Liechtenstein

A controller must notify a personal data breach to the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33(1) of the General Data Protection Regulation (GDPR)).

Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller must communicate it to the data subject without undue delay (Article 34(1) of the GDPR). Article 43 of the DSG bars the use of a notification under Article 33 of the GDPR, or of a communication under Article 34(1), in criminal proceedings under Articles 41 and 42 of the DSG against the person who gave it or that person's listed relatives, unless that person consents.

For processing by the public bodies responsible for preventing, investigating, detecting or prosecuting criminal offenses, Article 64 of the DSG requires the controller to notify a breach to the Datenschutzstelle without undue delay and if possible within 72 hours, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

In that field, Article 65 of the DSG requires the controller to notify the data subjects without undue delay where a breach is likely to result in a high risk to their rights and freedoms.

EEA Joint Committee Decision No. 154/2018 of 6 July 2018 replaced point 5e of Annex XI to the EEA Agreement with Regulation (EU) 2016/679. That Decision provides that, for the purposes of the EEA Agreement, the terms Member State and supervisory authority include the EFTA States and their supervisory authorities. The Datenschutzgesetz (DSG) of 4 October 2018 serves to implement the General Data Protection Regulation (GDPR). It also transposes Directive (EU) 2016/680. It took effect on 1 January 2019.

The DSG does not apply insofar as EEA law, in particular the GDPR, applies directly. The Datenschutzstelle is the national supervisory authority under Article 51 of the GDPR and Article 41 of Directive (EU) 2016/680.

In the criminal-justice field that Chapter III of the Datenschutzgesetz governs (the public bodies responsible for preventing, investigating, detecting or prosecuting criminal offences or enforcing penalties, and their processors), the controller must keep a record of all categories of processing activities in its responsibility, and a processor a record of the categories of processing it carries out for a controller, in writing or electronically.

Both must make the records available to the Datenschutzstelle on request. In automated processing systems the controller and the processor must log collection, alteration, consultation, disclosure including transfer, combination and erasure; the logs of consultations and disclosures must show the justification, the date and time and, as far as possible, who consulted or disclosed the data and who received them.

The logs may be used only to check the lawfulness of processing by the data protection officer, the Datenschutzstelle and the person concerned, for self-monitoring, for the integrity and security of the data and for criminal proceedings, and are erased at the end of the year after they were generated. The Datenschutzstelle can ask for them.

Article 44 of the General Data Protection Regulation (GDPR) permits a transfer of personal data to a third country or international organization only if the conditions of Chapter V are complied with by the controller and processor. The Datenschutzgesetz states that it does not apply insofar as EEA law, in particular the GDPR, applies directly.

Article 85 of the Datenschutzgesetz has the Government make ordinances, among other matters, on the adequacy decisions of the EU Commission under GDPR Article 45 and the standard data protection clauses under GDPR Article 46 that apply in Liechtenstein. Chapter III of the Datenschutzgesetz applies to processing by public bodies for the prevention, investigation, detection or prosecution of criminal offenses or the execution of penalties.

Article 77 of the Datenschutzgesetz allows a transfer to a third country in that field where the European Commission has made an adequacy decision under Article 36(3) of Directive (EU) 2016/680. Where there is no such decision, Article 78 allows the transfer if a legally binding instrument provides appropriate safeguards or the controller concludes that they exist.

Article 79 allows a transfer without such safeguards where it is necessary for listed purposes, such as protecting the vital interests of a person. Article 84 adds a further transfer ground for activities outside the scope of both the GDPR and that Directive, for defense, crisis management and humanitarian purposes, beyond the cases the GDPR already allows.

The Datenschutzgesetz serves to implement Regulation (EU) 2016/679. The text of that Regulation currently in force results from the publication of the decisions of the EEA Joint Committee in the Liechtenstein Law Gazette. General Data Protection Regulation (GDPR) Article 22(1) gives a person the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them.

Under GDPR Article 22(3), where the decision rests on a contract or on explicit consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under the Regulation's Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of a proportionate law, with suitable safeguards in place.

Its Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

Article 37(1) of the Datenschutzgesetz adds exceptions to the Article 22(1) right, beyond those in Article 22(2)(a) and (c), for decisions made within listed insurance, due diligence, credit and investment-service matters. Those matters include decisions made in performing an insurance contract that set the premium or grant the person's request.

