LexLint.ioBeta

Know the law your code answers to.

Law / Andorra

LQPD, personal data breach notification

Llei 29/2021, arts. 36-37 (personal data breach notification)

In force since .

A breach notification rule binding public and private bodies.

Obligation class
Breach notice, Reporting
Audit expectation
on_request
Who audits it
Regulator
Where the report goes
Produced on request

What it requires

  • Notify the Andorran Data Protection Agency of a personal data breach without undue delay and, where possible, within seventy-two hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.NIST Privacy FrameworkCM.AW-P7
  • Justify the reasons for the delay if notifying the Agency after that seventy-two-hour period.NIST Privacy FrameworkCM.AW-P7
  • As a data processor, notify the data controller without delay of a personal data breach you become aware of.NIST Privacy FrameworkCM.AW-P7
  • Communicate a personal data breach to the affected data subject without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless an Article 37(3) exception applies.NIST Privacy FrameworkCM.AW-P7
  • Describe in the Agency notification the nature of the breach, the categories and approximate number of data subjects and records affected where possible, a contact point, the likely consequences, and the measures taken or proposed, supplying information in phases without undue delay where it cannot all be given at once.NIST Privacy FrameworkCM.AW-P7
  • Document every personal data breach, its facts, effects and remedial measures, so the Agency can verify your compliance.NIST Privacy FrameworkPR.PO-P7

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
  • RS.CO-02Internal and external stakeholders are notified of incidents
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Regulator

Logging duty

Article 36(5) makes the controller document every personal data breach, with the facts, its effects and the corrective measures taken, so that the supervisory authority can verify compliance with the notification duty. The record is kept for every breach, whether or not it is notified. The facts, effects and measures are not log content values, so the contents are left empty. Article 36 sets no period for keeping the record. Article 37, the communication to the data subject, adds no record duty.

Kind
Explicit
As of
Provision
Article 36(5)
Trigger
security_incident

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 36(1) requires the controller, without undue delay and where possible within seventy-two hours of becoming aware of a personal data breach, to notify the Andorran Data Protection Agency of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Article 36(1) also requires a notification made after that seventy-two-hour period to justify the reasons for the delay.

Article 36(2) requires a processor to notify the controller without delay of any personal data breach it becomes aware of. Article 36(3) fixes what the Agency notification must contain at minimum, including the nature of the breach, the categories and approximate number of data subjects and personal data records concerned where possible, a contact point's name and details, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.

Article 36(4) lets that information be given in phases without undue delay where it cannot all be given at once. Article 36(5) requires the controller to document every personal data breach, including its facts, effects and remedial measures, so the supervisory authority can verify compliance with the notification duty.

Article 37(1) requires the controller to communicate a personal data breach to the data subject without undue delay where the breach is likely to result in a high risk to the rights and freedoms of natural persons.

Article 37(3) excuses that communication where the controller had applied protective measures, such as encryption, that rendered the affected data unintelligible, where the controller has since eliminated the high risk, or where communication would take disproportionate effort and a public communication of equivalent effectiveness is made instead.

Article 37(4) still lets the Agency require the communication, or determine that one of the Article 37(3) conditions applies, where the controller has not itself communicated the breach to the data subject.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .