MonacoLoi sur la Protection des Données Personnelles
Loi n. 1.565 du 3 decembre 2024 relative a la protection des donnees a caractere personnel Journal de Monaco n. 8725, arts. 1, 3-6, 9, 21-36, 58-63, 78-87 (scope, lawful basis, and controller and processor obligations)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Governance, Consent, Security, DPIA, Contract terms, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Establish one of the lawful bases Article 5 lists, such as consent, contract necessity, a legal obligation, vital interests, an important public interest ground, or legitimate interest, before processing personal data of a person in Monaco.NIST Privacy FrameworkCT.PO-P1
- Take consent only as a free, specific, informed and unambiguous act, present a bundled consent request separately from other terms, and do not make consent a condition of a good or service unless the processing is indispensable to providing it.NIST Privacy FrameworkCT.PO-P1
- Build data protection by design and by default into a processing operation, so that by default only the personal data necessary for each specific purpose is processed, collected, retained, or made accessible.NIST Privacy FrameworkGV.PO-P2
- Keep a written record of your processing activities covering the particulars Article 27 lists, and make it available to the Authority on request, unless you are an undertaking of fewer than 50 employees in Monaco whose processing is occasional, low risk, and free of sensitive or criminal record data.NIST Privacy FrameworkID.IM-P4
- Designate a data protection officer wherever you are a public body, your core activities require large scale regular and systematic monitoring, or your core activities involve large scale processing of sensitive or criminal record data, and let that officer report to top management free of instructions.NIST Privacy FrameworkGV.PO-P3
- Carry out a data protection impact assessment before processing likely to create a high risk to a person's rights and freedoms, such as large scale profiling with legal effects, large scale sensitive data processing, large scale public area surveillance, or large scale use of a digital identifier, and consult the Authority first where the assessment still shows a high risk you cannot mitigate.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkGV.PO-P5
- Take appropriate technical and organisational security measures, including pseudonymisation and encryption, proportionate to the risk of destruction, loss, alteration, or unauthorised disclosure of or access to the personal data you process.NIST Privacy FrameworkPR.DS-P5
- Get the Minister of State's prior authorisation before installing a video surveillance system in a place open to the public or filming a public way, and do not keep recorded images for more than 30 days.NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text. Also read by: Autorite de protection des donnees personnelles of Monaco (APDP) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://apdp.mc/professionnels/connaitre-vos-obligations/
- Guidance body
- Autorite de protection des donnees personnelles of Monaco (APDP)
- Open questions
- Does the exemption in Article 27 for undertakings "comptant moins de 50 salariés" ("with fewer than 50 employees") that are "établies en Principauté" ("established in the Principality") count only employees working in Monaco, or the whole workforce of the undertaking?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 27 requires the controller (and a processor, for the categories of processing it carries out) to keep a written register of processing activities, naming at least the controller, purposes, categories of persons and data, recipients, retention period or criteria where possible, security measures and transfers, and to make it available to the Authority on simple request; the register is exempt for an establishment of fewer than 50 employees unless the processing is risky, not occasional or involves sensitive or offence data. Article 32(I) requires the controller to document every personal data breach with its facts, effects and remedial steps, and Article 6 requires the controller to be able to demonstrate consent. The register's named contents are purposes, categories and the like, none of which is a log content value, so the content list carries only the consent state. Article 3 states the territorial scope. The Article 84 limit of 30 days on keeping video-surveillance images limits the recording itself, which is the processed data and not a log of the controller's processing, and is not coded as a log retention.
- Kind
- Explicit
- As of
- Provision
- Article 27; Article 32(I), last paragraph; Article 6, first paragraph
- Trigger
- personal_data_processing
- security_incident
- consent_or_optout
What this law does
Law 1.565 replaced Law 1.165 of 1993, transposes Council of Europe Convention 108 plus obligations, and was ratified by Monaco on . Article 118 states plainly that Law 1.165 is repealed, and the law was signed by Prince Albert II on and published in Journal de Monaco No. 8725 on .
No standalone entry into force clause was found across all 118 articles, including the closing and transitional provisions, so the effective date here is that Journal de Monaco publication date, , not an express commencement date the law states for itself.
Article 5 sets six lawful bases for processing personal data, consent, legal obligation, contract necessity, vital interests, an important public interest ground reserved to public bodies and their delegates, and legitimate interest, and bars a public body from relying on legitimate interest for the performance of its own missions.
Article 6 requires consent to rest on a free, specific, informed and unambiguous act, requires a bundled consent request to be presented separately from other terms, and bars making consent a condition of a good or service unless the processing is indispensable to providing it.
Article 23 requires data protection by design and by default, so that only the data necessary for each specific purpose is processed and personal data is not made accessible to an indefinite number of people without the person's own action. Article 27 requires a written record of processing activities, with a narrow exemption for an undertaking of fewer than 50 employees in Monaco whose processing is occasional, low risk, and free of sensitive or criminal record data.
Articles 28 to 30 require a data protection officer wherever a public body processes data, core activities require large scale regular and systematic monitoring, or core activities involve large scale processing of sensitive or criminal record data, and require that officer to report to top management free of any instruction.
Articles 35 and 36 require a data protection impact assessment before processing likely to create a high risk, and require the controller to consult the Authority first where the assessment still shows a high risk the controller cannot mitigate. Article 31 requires security measures, including pseudonymisation and encryption, proportionate to the risk of destruction, loss, alteration, or unauthorised disclosure of or access to personal data.
A video surveillance system installed in a place open to the public, or filming a public way, needs the Minister of State's prior authorisation under Article 85, and Article 84 caps the retention of recorded images at 30 days.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .