Data protection & privacy law in Andorra (2026)
Data protection in Andorra: comprehensive law.
Andorra enacted a comprehensive, GDPR-aligned personal data protection law (Law 29/2021, LQPD) in October 2021, which entered into force on 17 May 2022 and replaced the 2003 predecessor law. The law is enforced by the independent APDA (established 2005) and is underpinned by an EU adequacy decision dating from 2010, reconfirmed in a January 2024 European Commission review. Andorra has also ratified the modernised Council of Europe Convention 108+.
Legal framework
Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals (LQPD), in force since 17 May 2022; supervised by the Agència Andorrana de Protecció de Dades (APDA)
Key points: data & privacy in Andorra
Primary legislation
Law 29/2021 (LQPD), adopted 28 October 2021 and in force from 17 May 2022, mirrors GDPR principles including lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality. It was subsequently amended by Law 12/2024 of 15 July 2024.
Implementing regulation
Supervisory authority
The Agència Andorrana de Protecció de Dades (APDA), established since 2005 and reconstituted under Decree 368/2022, is the independent supervisory authority. It registers Data Protection Officers (DPOs), handles complaints, conducts inspections, and issues sanctions. Its jurisdiction extends to controllers not domiciled in Andorra that use processing means located in the Principality.
EU adequacy decision
The European Commission granted Andorra an adequacy decision in October 2010 (Decision 2010/625/EU), permitting free personal data flows from the EU/EEA to Andorra without supplementary safeguards. A January 2024 Commission staff working document reconfirmed that adequacy remains warranted.
Council of Europe Convention 108+
Andorra is a party to the Council of Europe's modernised Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108+), which forms an additional international foundation for its data protection framework.
Sanctions and enforcement
Timeline of decisions
- Guidance · officialAPDA Cookie Guidelines Enter Into Force
New cookie guidelines issued by the Andorran Data Protection Agency took effect, requiring freely given, specific, and unambiguous consent before activating non-essential cookies across websites, mobile applications, IoT devices, smart TVs, and connected vehicles. The rules operationalise the LQPD's consent requirements for the full ecosystem of online tracking.
APDA – Andorran Data Protection Agency
- Guidance · officialAPDA Cookie Guidelines Enter into Force
The Andorran Data Protection Agency (APDA) issued updated guidelines on the use of cookies, requiring freely given, specific, informed and unambiguous prior consent for non-essential cookies and mandating easy withdrawal mechanisms. This brought Andorra's cookie-consent standards into close alignment with EU practice.
APDA – Agència Andorrana de Protecció de Dades
- EnforcementAPDA Issues First Enforcement Resolution Against the Andorra Government
The APDA reprimanded the Government of Andorra for failing to respect the transparency principle in an administrative action, the first time the supervisory authority issued a formal enforcement resolution against a public-sector body, signalling an active new phase of oversight.
DataGuidance (citing APDA resolution)
- Decision · officialAndorra Ratifies Modernised Convention 108+, Becomes 20th State Party
Andorra deposited instruments of ratification of the amending Protocol to Convention 108 (Convention 108+), updating its commitment to the Council of Europe's data-protection treaty with GDPR-era requirements on risk-based security, data minimisation, and cross-border transfer safeguards. Andorra was the 20th state to ratify the modernised treaty.
Council of Europe
- Law · officialImplementing Regulation (Decree 391/2022) Published and Enters into Force
The Government of Andorra approved Decree 391/2022 on 28 September 2022, publishing it in the Official Bulletin (BOPA) on 5 October 2022; it entered into force the following day. The regulation specifies concrete procedures for data controllers, consent records, breach notifications, and the APDA's internal governance.
APDA / BOPA – Butlletí Oficial del Principat d'Andorra
- Law · officialQualified Personal Data Protection Law (LQPD, Law 29/2021) Enters into Force
Andorra's GDPR-aligned data protection law came into full force, granting individuals the right not to be subject to solely automated individual decisions with legal effects, requiring Data Protection Impact Assessments, mandating 72-hour breach notification, and imposing fines up to €100,000. The Andorran Data Protection Agency (APDA) became the competent authority for AI systems that process personal data.
