LexLint

Know the law your code answers to.

Law / Andorra

LQPD, Llei 29/2021 del 28 d'octubre

LQPD Llei 29/2021 del 28 d'octubre, arts. 1-2, 4-7, 11-14, 27-35, 38-41 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, and other general processing rules)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 17 May 2022.

A comprehensive regime rule binding public and private bodies.

As of 19 September 2026.

What it requires

  • Establish a lawful basis under Article 6 before processing personal data of a person in Andorra, and apply the Article 5 principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation and security throughout.
  • Designate a representative established in Andorra if you are a controller or processor not domiciled there or not constituted under Andorran law but use processing means located in Andorran territory.
  • Apply data protection by design and by default, keep a written record of your processing activities unless you employ fewer than fifty workers and none of the high-risk, non-occasional or special-category exceptions apply, and block rather than delete personal data pending any liability claim when you rectify or erase it.
  • Carry out a data protection impact assessment before high-risk processing such as systematic automated evaluation with legal effects, large-scale special-category processing, or large-scale systematic monitoring of a publicly accessible area, and consult the Agency first where the assessment shows a risk you have not mitigated.
  • Appoint a Data Protection Officer if you are a public authority, or if your core activities involve automated decisions with legal effects, large-scale special-category processing, or large-scale processing that could seriously affect a large number of data subjects, and notify the Agency of that officer's contact details within ten working days of appointment.
  • Put appropriate technical and organisational security measures in place, proportionate to the risk, before and during processing.
  • Do not treat academic, artistic, literary or professional journalistic expression as exempt from this law's core principles, only from the specific articles Article 12 lists, including the special-categories, criminal-offence-data and cross-border-transfer rules.

What it reaches

Obligation class

Governance, Consent, Security, DPIA

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Llei 29/2021, del 28 d'octubre, qualificada de proteccio de dades personals (LQPD) is Andorra's general, General Data Protection Regulation (GDPR)-modelled data protection statute, consolidated to reflect amendments by Llei 12/2024 and Llei 16/2024.

Article 2(2) extends the law to a controller or processor not domiciled in Andorra or not constituted under Andorran law that uses processing means located in Andorran territory, automated or not, and requires such a controller or processor to designate a representative established in Andorra. Article 4 defines the terms the law uses, including personal data, consent, processing, profiling, controller, processor and personal data breach.

Article 5 sets the principles applicable to processing, covering lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality, and Article 6 lists the lawful bases for processing, led by the data subject's consent.

Articles 27 to 31 set the controller's and processor's obligations, covering accountability, data protection by design and by default, the representative duty Article 2 already states, a duty to block personal data on rectification or erasure pending any liability claims, and a processor's contractual obligations.

Article 34 requires a written record of processing activities, exempting a business or organisation with fewer than fifty workers unless the processing risks data subjects' rights, is not occasional, or involves special categories of data or criminal-offence data.

Article 32 requires a data protection impact assessment before high-risk processing, and Article 33 requires prior consultation with the Andorran Data Protection Agency where that assessment shows a high risk the controller has not mitigated. Article 35 requires appropriate technical and organisational security measures proportionate to the risk, and Articles 38 to 41 add a Data Protection Officer duty for public bodies and qualifying private controllers, and codes-of-conduct provisions.

Article 12 exempts processing for academic, artistic or literary expression, or professional journalistic activity, from several of the law's provisions, including the special-categories and criminal-offence-data rules and the whole cross-border transfer chapter, to the extent necessary to reconcile data protection with freedom of expression and information.

Article 14 presumes a legitimate-interest basis for processing the contact data of an individual entrepreneur's or professional's staff, limited to their professional capacity.

A separate future law, still to be presented under the LQPD's fourth final provision, will govern data processing for the prevention, investigation, detection or prosecution of criminal offences, following the model of Directive (EU) 2016/680, and until then Article 2(4)(c) excludes that processing from the LQPD's own scope.

The fourth final provision sets the law's entry into force at six months after its publication in the Official Bulletin of the Principality of Andorra, and the Andorran Data Protection Agency's own notice confirms that date as 17 May 2022.

When LexLint raises it

  • crawls_web
  • trains_models
  • generates_content
  • deploys_chatbot
  • automated_outreach
  • high_risk_decisions

Read the law

Consolidated statute text at portaljuridicandorra.ad
apda.ad entry-into-force announcement

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app