Monaco. Comprehensive data protection. Act

Loi 1.565Law No. 1.565 of 3 December 2024 on the protection of personal data (Loi n° 1.565 relative à la protection des données personnelles)

In force

Partly verified

Medium confidence. Exact Journal de Monaco publication date not verified. Whether fines include a turnover-based alternative not verified. DLA Piper's Monaco page still describes the old CCIN regime and is out of date.

§1Summary

Synopsis

A GDPR-style law replacing Monaco's 1993 regime with accountability duties, data subject rights, DPIAs, breach notification and a new independent authority, the APDP. It aims to support an EU adequacy decision.

Key themes

accountability
data subject rights
DPO
DPIA
breach notification
representative
administrative fines

Unique features

Replaces the old prior-declaration/authorisation model with accountability; non-Monaco controllers targeting Monaco must appoint a representative in Monaco or, failing that, in an EU Member State.

SaaS relevance

Caught where a SaaS provider is established in Monaco or offers services to or monitors people in Monaco; appoint a representative.

§2Obligations

Extraterritorial: Yes
Breach notification: APDP within 72h; individuals promptly if high risk
DPO: Conditional
Cross-border transfers: Adequacy/appropriate safeguards (GDPR-style)
Maximum penalty: Administrative fines up to €10m; criminal penalties for serious offences

§3Dates

Key dates

Adopted 3 December 2024
In force December 2024
Immediately applicable on publication (December 2024); 1-year transition for records, DPO and security obligations; 3-year transition for DPIAs (to ~December 2027); replaced Law No. 1.165 of 1993

§4Text and authority

Text

Authoritative text journaldemonaco.gouv.mc

Authority

Autorité de Protection des Données Personnelles (APDP), successor to the CCIN

§5Where it applies

Domestic law of: Monaco

§6Sources and verification

Verification

Medium confidence.

Partly verified