Andorra. Comprehensive data protection. Act

LQPDQualified Law 29/2021 of 28 October on the protection of personal data (Llei 29/2021, qualificada de protecció de dades personals)

In force

Partly verified

Medium confidence. In-force date (2022-05-17) from prior knowledge, not re-verified; maximum fine not verified. EU adequacy Decision 2010/625/EU, confirmed in 2024 review.

§1Summary

Synopsis

Andorra's GDPR-aligned data protection law, replacing the 2003 law to keep pace with the EU and preserve adequacy. It covers lawful bases, rights, accountability, DPOs, breach notification and APDA enforcement.

Key themes

principles
data subject rights
DPO
DPIA
breach notification
transfers
sanctions

Unique features

Closely mirrors the GDPR; Andorra has held EU adequacy since 2010.

SaaS relevance

Applies to SaaS providers in Andorra and those targeting Andorran residents.

§2Obligations

Extraterritorial: Yes
Breach notification: APDA within 72h; individuals if high risk
DPO: Conditional
Cross-border transfers: Adequacy/appropriate safeguards

§3Dates

Key dates

Adopted 28 October 2021
In force 17 May 2022
Replaced Qualified Law 15/2003; entered into force six months after publication

§4Text and authority

Text

Authoritative text bopa.ad

Authority

Agència Andorrana de Protecció de Dades (APDA)

§5Where it applies

Domestic law of: Andorra

§6Sources and verification

Sources consulted

apda.ad

Verification

Medium confidence.

Partly verified

Medium confidence. In-force date (2022-05-17) from prior knowledge, not re-verified; maximum fine not verified. EU adequacy Decision 2010/625/EU, confirmed in 2024 review.