AndorraLQPD, Llei 29/2021 del 28 d'octubre
LQPD Llei 29/2021 del 28 d'octubre, arts. 1-2, 4-7, 11-14, 27-35, 38-41 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, and other general processing rules)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Consent, Security, DPIA
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a lawful basis under Article 6 before processing personal data of a person in Andorra, and apply the Article 5 principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation and security throughout.NIST Privacy FrameworkCT.PO-P1
- Designate a representative established in Andorra if you are a controller or processor not domiciled there or not constituted under Andorran law but use processing means located in Andorran territory.NIST Privacy FrameworkGV.PO-P5
- Apply data protection by design and by default, keep a written record of your processing activities unless you employ fewer than fifty workers and none of the high-risk, non-occasional or special-category exceptions apply, and block rather than delete personal data pending any liability claim when you rectify or erase it.NIST Privacy FrameworkGV.PO-P2NIST Privacy FrameworkID.IM-P4
- Carry out a data protection impact assessment before high-risk processing such as systematic automated evaluation with legal effects, large-scale special-category processing, or large-scale systematic monitoring of a publicly accessible area, and consult the Agency first where the assessment shows a risk you have not mitigated.NIST Privacy FrameworkID.RA-P4
- Appoint a Data Protection Officer if you are a public authority, or if your core activities involve automated decisions with legal effects, large-scale special-category processing, or large-scale processing that could seriously affect a large number of data subjects, and notify the Agency of that officer's contact details within ten working days of appointment.NIST Privacy FrameworkGV.PO-P3
- Put appropriate technical and organisational security measures in place, proportionate to the risk, before and during processing.NIST Privacy FrameworkPR.DS-P5
- Do not treat academic, artistic, literary or professional journalistic expression as exempt from this law's core principles, only from the specific articles Article 12 lists, including the special-categories, criminal-offence-data and cross-border-transfer rules.
These lines are LexLint's reading of the law's text. Also read by: Agencia Andorrana de Proteccio de Dades (APDA), the Andorran Data Protection Agency (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
1 more
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.apda.ad/obligacions
- Guidance body
- Agencia Andorrana de Proteccio de Dades (APDA), the Andorran Data Protection Agency
- Open questions
- Does a controller not domiciled in Andorra "facin servir mitjans de tractament ubicats en el territori andorrà" ("use processing means located in Andorran territory") when it only serves websites or apps to devices located in Andorra?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 34 makes every controller keep a written register of its processing activities (public bodies always, private bodies where the Article 34(8) size and risk conditions are met; fewer than fifty workers with no risky, non-occasional or special-category processing is exempt), with the content listed in Article 34(3) and (4), and Article 34(7) makes the register available to the Agency on its request. Article 7(1) separately makes a controller relying on consent able to demonstrate that the person consented, which cannot be shown without a record; Article 5(3) adds the general duty to demonstrate compliance with the principles. The register's items (purposes, categories of persons, data and recipients, transfers, deletion periods, security measures) are not log content values, so only the consent state is coded. Article 34 sets no period for keeping the register. Article 36(5) (the record of every breach) is not among the articles this row cites and is coded on the breach row. The Article 2(2) prong that reaches a controller using processing means located in Andorra turns on where the equipment is, which is not a hook value, so it is left out of the hook.
- Kind
- Explicit
- As of
- Provision
- Article 34 (register of processing activities), with Article 7(1) (proof of consent)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Llei 29/2021, del 28 d'octubre, qualificada de proteccio de dades personals (LQPD) is Andorra's general, General Data Protection Regulation (GDPR)-modelled data protection statute, consolidated to reflect amendments by Llei 12/2024 and Llei 16/2024.
Article 2(2) extends the law to a controller or processor not domiciled in Andorra or not constituted under Andorran law that uses processing means located in Andorran territory, automated or not, and requires such a controller or processor to designate a representative established in Andorra. Article 4 defines the terms the law uses, including personal data, consent, processing, profiling, controller, processor and personal data breach.
Article 5 sets the principles applicable to processing, covering lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality, and Article 6 lists the lawful bases for processing, led by the data subject's consent.
Articles 27 to 31 set the controller's and processor's obligations, covering accountability, data protection by design and by default, the representative duty Article 2 already states, a duty to block personal data on rectification or erasure pending any liability claims, and a processor's contractual obligations.
Article 34 requires a written record of processing activities, exempting a business or organisation with fewer than fifty workers unless the processing risks data subjects' rights, is not occasional, or involves special categories of data or criminal-offence data.
Article 32 requires a data protection impact assessment before high-risk processing, and Article 33 requires prior consultation with the Andorran Data Protection Agency where that assessment shows a high risk the controller has not mitigated. Article 35 requires appropriate technical and organisational security measures proportionate to the risk, and Articles 38 to 41 add a Data Protection Officer duty for public bodies and qualifying private controllers, and codes-of-conduct provisions.
Article 12 exempts processing for academic, artistic or literary expression, or professional journalistic activity, from several of the law's provisions, including the special-categories and criminal-offence-data rules and the whole cross-border transfer chapter, to the extent necessary to reconcile data protection with freedom of expression and information.
Article 14 presumes a legitimate-interest basis for processing the contact data of an individual entrepreneur's or professional's staff, limited to their professional capacity.
A separate future law, still to be presented under the LQPD's fourth final provision, will govern data processing for the prevention, investigation, detection or prosecution of criminal offences, following the model of Directive (EU) 2016/680, and until then Article 2(4)(c) excludes that processing from the LQPD's own scope.
The fourth final provision sets the law's entry into force at six months after its publication in the Official Bulletin of the Principality of Andorra, and the Andorran Data Protection Agency's own notice confirms that date as .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .