By Benoît Van Asbroeck and Enida Rrapaj
Recent reporting on the Israeli-backed data-centre project in or near TEDA Tirana has rightly attracted attention. If developed as announced, the project would represent an important step in Albania’s ambition to become a regional hub for digital infrastructure, technology and innovation.[1]
For the Belgian–Albanian business community, this is a positive and timely development. Albania is increasingly discussed not only through the traditional lenses of tourism, real estate, infrastructure and manufacturing, but also through sectors that define modern competitiveness: data infrastructure, cybersecurity, cloud services, artificial intelligence and digital innovation.
That shift matters. Data centres are not merely technical facilities. They are strategic assets. They support cloud services, managed IT, cybersecurity operations, backups, disaster recovery, business continuity and, increasingly, AI-driven processing. A credible data-centre investment in Albania can strengthen the country’s position in the regional digital economy and deepen its connection with EU markets.
From a Belgian and EU business-law perspective, the project should be welcomed. Albania offers geographic proximity to the EU, a young and adaptable workforce, competitive conditions, improving infrastructure and a clear political commitment to European integration. For EU companies considering regional diversification, nearshoring, operational resilience or digital infrastructure alternatives near the EU market, Albania warrants serious consideration.
At the same time, serious digital infrastructure requires serious legal architecture. Belgian and EU companies operate in a regulatory environment where data protection, cybersecurity, auditability, contractual control and operational resilience are central to decision-making. Any hosting location—whether in Albania, the EU, Israel, the United Kingdom, the United States or elsewhere—must be assessed through that lens.
The relevant question is therefore what data will be processed, who will access it, from where, under which contracts, with which safeguards and under which supervisory expectations.
This is where Albania’s direction is encouraging. The country has been modernising its digital and regulatory framework in line with its EU path. In cybersecurity, Albania has adopted Law No. 25/2024 “On Cybersecurity,” a framework expressly linked to the EU’s NIS2 Directive. The law covers public and private entities administering information infrastructures, communication networks and systems whose compromise may affect health, safety, economic welfare or the functioning of the Albanian economy.[2]
That is an important signal. Albania is not approaching digital infrastructure as an unregulated space, but as part of a broader cyber-resilience and EU-alignment strategy. The same law defines data-centre services as services involving structures dedicated to the centralised accommodation, interconnection and operation of IT and network equipment providing data storage, processing and transport, together with power-distribution and environmental-control infrastructure.[3] Data-centre service providers are included within the digital-infrastructure category in the law’s annexes, alongside cloud computing providers, DNS providers, internet exchange points and other key digital operators.[4]
For EU customers, this can become a competitive advantage. A credible local cybersecurity regime gives investors and clients more confidence that Albania is building not only physical infrastructure but also institutional capacity around digital trust.
The GDPR dimension should be understood in the same constructive but precise way. The GDPR may apply where EU controllers or processors use infrastructure abroad, and in certain cases where non-EU entities offer services to, or monitor, individuals in the EU.[5] If a Belgian or other EU company hosts customer, employee, supplier or platform data in an Albanian data centre, the EU company remains accountable under the GDPR. That accountability follows the controller, the processor relationship and the data flows. It does not disappear because the servers are outside the EU.
This has practical consequences. A European customer will need to understand the full processing architecture: where the production servers are located, where backups are stored, who provides remote support, where administrators are based, whether logs or telemetry are exported, whether there are sub-processors, who controls encryption keys and whether the provider can access data in clear form. These are the operational questions that determine whether an international hosting model is compliant, auditable and commercially viable.
Albania does not currently appear on the European Commission’s published list of jurisdictions benefiting from an Article 45 GDPR adequacy decision.[6] This does not make Albanian hosting unattractive. It means that EU companies must structure the arrangement properly, as they do with many international technology partners. In practice, where EU personal data is hosted or accessed in Albania, the arrangement will normally require appropriate transfer mechanisms, such as Standard Contractual Clauses, together with a documented transfer impact assessment.[7]
That transfer impact assessment is where legal form meets operational reality. It requires the parties to consider whether the law and practice of the destination country may affect the effectiveness of the transfer safeguards, including in relation to public-authority access, available remedies and the practical ability of the data importer to comply with its contractual obligations. For a data-centre project, this means analysing not only the country of storage but also remote access, support locations, privileged administration, security monitoring, backup arrangements, subcontracting and onward transfers.
The Israeli element in the project should also be analysed accurately. Israel benefits from an EU adequacy decision, while Albania does not yet.[8] But the legal analysis depends on the actual data flows. If EU data is stored in Albania, accessed from Israel, supported from another country or backed up elsewhere, each access point must be mapped. This is standard practice in modern data-centre and cloud governance.
