What the domain pays and how big it is
Someone employed in information technology services earned around 45,700 lei gross a month at the end of 2025, against a national average of roughly 16,400. It is the highest figure of any division the National Bureau of Statistics publishes. The number belongs to division 62, not to the section: the section it sits in, information and communication, shows around 37,100 lei, because it also contains telecommunications and broadcasting, where pay is about half. Division 63 — hosting, data processing, portals — pays 35,000.
The number of companies rose sharply. In division 62, 2,944 economic agents reported for 2025 against 2,478 for 2024, with 17,148 employees and sales revenue of 13.5 billion lei. In division 63, 763 economic agents, 8,943 employees and 5.4 billion lei.
Two things follow for anyone entering now.
First, pay is your largest cost, and if you hire at market rate the payroll of a single developer exceeds everything you would spend on registration, accounting and subscriptions in a whole year. An IT business plan does not break at the paperwork line.
Second, 466 more companies than the year before, in a division that already held almost two and a half thousand, means you are not entering a consolidated market — but nor are you entering one where the client comes looking for you. Most of those companies are small and work for a single foreign customer.
What the state does not ask for before you start
It is worth saying plainly, because it is unusual: in divisions 62 and 63 there is no permit to obtain before the first invoice.
The Moldovan licence nomenclature runs to 22 positions and none covers any class in these two divisions. The authorisation list holds none either. There is no notification to the town hall, because no code in 62 or 63 appears on the list of commercial activities — unlike a shop or a restaurant. There is no requirement as to premises, equipment, seniority or qualifications.
In practice, nothing stands between the day you file at the Public Services Agency and the day you can sign the first contract except the few working days the registration itself takes.
It is worth explaining why the hub card used to carry a licence mention at all. Position 8 of the nomenclature covers trade in special technical means intended for the covert acquisition of information and the supply of technical information protection services, licensed by the Security and Intelligence Service for five years. It is the position closest to this domain and the only reason the domain ever features in a conversation about licences.
But its subject is not software. The first limb is import, manufacture and trade in interception equipment — activities belonging to other divisions of the classifier. The second means technical protection against covert capture of information: shielding, countermeasures, technical sweeps, not information security in the ordinary sense. Penetration testing, security audit, traffic encryption and firewall administration are not licensed activities in Moldova. If your company genuinely does technical countermeasures or sells that kind of equipment, ask the Service before signing the first contract.
What the state asks for once you have started
This is where the weight sits, and since 23 August 2026 it sits heavily.
Notification of processing is gone, the duties are not
Until that date, Law 133/2011 required processing of personal data to be notified to the National Centre for Personal Data Protection. Law 195/2024 repealed it, along with articles 74¹–74³ and 423⁴ of the Contravention Code, and inverted the logic: you no longer ask permission and no longer tell anyone, but you must be able to demonstrate at any moment that you did what was required.
What stays inside the company:
- The record of processing activities — article 30. An internal document listing purposes, categories of people and of data, recipients, transfers to other states with the documentation of the safeguards, erasure deadlines and technical security measures. The controller and the processor each keep their own, so an outsourcer keeps its own record rather than sheltering behind the client.
- The impact assessment, wherever processing presents a high risk.
- The data protection officer, in the cases in article 37: a public authority, regular and systematic monitoring on a large scale, or large-scale processing of special categories of data. They may be an employee or engaged under a services contract, may serve a whole group of undertakings, receive no instructions on how to do the job and cannot be dismissed for doing it. Their contact details are published and sent to the Centre — the only notification left standing.
The fines are large, but not yet at full value
Article 88 sets two ceilings: up to 1,000,000 lei or 1% of annual turnover for breaches of controller and processor duties, and up to 2,000,000 lei or 2% for the principles of processing, data subject rights and international transfers. The greater of the sum and the percentage applies.
Article 90(4) adds a ladder few have noticed: in the first year 10% of the amount set applies, in the second year 40%, and from the third year 100%. So a fine calculated today at two million is collected at two hundred thousand, and a company that puts its records in order over the next twelve months does so in the cheapest window it will ever have.
VAT is decided by where your client sits, not where you do
Article 111(1)(e) of the Fiscal Code places information technology services supplied through electronic communications equipment at the seat of the beneficiary. The same rule covers consultancy, transfers of copyright and the supply of information.
The practical consequence: for a client established outside Moldova the supply is treated as made there and falls outside the scope of Moldovan VAT — you put no VAT on the invoice and have none to collect. For a Moldovan client the standard rate applies. A company working exclusively for foreign customers ends up with essentially no output VAT, which changes the shape of the return entirely and is worth telling the accountant in the first month rather than the thirteenth.
The 7% regime in the IT parks
Six of the seven classes above are eligible for residency in an information technology park: 62.01, 62.02, 62.03, 62.09, 63.11 and 63.12 all appear in article 8 of Law 77/2016. 63.99 does not — it is the only one in the tables above that stays on the general regime, and it is exactly the kind of detail discovered late, because its neighbours in the same division are eligible.
The article 8 list is written per class, not per division, and it also covers several activities that do not appear above at all: publishing of computer games and of other software, computer training, research and development in named fields, manufacture of microprocessors and integrated circuits, special effects and animation, and specialised design based on high-performance computing equipment.
How to apply, what it costs, how the minimum tax per employee is calculated and what the 7% covers are set out in the Moldova IT Park guide, and the figures can be checked against your own company with the tax calculator. None of that is repeated here.
For IT the usual answer is an SRL, more firmly than in other domains.
Liability stays limited to the share capital, there is no minimum, the form admits 100% foreign founders, and it is the only one a corporate client in the European Union will accept without argument when it runs due diligence before the first contract. IT park residency is open to any subject of entrepreneurial activity, so the legal form is not what limits you there.
A sole trader looks attractive to a developer working alone, right up to the part where it is not a legal person and the holder is liable without limit, with their entire personal estate. In a field where contracts carry indemnity clauses for data breaches and intellectual property infringement, and where the data protection fine is measured in millions, unlimited liability is a poor bet.
A joint-stock company has no place at the start. It is a form designed for capital raised from several investors, with reporting duties to match, not for a team that grows contract by contract.
