. The Regulations require it to notify the applicant of the outcome of its review, whether approval or rejection (Article 36, paragraph 3). Meeting this obligation requires the Center to issue a clear decision and communicate it to the company within the time limit. Giving reasons for rejection is also an essential safeguard, enabling the applicant to understand and remedy shortcomings or challenge the Center’s assessment. This remains important even though the specific provision governing licensing procedures does not expressly require reasons to be given for rejection.
From a data protection perspective, silence does not demonstrate that the regulatory authority has performed its review and oversight functions. The priority for reform is therefore to require the Center to issue express, reasoned decisions, provide effective review of delays and rejections, and publish indicators on applications whose time limits have expired without a response. Replacing deemed rejection with automatic approval as a general rule would require legislative amendment and an assessment of the risks of allowing data processing whose safeguards have not been examined. Measures to address administrative inaction must protect license applicants from unjustified waiting periods, while ensuring that data subjects’ rights remain the basis for assessing the activity for which a license is sought.
Safeguards for Regulating Time Limits and Holding the Center Accountable for Delays
Addressing inconsistencies in licensing time limits begins with correcting Article 36 of the Executive Regulations to align it with the 90-day period set by the Law, and bringing the guidelines and electronic portal procedures into line with that period. This correction should also establish when the period begins and how its starting point can be proved. It should include publishing clear rules for deciding renewal and amendment applications, and regulating the relationship between the timelines for primary and supplementary licenses. Binding rules must be issued through the appropriate legal instrument and made available to those subject to them. Their effective date and the arrangements for handling applications already submitted must be specified, so that compliance requirements do not change during review without clear transitional arrangements.
Effective control of the decision period requires procedures that allow an application to be tracked from the date it is filed. These include issuing an electronic receipt recording the documents submitted and their submission dates, setting a short time limit for the initial review, and notifying the company of missing items and the basis for requesting them. The date the file becomes complete and the time limit for deciding the application must then be recorded. Requests for additional information should also be regulated, with reasons given for repeated requests and their effect on the calculation of the period explained by reference to a specific legal basis. A downloadable record would provide evidence of the company’s responses and the Center’s correspondence, helping to identify who is responsible for each period of delay.
Accountability requires the Center to notify applicants of an express, reasoned decision within the time limit. It also requires a publicly announced administrative process providing prompt review of delays, disagreements over the completeness of documentation and the reasons for rejection, without prejudice to the right to go to court. Procedures could include automatically referring an application to a supervisory level as the end of the period approaches, then recording any overrun, its cause and the action taken to address it. The temporary continuation of a license during renewal, or arrangements governing applications pending when the compliance grace period expires, must be provided for in a provision with a sufficient legal basis. That provision must define the conditions and scope of these arrangements while preserving the power to intervene where data subjects are at risk.
These safeguards should be complemented by regular publication of aggregated indicators on the number of complete applications, average decision periods and the percentage of decisions issued within the time limit. Publication should also cover cases of deemed rejection and the reasons for delays. The indicators should distinguish between the time applicants take to respond and the time spent on review within the Center, while protecting personal data and trade secrets. This information would allow an assessment of the Center’s staffing, expertise and resource needs, and provide a basis for administrative and parliamentary accountability. An effective licensing system requires the authority responsible for enforcing the Law to explain the reasons for its decisions and delays. Identifying shortcomings must also lead to specific corrective measures whose implementation can be monitored.
Conclusion
A review of the time limits for deciding personal data protection license applications reveals inconsistencies that affect companies’ ability to determine their obligations and the Center’s ability to enforce the Law clearly and accountably. Differences in how the period is calculated, uncertainty about proving that an application is complete, and the effect of subsequent requests to supplement it may make the end of the decision period difficult to establish. With silence resulting in deemed rejection, a company bears the consequences of the expiry of a period whose starting point and calculation it may dispute with the Center, without receiving a substantive explanation for the rejection of its application.
Addressing this situation requires resolving conflicts between the relevant provisions, regulating procedures for supplementing applications and providing notifications, and establishing arrangements for applications pending at renewal or when the compliance grace period expires. The guiding standard for these reforms remains rigorous assessment of data protection safeguards within a clearly defined period, while enabling license applicants to understand the reasons for a decision and seek its review. The Center exercises powers that affect data subjects’ rights and the ability of those subject to the Law to continue their activities. These powers must be accompanied by a duty to decide applications, with compliance open to scrutiny, and clear accountability for delays and their consequences.