San Marino

Article 34(1) requires the controller, in the case of a personal data breach, to notify it to the Data Protection Authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and to accompany a later notification with reasons for the delay.

Article 34(2) requires the processor to notify the controller without undue delay after becoming aware of a breach, and article 34(3) fixes what the notification must describe: the nature of the breach including, where possible, the categories and approximate number of data subjects and of personal data records concerned, the name and contact details of the data protection officer or other contact point, the likely consequences, and the measures taken or proposed to address it and mitigate its adverse effects.

Article 34(5) requires the controller to document every breach, its effects and the remedial action taken.

Article 35(1) requires the controller to communicate the breach to the data subject without undue delay where it is likely to result in a high risk to the rights and freedoms of natural persons, in clear and plain language, and article 35(3) excuses that communication only where protective measures such as encryption render the data unintelligible, where subsequent measures make the high risk no longer likely, or where it would involve a disproportionate effort and a public communication of equal effect is made instead.

Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title. Article 129 provides that the law enters into force on the fifteenth day after its legal publication. The Bollettino Ufficiale records its publication on 21 December 2018, so the law entered into force on 5 January 2019.

Article 3 fixes the law's territorial and material scope. Article 4 carries the processing principles and article 5 the lawful bases, while article 6 sets the conditions for valid consent and article 7 the conditions for a child's consent to an information society service. Articles 10 and 11 govern data on criminal convictions and processing that does not require identification.

Article 26 places responsibility for compliance on the controller, article 27 requires data protection by design and by default, article 28 governs joint controllers, article 29 the engagement of a processor and article 30 processing under the authority of either. Article 31 requires records of processing activities and article 32 cooperation with the Data Protection Authority. Article 33 requires technical and organisational measures giving a level of security appropriate to the risk.

Article 36 requires a data protection impact assessment where processing is likely to result in a high risk, and article 37 prior consultation of the Authority where the assessment shows that risk. Articles 38 to 40 govern the designation, position and tasks of the data protection officer, and articles 41 to 44 the codes of conduct, their monitoring, certification and certification bodies.

Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title. Article 129 provides that the law enters into force on the fifteenth day after its legal publication. The Bollettino Ufficiale records its publication on 21 December 2018, so the law entered into force on 5 January 2019.

Article 45 permits a transfer of personal data to a foreign country or an international organisation only on the conditions this Title lays down, including for onward transfers from there to another country or organisation.

Article 46 governs transfer on the basis of a decision that the destination affords an adequate level of protection, article 47 transfer subject to appropriate safeguards such as standard data protection clauses, article 48 binding corporate rules and what they must specify, and article 49 the recognition of judgements and decisions of foreign countries.

Article 50 sets the narrow derogations that permit a transfer in the absence of an adequacy decision or appropriate safeguards, including the data subject's explicit consent after being informed of the risks, contractual necessity, important reasons of public interest, legal claims, vital interests, and a transfer from a public register.

Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title. Article 129 provides that the law enters into force on the fifteenth day after its legal publication. The Bollettino Ufficiale records its publication on 21 December 2018, so the law entered into force on 5 January 2019.

Article 22(1) gives the data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them. Paragraph 2 lists exceptions, including where the decision is necessary for a contract or rests on explicit consent.

Paragraph 3 requires the controller, in those cases, to implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, at least the right to obtain human intervention, express a point of view, and contest the decision.

Article 13 fixes the information a controller gives when it collects personal data from the data subject, and article 14 the information due where the data came from elsewhere.

Article 15 gives a right of access, article 16 a right to rectification, article 17 a right to erasure described as the right to be forgotten, article 18 a right to restriction of processing, article 19 the duty to notify recipients of a rectification, erasure or restriction, article 20 a right to data portability and article 21 a right to object, including to direct marketing.

Articles 23 and 24 set the restrictions on those rights, including for reasons of justice, and article 25 carries the rights of deceased persons. Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title. Article 129 provides that the law enters into force on the fifteenth day after its legal publication. The Bollettino Ufficiale records its publication on 21 December 2018, so the law entered into force on 5 January 2019.

Article 52, paragraph 1 establishes the Data Protection Authority as an independent public authority responsible for monitoring the application of the law in order to protect the fundamental rights and freedoms of natural persons with regard to personal data processing.

Article 52, paragraph 2 makes the Authority a collegial body of three regular members and two substitute members appointed by the Great and General Council, which designates the President and Vice-President when it appoints the board. Members serve four-year terms, renewable for two further mandates.

Article 53 requires members to meet integrity requirements and to be chosen from experts of proven experience and competence in personal data protection, in particular in legal and information technology disciplines. Article 54 guarantees the Authority full autonomy and independence, provides it with the human, technical and financial resources it needs, and bars its members from seeking or accepting instructions from anyone.

Article 58, paragraph 1 sets the Authority's tasks, which include supervising and ensuring application of the law, promoting data protection culture among controllers and processors, advising the Great and General Council and the State Congress on legislative and administrative measures, examining complaints, and conducting investigations on the application of the law.

Article 59, paragraph 1 gives the Authority investigative powers, including ordering a controller or processor to provide any information it needs, conducting data protection audits, and obtaining access to all personal data and information and to all premises of the controller and processor.

Article 59, paragraph 2 gives it corrective powers, including issuing warnings and reprimands and ordering a controller or processor to meet a data subject's requests and to bring processing into compliance with the law. Articles 60 to 63 let it request information and documents and carry out verifications, including special ones. Article 65 provides that a data subject has administrative protection, through complaints and reports to the Authority, and judicial protection under Article 70.

Article 66 gives a data subject who considers that the processing concerning them violates the law the right to lodge a complaint with the Authority if the alleged violation occurred in San Marino. Article 67 requires the Authority to decide a complaint by a reasoned measure within 90 days of receiving it, extendable by at most two months, and declares a complaint inadmissible if the complainant has brought an action before the judicial authority.

Article 68 lets anyone submit a report to the Authority if they believe the law has been violated. Article 69, which provided for opposition to the Authority's measures, has been repealed. Article 70, paragraph 1 gives the Administrative Judge exclusive jurisdiction over disputes on the application of the law, including those concerning the sanctioning measures the Authority issues.

Article 71 entitles any person who has suffered material or non-material damage from an infringement of the law to compensation from the controller or processor, makes each controller involved liable for the damage caused by infringing processing, and makes a processor liable where it has not complied with obligations directed to processors or has acted outside the controller's lawful instructions, with joint and several liability where more than one is involved.

Article 72, paragraph 1 subjects the controller's and processor's own obligations to administrative fines of up to five million euros or two per cent of total annual turnover of the previous financial year, whichever is higher, and article 72, paragraph 2 sets the higher tier for the basic principles, the data subject's rights and the transfer rules.

Article 73 fixes the procedure for imposing fines, and article 75 bars publishing or disseminating news or images identifying a child involved in legal proceedings. Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title. Article 129 provides that the law enters into force on the fifteenth day after its legal publication. The Bollettino Ufficiale records its publication on 21 December 2018, so the law entered into force on 5 January 2019.

Article 8(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the processing of genetic data, of biometric data, and of data concerning health or a natural person's sex life or sexual orientation.

Article 8(2) lifts that prohibition only in the cases it lists, which mirror the General Data Protection Regulation (GDPR)'s: the data subject's explicit consent to one or more specified purposes; obligations and rights in the field of employment, social security and social protection law; the vital interests of the data subject or another person where the data subject is incapable of consenting; processing in the course of the legitimate activities of a foundation, association or other not-for-profit body with a political, philosophical, religious or trade union aim, confined to its members and not disclosed onward without consent; data manifestly made public by the data subject; legal claims and courts acting judicially; substantial public interest; preventive or occupational medicine and the provision of health or social care by or under the responsibility of a professional bound by secrecy; public health; and archiving in the public interest, scientific or historical research or statistics.

Article 2(1)(p) defines biometric data as personal data obtained from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person that allow or confirm unique identification, such as facial images or fingerprint data. Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title.

Article 129 provides that the law enters into force on the fifteenth day after its legal publication. The Bollettino Ufficiale records its publication on 21 December 2018, so the law entered into force on 5 January 2019.

Law No. 114 of 23 August 2016 introduced criminal-law protection against computer crimes by inserting new articles into the Criminal Code.

Article 182-bis punishes anyone who unlawfully enters a computer or telematics system protected by security measures, or remains there against the express or tacit will of the person entitled to exclude them, with second-degree imprisonment; the punishment rises to third-degree imprisonment for a public official, a private investigator, a system operator, or where violence or destruction of data is involved, and to third or fourth-degree imprisonment where the system is one of public interest.

A separate paragraph punishes, with first-degree imprisonment and a fine of up to 5,500.00 euro, anyone who holds or has access to means suited to enter a protected system in order to obtain an undue profit or cause damage, rising to second-degree imprisonment and a fine from 5,500.00 to 10,500.00 euro where the public-official or system-operator aggravating circumstance applies; a further paragraph punishes, with second-degree imprisonment and a fine of up to 10,500.00 euro, anyone holding or accessing without justified reason equipment or programmes designed to alter a system or its data.

Because the core offence's trigger is defeating a security measure or exceeding an express or tacit exclusion, a plain reading does not reach reading a public, unauthenticated page. The same law separately inserted an interception offence (art. 190-bis), a data and system damage offence (art. 203-bis), and a computer fraud offence (art. 204-ter) into the Criminal Code, not further detailed on this instrument.

Article VII.V.13, paragraph 4 of Regulation no. 2024-03 on crypto-assets requires the information systems of a crypto-asset firm to guarantee high levels of security, with documented safeguards for the physical and logical security of hardware and software, data back-up and disaster recovery, authorised access, and traceability of changes to data.

Article VII.V.13, paragraph 5 requires a specific section of the crypto-asset firm's business continuity plan to cover the information and accounting systems. Article I.I.1 provides that the sanctioning powers of the Central Bank are governed by article 31 of Law no. 96 of 29 June 2005 and that violations of the Regulation are punished under Decree no. 76 of 30 May 2006.

Article VII.I.2 provides that a violation of Part VII of the Regulation, which contains article VII.V.13, is punished by the sanctions decree at its articles 7, 8, 15, 18 and 18-bis. The Regulation defines a crypto-asset firm as a company that provides exclusively asset-referenced crypto-asset issuance services, crypto-asset services, or both, besides any connected and ancillary activities the Regulation permits. The version of the Regulation read for this row is the consolidated text in force from 29 January 2026.

Article VII.VI.13, paragraph 4 of Regulation no. 2024-05 on investment services and activities requires the information systems of an investment firm to guarantee high levels of security, with documented safeguards for the physical and logical security of hardware and software, data back-up and disaster recovery, authorised access, and traceability of changes to data.

Article VII.VI.13, paragraph 5 requires a specific section of the investment firm's business continuity plan to cover the information and accounting systems. Article I.I.1 provides that the sanctioning powers of the Central Bank are governed by article 31 of Law no. 96 of 29 June 2005 and that violations of the Regulation are punished under Decree no. 76 of 30 May 2006.

Article VII.I.2 provides that a violation of Part VII of the Regulation, which contains article VII.VI.13, is punished by the sanctions decree at its articles 7, 8, 15, 18 and 18-bis. The Regulation defines an investment firm by reference to article 1 of the LISF. The version of the Regulation read for this row is the consolidated text in force from 29 January 2026.

Article 98 of Law No. 8 of 25 January 1991 lists 'free uses' of a previously disseminated work, including at (c) analysis and brief quotation of other works, justified by the critical, polemic, pedagogic, scientific or informative character of the work in which they are included.

Article 100 separately permits the reproduction of news and information generally, provided it is in conformity with the codes of conduct for journalists and that the source is quoted, without a stated headline-length or short-extract cap. Article 101 limits both: it prohibits the reproduction or slavish imitation of a work's configuration where this could cause confusion as to the work or its author, separately prohibits reproducing the regular columns of a periodical publication where doing so is so systematic as to identify the periodical's usual and typical content, and bars reproducing the title of a newspaper, magazine or other periodical in another work of the same kind within three years of the title's prior use.

No reported San Marino decision applies articles 98 or 100 to a systematic news aggregator as opposed to an individual quoting or reporting on a published work. The law's own text (Chapter VI, art. 121) states that it enters into force on the fifth day following its legal publication; the law's own printed header states its promulgation date and that it was published on 4 February 1991. No commencement notice stating the resulting day has been located.