For those decisions, except insurance decisions that grant the person's request and due diligence decisions, Article 37(2) requires the controller to take suitable measures to protect the person's legitimate interests, including at least the right to obtain human intervention, to state their point of view and to contest the decision.

Article 37(3) lets a decision in an insurance matter under Article 37(1)(a) rest on health data, with appropriate and specific measures to safeguard the person's interests.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Liechtenstein can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. The Datenschutzgesetz narrows these rights twice.

Article 27(4) restricts access, rectification, restriction and objection where they would likely make scientific or historical research or statistics impossible or seriously impair it, and lets a controller refuse access to data needed for scientific research where giving it would take disproportionate effort.

Article 35(1) replaces erasure with restriction where the way the data are processed or stored makes erasure impossible or disproportionately costly and the person's interest in it is low, unless the data were processed unlawfully.

The Datenschutzstelle is responsible for supervising processing by public and non-public bodies (Article 10 of the DSG).

It fines a violation of the General Data Protection Regulation (GDPR), including a negligent one, at up to 11 million francs or, for a legal person, up to 2 percent of its total worldwide annual turnover of the preceding financial year, whichever is higher, in cases under Article 83(4) of the GDPR, and at up to 22 million francs or up to 4 percent, whichever is higher, in cases under Article 83(5) and (6) of the GDPR (Article 40 of the DSG). No fines are imposed on authorities and other public bodies.

A person who has suffered material or immaterial damage through a violation of the GDPR or of Chapter I or II of the DSG is entitled to damages from the controller or the processor under Article 82 of the GDPR (Article 44 of the DSG).

Obtaining without authority personal data that is not freely accessible from a data processing system is an offense, prosecuted before the Landgericht at the injured party's request and punishable by imprisonment of up to six months or a fine of up to 360 daily rates (Article 41 of the DSG).

Article 9(1) of the General Data Protection Regulation (GDPR) prohibits the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Article 21(1) of the Datenschutzgesetz permits, as a derogation from Article 9(1) of the GDPR, the processing of special categories of personal data in listed cases. That includes processing by public and non-public bodies where it is necessary to exercise rights and meet duties under social security and social protection law. Where it relies on Article 21(1), Article 21(2) requires adequate and specific measures to safeguard the interests of the data subject.

The Datenschutzstelle's own published glossary lists voice patterns and face patterns among biometric data, which it describes as unique and lasting. The glossary adds that photographs count as biometric data only when processed with special technical means that allow unique identification or authentication of a person.

Any person who gains access to a computer system, or part of one, that they may not use or may not use alone, by overcoming specific security precautions, is punished with up to six months' imprisonment or a fine of up to 360 daily rates, if the purpose is to obtain personal data protected by a confidentiality interest or to inflict a disadvantage on another person by using data or the system.

The penalty rises to up to two years for an act against a computer system that is part of critical infrastructure, and up to two or three years respectively where committed as part of a criminal group. Prosecution requires the authorization of the aggrieved party. The provision reaches unauthorized access achieved by circumventing a technical access control; it does not by its terms reach the collection of data made available without any security precaution to overcome. The current text of Section 118a was substituted in full by the Act of 28 February 2019 amending the Strafgesetzbuch.

Section 126a punishes a person who damages another by changing, deleting, or otherwise making unusable or suppressing data not at that person's sole disposal, with up to six months' imprisonment or a fine of up to 360 daily rates, rising to up to two years where the damage exceeds CHF 7,500, up to three years for compromising a large number of systems with a purpose-built tool, and six months to five years for damage exceeding CHF 300,000 or an act against critical infrastructure or by a criminal group.

Section 126b punishes serious interference with a computer system's functioning on the same escalating structure. Section 126c punishes developing, distributing, or possessing a computer program or password evidently created to commit any of these offenses, or the offense at § 118a, with up to six months' imprisonment or a fine of up to 360 daily rates, with a defense for a person who voluntarily prevents the tool's use.

An aggressive scraping or crawling operation that changes, deletes, or degrades data or a system it does not control, or that uses a purpose-built tool to compromise a large number of systems, is reached by this chapter. Sections 126a and 126b were inserted, and 126c enacted, by LGBl.