The same applies to encryption. Encryption at rest and in transit are essential, but for sensitive or regulated workloads the more important question is who controls the keys. If the customer controls the keys, if privileged access is limited and logged, and if the provider cannot access data in clear form except under tightly controlled circumstances, the practical risk profile changes materially. That kind of technical and contractual design is what will make Albania attractive to demanding EU clients.
From a GDPR perspective, the data-centre operator will often act as a processor or sub-processor. That requires a robust Article 28 GDPR contract covering instructions, confidentiality, security, assistance, breach notification, audit rights, sub-processing, deletion or return of data and international transfers. For cloud or managed-service models, the contractual structure may be more complex, because the data centre may sit underneath a cloud provider, managed-service provider or SaaS operator. In those cases, the legal chain must match the operational chain.
Cybersecurity reporting must also be integrated into the governance model. Albania’s cybersecurity law provides for incident reporting and cooperation with the relevant cyber authorities for operators falling within the critical or important information-infrastructure framework.[9] At the same time, an EU customer may have separate GDPR personal-data-breach obligations, sectoral reporting duties and contractual notification requirements. A well-structured hosting arrangement should therefore align the incident-response matrix before any incident occurs: who detects, who investigates, who notifies, within what timeframe, with what information and under which confidentiality safeguards.
This matters especially for regulated sectors such as finance, healthcare, telecoms, public services, logistics and managed IT. These sectors cannot choose hosting locations only on price or capacity. They need to justify decisions to boards, auditors, regulators and customers. If Albania can offer both competitive infrastructure and credible legal safeguards, it will be better positioned to attract higher-value digital workloads.
The opportunity is therefore not only technical but also legal, contractual and institutional. Albania can position itself as a near-EU digital jurisdiction with competitive advantages, a European political trajectory and a regulatory framework moving in the right direction. That combination gives Albania a credible place in conversations around regional resilience, cloud-adjacent services, data sovereignty, AI infrastructure and business continuity for EU-facing companies.
For the Belgian–Albanian business community, this is the type of project that can deepen economic ties between Albania and the EU. It should be supported, promoted and professionally structured. Belgian and EU companies will not expect Albania to be identical to an EU Member State before accession. They will expect clarity, enforceability, transparency and workable safeguards. Those are achievable objectives.
Albania can compete for EU digital workloads if it pairs its infrastructure investment with the legal and contractual architecture that EU clients require. The data-centre project in TEDA Tirana is a concrete opportunity to demonstrate that pairing. Whether it succeeds will depend less on megawatts and rack space than on whether the trust framework is engineered from the start.
Footnotes
- [1] Public reporting describes an Israeli-backed data-centre project connected to TEDA Tirana. Data Center Dynamics reported an Israeli-backed 32MW project in TEDA, with a reported cost of approximately EUR 100 million and possible expansion up to 100MW. The Jerusalem Post similarly reported that ADC had been selected to build Albania’s first data centre, with an estimated EUR 100 million cost, 32MW capacity and possible expansion to 100MW.
- [2] Law No. 25/2024 “On Cybersecurity” states that it is partially aligned with Directive (EU) 2022/2555, the NIS2 Directive. Its object is to define rights and obligations for public and private entities administering information infrastructures, communication networks and systems whose compromise or destruction may affect health, safety, economic welfare or the effective functioning of the Albanian economy.
- [3] Law No. 25/2024, Article 5, definition of “data centre services.”
- [4] Law No. 25/2024, Annex I, digital infrastructure sector.
- [5] Article 3 GDPR, Regulation (EU) 2016/679.
- [6] European Commission, Adequacy decisions under Article 45 GDPR. Albania is not currently listed among jurisdictions benefiting from an adequacy decision.
- [7] See Commission Implementing Decision (EU) 2021/914 on Standard Contractual Clauses for transfers of personal data to third countries, and European Data Protection Board Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data.
- [8] Commission Decision 2011/61/EU on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data; see also the European Commission’s 2024 review of existing adequacy decisions.
- [9] Law No. 25/2024, provisions on cybersecurity risk-management measures, incident reporting, CSIRT cooperation, supervisory powers, corrective measures and administrative sanctions for operators falling within the critical or important information-infrastructure framework.
About the authors:
Benoît Van Asbroeck is Counsel at Bird & Bird in Brussels and leads the Belgian Data Protection, Tech & Comms and Media practices.
Enida Rrapaj is a Brussels and Tirana qualified lawyer and Founder and President of the EU–Belgian–Albanian Chamber of Commerce and Industry.
Together, they advise at the intersection of EU data regulation, technology, cross-border business and Albania–EU economic cooperation.