Is a listed company, in Andorra

Llei 29/2021, arts. 46-74 (the Andorran Data Protection Agency, its powers, infractions and sanctions) · Read the law's page

• Expect a data subject to be able to lodge a complaint with the Agency electronically or in person, and a representative body, organisation or non-profit association active in data-subject-rights protection to be able to lodge it and pursue judicial remedies on their behalf.
• Cooperate with an Agency investigation, including giving inspectors access to your premises, equipment, processing means and any information they request.
• Comply with a corrective order the Agency issues, which can include a warning, a reprimand, an order to fulfil a data subject's rights request, an order to bring processing into compliance, a temporary or definitive limitation or ban on processing, or an order suspending data flows to a third country.
• Expect an administrative fine set according to the nature, gravity and duration of an infringement, intent or negligence, mitigating measures you took, your degree of cooperation with the Agency, and prior infringements, ranging from five hundred euros for a minor infringement to one hundred thousand euros for a very serious one.
• Expect the total fine for several infringements arising from the same or related processing to be capped at the amount set for the single most serious infringement.
• Expect joint and several liability with every other controller or processor involved in the same processing for compensating a person's material or non-material damage from an infringement of this law, unless you prove you bear no responsibility for it.
• Expect a claim for compensation to be brought within one year of a final declaration of liability, before the competent Andorran courts.
• Expect the Agency to refer signs of criminal conduct arising during a sanctioning procedure to the competent court and suspend the administrative procedure while that referral is pending.