2009 Nr. 228, published 21 August 2009, whose own commencement clause fixes that publication day as its Inkrafttreten; the higher CHF 300,000/critical-infrastructure/criminal-group tier of Secs. 126a and 126b was added later by LGBl. 2019 Nr. 124, in force 1 October 2019, without altering the base offenses described above.

Published works may be used without the rightsholder's authorization only for a closed list of privileged purposes: use within a personal or closely connected circle, illustration in teaching or non-commercial scientific research, photomechanical reproduction for teaching, research, or internal documentation in an institution, and non-commercial digital reproduction for teaching or research.

The article does not apply to computer programs, and it does not create a text-and-data-mining exception or a machine-readable opt-out mechanism of the kind EU Directive 2019/790 introduced; a use falling outside this closed list, including bulk reproduction of copyrighted text for commercial AI training or aggregation, requires the rightsholder's authorization under the general reproduction right (Art. 10).

The closed list of privileged purposes in Art. 22(1)(a)-(d), quoted above, was inserted in its entirety by LGBl. 2006 Nr. 263, published 19 December 2006, whose own commencement clause fixes that publication day as its Inkrafttreten; it replaced the original 1999 text of Art. 22(1).

The producer of a database that required a qualitatively or quantitatively substantial investment in obtaining, verifying, or presenting its contents has the right to prohibit the extraction or re-utilization of the whole, or a substantial part, of that database's contents (Art. 45), independent of any copyright in the database or its contents.

The right runs for 15 years from completion of the database (Art. 49), and belongs to a producer who is a national of, or habitually resident in, an EEA member state, or a company with a genuine link to one (Art. 46), reflecting the sui generis right's EEA-wide incorporation of EU Directive 96/9/EC.

A lawful user of a publicly available database may extract or re-utilize a non-substantial part without authorization for private use of a non-electronic database, for teaching or scientific research with attribution, or for public security or administrative or judicial proceedings (Art. 48).

Unauthorized extraction or re-utilization is a criminal offense on the aggrieved party's complaint, with up to one year's imprisonment or a fine of up to 360 daily rates, rising to up to three years for a commercial infringement (Art. 64). The Urheberrechtsgesetz was passed by the Landtag on 19 May 1999 and published as LGBl.

1999 Nr. 160 on 23 July 1999; its own Art. 79 provides that it enters into force on the day of its Kundmachung (publication), so 23 July 1999 is the day the sui generis right and Art. 64's offense took effect, not the 19 May 1999 passage date.

Article 17 of the Kommunikationsgesetz requires providers to take all appropriate measures to maintain network integrity and the availability of public communications networks and services. Article 17 of the Kommunikationsgesetz lets the regulatory authority oblige any provider to undergo a security audit by a qualified, independent body.

Article 70 of the Kommunikationsgesetz fines a provider that infringes its duties on the integrity and availability of public communications networks and services under Article 17.

Article 1 binds a public or private entity listed in Annex 1 or Annex 2 that qualifies as a medium or large company under Article 1064(2) or (3) of the Personen- und Gesellschaftsrecht (Persons and Companies Act) and provides its services or carries out its activities in Liechtenstein.

Article 4 requires such an essential or important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems it uses for its operations or to provide its services, and to prevent or minimise the impact of a security incident on the recipients of its services and on other services.

These measures must cover at least ten baseline categories mirroring NIS2 Article 21: risk analysis and information-system-security policy, incident handling, business continuity (including backup management and disaster recovery) and crisis management, supply-chain security, security in the acquisition, development and maintenance of systems including vulnerability management and disclosure, evaluating the measures' effectiveness, basic cyber-hygiene procedures and training, cryptography and encryption, personnel security and access control, and multi-factor or continuous authentication.

Article 5 requires the entity's leadership body (Leitungsorgan) to approve and oversee those measures and to attend, and offer its staff, regular training on recognising and assessing cybersecurity risk. Annex 2 Item 6 names an online-marketplace provider, an online-search-engine provider and a social-networking-platform provider among the digital-service providers this duty reaches expressly.

Article 2 of the EEA DORA Implementation Act applies the Act to financial entities and ICT third-party service providers, subject to the exceptions in Article 2(3) of Regulation (EU) 2022/2554. Article 11 of the EEA DORA Implementation Act makes Regulation (EU) 2022/2554 national law until its incorporation into the EEA Agreement. Article 4 of the EEA DORA Implementation Act makes the FMA the competent authority for Liechtenstein under Regulation (EU) 2022/2554.

Article 9 of the EEA DORA Implementation Act fines a person who fails to meet the ICT risk management requirements of Articles 5 to 14 of Regulation (EU) 2022/2554. Article 9 of the EEA DORA Implementation Act sets the fine for a legal person at up to CHF 1,000,000.

Article 17 of the Kommunikationsgesetz requires providers to notify the regulatory authority without delay of any breach of security or loss of network integrity with significant impact on network operation. Article 70 of the Kommunikationsgesetz fines a provider that infringes its duties on the integrity and availability of public communications networks and services under Article 17.

Article 6 requires an essential or important entity to notify the Stabsstelle Cyber-Sicherheit (Cyber Security Office) of a significant security incident without delay.

It requires an early warning within 24 hours of becoming aware of the incident, stating where relevant whether it is suspected to result from unlawful or malicious acts or to have cross-border effect, followed by a full notification within 72 hours that updates that assessment with the incident's severity, impact and any indicators of compromise.

An intermediate report is due on the Office's request, and a final report is due within one month of the 72-hour notification, describing the incident, its cause and its mitigation in detail. Annex 2 Item 6 names an online-marketplace provider, an online-search-engine provider and a social-networking-platform provider among the digital-service providers this duty reaches expressly.

Article 2 of the EEA DORA Implementation Act applies the Act to financial entities and ICT third-party service providers, subject to the exceptions in Article 2(3) of Regulation (EU) 2022/2554. Article 11 of the EEA DORA Implementation Act makes Regulation (EU) 2022/2554 national law until its incorporation into the EEA Agreement.

Article 9 of the EEA DORA Implementation Act fines a person who fails to submit the reports required by Article 19 of Regulation (EU) 2022/2554 to the FMA correctly, completely or on time. Article 19 of Regulation (EU) 2022/2554 requires financial entities to report major ICT-related incidents to the relevant competent authority.

The Produktehaftpflichtgesetz (PrHG) is the Liechtenstein act on liability for defective products, and it was published in the Landesgesetzblatt on 14 January 1993. Article 1, paragraph 1 makes the manufacturer liable for the damage where a defective product leads to a person being killed or injured, or to damage to or destruction of a thing that is ordinarily intended for private use or consumption and was mainly used privately by the injured person.

Article 1, paragraph 2 excludes liability for damage to the defective product itself. Article 2 treats as manufacturer the manufacturer of the final product, of a raw material or of a component, and anyone who presents itself as the manufacturer by putting its name, trade mark or another mark of identification on the product.

Article 3 also treats as manufacturer a person who imports a product into the European Economic Area for sale, hire, hire-purchase or another form of distribution in the course of its business. Article 4, paragraph 1 treats each supplier as the manufacturer where the manufacturer cannot be identified, unless the supplier names the manufacturer or its own supplier to the injured person within a reasonable time after being asked.

Article 4, paragraph 2 applies the same rule to an imported product whose importer cannot be identified, even if the manufacturer is named. Article 5, paragraph 1 defines a product as any movable thing, even one that forms part of another movable or of an immovable, and electricity. Article 6, paragraph 1 makes a product defective if it does not offer the safety that one is entitled to expect, taking all circumstances into account.

Article 6, paragraph 1 names among those circumstances the presentation of the product, the use that can reasonably be expected and the time at which the product was put into circulation. Article 6, paragraph 2 provides that a product is not defective merely because an improved product was put into circulation later.

Article 7, paragraph 1 frees the manufacturer who proves that it did not put the product into circulation, that the circumstances indicate the defect did not yet exist when it did so, that the product was not made for sale or another form of distribution with an economic purpose or in the course of its professional activity, that the defect is due to the product complying with mandatory rules issued by the public authorities, or that the defect could not be recognised according to the state of science and technology when the product was put into circulation.

Article 7, paragraph 2 frees the manufacturer of a raw material or a component who proves that the defect was caused by the design of the product it went into or by the instructions of that product's manufacturer. Article 7a makes several persons who are liable answerable jointly and severally. Article 7b, paragraph 1 provides that the manufacturer's liability is not reduced where the damage was caused by a defect in the product and at the same time by the act of a third party.

Article 7b, paragraph 2 applies section 1304 of the Allgemeines bürgerliches Gesetzbuch by analogy where the injured person, or someone whose conduct the injured person must answer for, is at fault. Article 8, paragraph 1 makes the injured person bear damage to things up to 900 francs themselves. Article 8, paragraph 2 has the Government adjust that amount where the deductible is changed in the law of the European Economic Area.

Article 9 makes void an agreement that limits or excludes liability under the Act towards the injured person. Article 10 sets a limitation period of three years from the day the injured person knew or should have known of the damage, the defect and the identity of the manufacturer. Article 11, paragraph 1 extinguishes claims under the Act ten years after the manufacturer put the product that caused the damage into circulation.

Article 11, paragraph 2 provides that the claim is not extinguished where court proceedings against the manufacturer are pending. Article 12, paragraph 1 applies the Allgemeines bürgerliches Gesetzbuch to the claims for compensation that the Act provides, except where the Act provides otherwise.

Article 12, paragraph 2 leaves untouched the provisions of the Allgemeines bürgerliches Gesetzbuch and other rules under which damage is compensated to a wider extent or to other persons than under the Act. Article 12, paragraph 3 excludes damage from a nuclear incident to which an international convention ratified by the States of the European Economic Area applies. Article 13 applies the Act only to products put into circulation after it entered into force.

Article 14 provides that the Act enters into force on 1 November 1994. The consolidated text records that Article 14 was amended in 1994, that Articles 7a and 7b were inserted in 1997 and that the second paragraph of Article 5 was repealed in 2001. The Systematic Register of Liechtenstein legislation records three changes to the Act, the last of them published in 2001.

A person who offers or presents a product or service, including a media product or service, that could endanger a minor's development or safety, and an entrepreneur who enables access to such a product or service, must take suitable and reasonable measures ensuring that minors of the relevant age group do not obtain access.

Audio-visual media products and services, in particular films and entertainment software, may only be offered to, or possessed and consumed by, a minor consistent with a minimum-age classification that a commercial provider must apply and clearly display, following reference-body recommendations designated by the Office for Social Services.

The Act's own general child-protection framework is expressly subordinate, for media specifically, to the media legislation's own child-protection provisions (the Mediengesetz above); it operates as the residual, non-media-specific duty for a product or service more broadly. The Kinder- und Jugendgesetz was adopted by the Landtag on 10 December 2008, published as LGBl.

2009 Nr. 29 on 28 January 2009, and its own Art. 110 fixes 1 February 2009 as its Inkrafttreten (subject to the referendum period lapsing unused).

A video-sharing-platform provider, defined as a person who operates a video-sharing platform service, must take appropriate measures to protect minors from broadcasts, user-generated videos, and audiovisual commercial communication that could impair their physical, mental, or moral development.

It must also take appropriate measures to protect the general public from content whose dissemination is itself a criminal offense, including incitement to a terrorist act and child-pornography offenses under the Strafgesetzbuch. Disputes between users and a video-sharing-platform provider over compliance are mediated by Liechtenstein's regulatory authority (Art. 82d).

The Act's own enumerated list of administrative fines (Art. 93) does not separately name a breach of Art. 82c's protection duties themselves. The Act was passed by the Landtag on 5 October 2023 and published as LGBl. 2023 Nr. 448 on 6 December 2023. It came into force only on 1 May 2025, the day Liechtenstein's Kundmachung of EEA Joint Committee Decision No. 337/2022 fixed as its Inkrafttreten for the Principality (LGBl. 2025 Nr. 214); it transposes Article 28b of Directive 2010/13/EU.

Article 27 permits quoting a published work where the quotation serves explanation, reference, or illustration and its length is justified by that purpose, with the quotation and its source named. Article 31(2) separately permits reproducing, distributing, broadcasting, or retransmitting a short excerpt from a press article or a radio or television report for the purpose of informing about current issues, with the excerpt and its source named.

Together these are the exceptions an aggregator's reproduction of a headline or short excerpt of third-party journalism would rely on; both are scoped to a defined purpose (illustration or explanation; informing about current issues) and a source-attribution duty, not a general license to republish. The Urheberrechtsgesetz was passed by the Landtag on 19 May 1999 and published as LGBl.

1999 Nr. 160 on 23 July 1999; its own Art. 79 provides that it enters into force on the day of its Kundmachung (publication), so 23 July 1999, not the 19 May 1999 passage date, is the day these provisions took effect.