AndorraLQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect a data subject to be able to lodge a complaint with the Agency electronically or in person, and a representative body, organisation or non-profit association active in data-subject-rights protection to be able to lodge it and pursue judicial remedies on their behalf.
- Cooperate with an Agency investigation, including giving inspectors access to your premises, equipment, processing means and any information they request.
- Comply with a corrective order the Agency issues, which can include a warning, a reprimand, an order to fulfil a data subject's rights request, an order to bring processing into compliance, a temporary or definitive limitation or ban on processing, or an order suspending data flows to a third country.
- Expect an administrative fine set according to the nature, gravity and duration of an infringement, intent or negligence, mitigating measures you took, your degree of cooperation with the Agency, and prior infringements, ranging from five hundred euros for a minor infringement to one hundred thousand euros for a very serious one.
- Expect the total fine for several infringements arising from the same or related processing to be capped at the amount set for the single most serious infringement.
- Expect joint and several liability with every other controller or processor involved in the same processing for compensating a person's material or non-material damage from an infringement of this law, unless you prove you bear no responsibility for it.
- Expect a claim for compensation to be brought within one year of a final declaration of liability, before the competent Andorran courts.
- Expect the Agency to refer signs of criminal conduct arising during a sanctioning procedure to the competent court and suspend the administrative procedure while that referral is pending.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
This law's own Chapter Seven (arts. 68-74) sets administrative fines only, from EUR 500 up to EUR 100,000 depending on the infringement tier, with no turnover-based fine. Article 69 separately requires the Head of the Agency to refer signs of criminal conduct emerging during a sanctioning procedure to the competent court and suspend the administrative procedure, without stating the criminal offences or penalties itself.
Penalty structure
Article 73 sets three fixed fine tiers by infringement severity: very serious infringements EUR 30,001 to 100,000, serious infringements EUR 15,001 to 30,000, and minor infringements EUR 500 to 15,000. Article 68(3) caps the total fine for several infringements arising from the same or related processing at the amount set for the most serious infringement. Unlike the GDPR and several jurisdictions this Law otherwise closely follows, no tier is expressed as a percentage of annual turnover. Article 74 limits the sanction against Andorra's general administration and other listed public bodies to a reprimand.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 100,000
Who enforces it
Enforcement body
Andorran Data Protection Agency (Agencia Andorrana de Proteccio de Dades, APDA), led by a Head designated by the Consell General
Settledness
- As of
- Open questions
- Does the one-year period in Article 71(6) for a compensation action run from the date a decision of the Agency becomes final or only from a court's declaration of liability, given that it counts from "la fermesa de la declaració de la responsabilitat" ("the finality of the declaration of liability")?
- Does the reprimand-only regime of Article 74(2) reach a public-law corporation listed in Article 74(1)(f) when part of its processing is not tied to "l’exercici de potestats de dret públic" ("the exercise of public-law powers")?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 46 to 74 set up the Agency, its investigation and inspection powers (Articles 62 and 63), the sanction procedure and the infringements. A controller must supply the inspectors with the information they ask for and give access to its premises and computer resources (Article 63(2)), and the Agency may examine equipment and access systems and audit computer systems (Article 63(4)). That is a power to demand information and inspect, not a duty to keep a record. The infringements in Article 72 punish failing to keep the Article 34 register or to document a breach, but those duties sit in Articles 34 and 36(5), which this row does not cite, so it is coded on its own text.
- Kind
- None
- As of
What this law does
Article 46 establishes the Andorran Data Protection Agency (APDA), created in 2003, as an independent public-law institution with its own legal personality, acting with full independence from Andorra's public administrations. Article 50bis places the Agency under a Head, designated by the Consell General by a two-thirds qualified majority, who exercises the Agency's legal and institutional representation independently and neutrally.
Article 61 gives a data subject the right to lodge a complaint with the Agency electronically or in person, and lets a representative body, organisation or non-profit association active in data-subject-rights protection lodge the complaint and pursue judicial remedies on the data subject's behalf.
Articles 62 and 63 give the Agency investigatory powers to demand information, conduct data-protection audits, access a controller's or processor's premises, equipment and processing means, and notify suspected infringements.
Article 65 splits the sanctioning procedure into an investigative phase run by the Agency's inspectors and a sanctioning phase decided by the Head of the Agency, and Article 69 requires the Head to notify the competent court and suspend the administrative procedure if signs of criminal conduct emerge during it.
Article 67 gives the Agency corrective powers, including a warning, a reprimand, an order to comply with a data subject's rights request, an order bringing processing into compliance, a temporary or definitive limitation or ban on processing, and an order suspending data flows to a third country or international organisation, cumulative with an administrative fine under Article 68.
Article 68 sets the criteria for an administrative fine, including the nature, gravity and duration of the infringement, intent or negligence, mitigating measures taken, the degree of cooperation with the Agency, and prior infringements, and caps the total fine for several infringements from the same conduct at the amount set for the most serious infringement.
Article 70 sets the limitation period for infringements at three years for very serious infringements, two years for serious infringements, and one year for minor infringements.
Article 71 gives any person who has suffered material or non-material damage from an infringement of this law the right to compensation from the controller or processor, holds every controller or processor involved in the same processing jointly and severally liable, and excuses one that proves it bears no responsibility for the damage.
Article 72 classifies infringements as very serious, serious or minor, with a very serious infringement including processing without a lawful basis, processing prohibited special categories of data without an Article 9 exception, and deliberately reversing an anonymisation process to re-identify a data subject.
Article 73 sanctions a very serious infringement with a fine of thirty thousand and one to one hundred thousand euros, a serious infringement with fifteen thousand and one to thirty thousand euros, and a minor infringement with five hundred to fifteen thousand euros, with no separate turnover-based tier. Article 74 limits the sanction against Andorra's general administration, the comuns, the Consell General, the judiciary and other listed public bodies to a reprimand rather than a fine.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .