Cybersecurity law & regulation in Andorra (2026)
Cybersecurity in Andorra: comprehensive law.
Andorra enacted Law 22/2022 on 9 June 2022, establishing a horizontal cybersecurity framework for networks and information systems aligned with EU NIS Directive 2016/1148. The National Cybersecurity Agency (ANC-AD) acts as the competent authority, overseeing CSIRT-AD for incident response and supervising compliance across critical operators. As a non-EU microstate, Andorra is not directly bound by NIS2 but has voluntarily aligned its 2022 regime with the earlier NIS1 framework.
Legal framework
Law 22/2022 on Measures for the Security of Networks and Information Systems; National Cybersecurity Agency (ANC-AD); CSIRT-AD
Key points: cybersecurity in Andorra
Law 22/2022, NIS-aligned cybersecurity law
Approved by the General Council on 9 June 2022, Law 22/2022 establishes mandatory security obligations for operators of essential services and digital service providers, modelled on EU Directive 2016/1148 (NIS1). It requires critical operators to implement risk-based security plans and report significant incidents.
National Cybersecurity Agency (ANC-AD)
ANC-AD is the designated national competent authority under Law 22/2022. It ensures regulatory compliance, provides risk-assessment methodologies and tools to critical operators, and advises public and private entities on security planning.
CSIRT-AD, national incident response
The Computer Security Incident Response Team (CSIRT-AD), overseen by ANC-AD, serves as the national point of contact for cyber incident reporting and response. It coordinates with authorities, operators, and international partners. In 2025, ANC-AD managed 1,624 reported incidents, up 5.6% from 2024.
Data-breach notification under LQPD
Law 29/2021 (Qualified Personal Data Protection Law, LQPD), in force since 17 May 2022, requires data controllers to notify the Andorran Data Protection Agency (APDA) of personal data breaches within 72 hours. Where there is high risk to data subjects, direct notification to affected individuals is also mandatory.
Banking-sector cybersecurity obligations (AFA)
The Andorran Financial Authority (AFA) supervises banks' compliance with Law 22/2022 cybersecurity requirements. Banks must self-identify as critical or essential institutions and implement measures to manage digital risks associated with critical infrastructure, consistent with AFA's broader supervisory mandate.
NIS2 not applicable; no current upgrade proposal
Andorra is not an EU Member State and is therefore not legally bound by NIS2 (Directive 2022/2555). No publicly announced legislative initiative to align with NIS2 has been identified as of May 2026; the Law 22/2022 / NIS1-aligned framework remains in force.
Timeline of decisions
- Decision · officialANC-AD Signs Four-Year Cybersecurity Cooperation Agreement with Spain's INCIBE
Andorra's National Cybersecurity Agency (ANC-AD) and Spain's National Cybersecurity Institute (INCIBE) signed a four-year renewable agreement covering incident-prevention, information sharing, best-practice exchange, and joint support for critical infrastructure. The pact fulfils a key deliverable of Andorra's national Digital Transformation Strategy and extends its bilateral cybersecurity partnerships beyond CSIRT-level cooperation.
Andorra Digital (Government of Andorra)
- Guidance · officialANC-AD Publishes National Cybersecurity Strategy 2024-2027
The National Cybersecurity Agency released Andorra's first multi-year national cybersecurity strategy, setting objectives across prevention, detection, response, and recovery while addressing AI, cloud, and blockchain resilience. The strategy formally designates ANC-AD as the competent national authority and CSIRT-AD as the point of coordination for all cyber incidents.
ANC-AD
- Law · officialGeneral Council Enacts Law 22/2022 on Network and Information System Security (NIS)
Andorra's parliament passed its first standalone cybersecurity law, transposing EU NIS Directive 2016/1148 and creating the National Cybersecurity Agency (ANC-AD) and the national CSIRT-AD. The law imposes mandatory security obligations and incident-notification requirements on operators of essential services and digital service providers.
Andorra Digital (Government of Andorra)
- Decision · officialAndorra Signs Second Additional Protocol to Budapest Convention (e-Evidence)
At the Council of Europe Ministerial Meeting in Turin, Andorra became the 23rd state to sign the Second Additional Protocol to the Budapest Convention, which establishes enhanced cross-border mechanisms for disclosure of electronic evidence in criminal investigations. Ratification would bind operators to disclose subscriber and traffic data to foreign authorities under mutual legal assistance frameworks.
Council of Europe
- IncidentDDoS Attacks on Andorra Telecom Knock Out National Internet (SquidCraft Games Incident)
Sustained DDoS attacks peaking at 100 Gbps targeted Andorra Telecom, the country's sole ISP, reducing national connectivity to approximately 37.5% for over 30 minutes, with attacks continuing daily for several days thereafter. Linked to a DDoS-for-hire service targeting players in the SquidCraft Minecraft tournament, the incident exposed the systemic risk of a single-ISP national infrastructure and accelerated work on Law 22/2022.
The Record (Recorded Future News)
- Law · officialAndorra Ratifies the Budapest Convention on Cybercrime
Three years after signing, Andorra formally ratified the Council of Europe Budapest Convention on Cybercrime, binding itself to criminalise illegal access, data interference, computer fraud, and online child sexual abuse material, and to provide mutual legal assistance to other parties in cybercrime investigations.
Council of Europe – Treaty Office
Sources
- andorra-digital.com/en/national-cybersecurity-agency
- andorra-digital.com/en/lines/cybersecurity
- cyberpolicyportal.org/states/andorra
- andorranbanking.ad/en/aba_topics/cybersecurity-and-personal-data-protection/
- dataguidance.com/jurisdiction/andorra
- dataguidance.com/news/andorra-data-protection-law-enters-force
- cookieyes.com/blog/andorra-personal-data-protection-law/
- practiceguides.chambers.com/practice-guides/banking-regulation-2025/andorra
- digital-strategy.ec.europa.eu/en/policies/nis2-directive
Next for Andorra: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026