Andorran Data Protection Agency (APDA)
- Law · officialQualified Law 29/2021 (LQPD) Enters into Force
Law 29/2021, enacted on 28 October 2021 and published in the BOPA on 17 November 2021, took effect six months later, replacing the 2003 law and establishing a GDPR-aligned regime with mandatory data protection officers, data breach notification, privacy-by-design requirements, and a maximum fine of €100,000.
Portal Jurídic d'Andorra (official legal gazette)
- Law · officialLQPD (Law 29/2021) Enters into Force, GDPR-Equivalent Privacy and Security Framework
Andorra's Qualified Personal Data Protection Law, enacted 28 October 2021 and published in BOPA no. 119 on 17 November 2021, became fully effective. It replaced the 2003 act, aligned national rules with GDPR, and imposed binding technical and organisational security obligations, DPO appointments, and breach notifications to the APDA on all public and private processors.
APDA
- LawLaw 29/2021 (LQPD), Qualified Personal Data Protection Law Adopted
The General Council enacted the Qualified Personal Data Protection Law, a comprehensive overhaul aligning Andorra with EU GDPR principles and Directive 2016/680 for law enforcement data. The law granted data subjects rights of access, rectification, erasure, portability, and objection to automated decision-making, and repositioned the APDA as a fully independent supervisory authority.
Cuatrecasas (citing official text)
- Law · officialConsell General Enacts Qualified Law 29/2021 on Personal Data Protection (LQPD)
Andorra's parliament enacted the Llei qualificada de protecció de dades personals (LQPD), a comprehensive overhaul aligning domestic law with EU GDPR principles, including new rights for data subjects (access, rectification, erasure, portability), and formally establishing the APDA as a fully independent supervisory authority.
Consell General – Principat d'Andorra (Parliament)
- Law · officialGeneral Council Enacts Law 29/2021, Qualified Personal Data Protection Law (LQPD)
Andorra enacted a comprehensive privacy law closely modelled on the EU GDPR, requiring risk-based security measures, data-protection impact assessments, and mandatory breach notification to the APDA. The law replaced the 2003 act and became the primary instrument governing cybersecurity obligations for personal data held by private and public entities.
Council of Europe
- Guidance · officialArticle 29 Working Party Issues Favourable Opinion 7/2009 on Andorra
The EU's Article 29 Working Party (WP166) concluded that Andorra's data protection regime, anchored in Qualified Law 15/2003, ensures an adequate level of protection within the meaning of Article 25(6) of Directive 95/46/EC, paving the way for the 2010 Commission adequacy decision.
Article 29 Data Protection Working Party / European Commission
- Law · officialLaw 15/2003, Andorra's First Personal Data Protection Law
Andorra enacted its foundational personal data protection statute, Law 15/2003, creating basic rules for data processing and establishing initial supervisory oversight. Though eventually superseded by the 2021 LQPD, it provided the country's first legal basis for online privacy rights and laid the institutional groundwork for what would become the APDA.
Council of Europe – Data Protection
- Law · officialAndorra Enacts Qualified Law 15/2003, Its First Comprehensive Data Protection Law
The Consell General passed Andorra's founding data protection statute, establishing individual rights over personal data, requiring lawful bases for processing, and creating the Andorran Data Protection Agency (APDA) as the independent supervisory authority. This law formed the basis for Andorra's subsequent EU adequacy recognition.
APDA – official English text of Qualified Act 15/2003
Sources
- portaljuridicandorra.ad/L2021029
- apda.ad/
- apda.ad/ca/normativa-andorrana
- apda.ad/assets/pdf/decret_reglament_agencia_andorrana_proteccio_dades_-_ca.pd
- ccis.ad/wp-content/uploads/2023/02/Reglament-proteccio-de-dades-personals.pdf
- eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32010D0625
- eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52024SC0003
- edps.europa.eu/data-protection/our-work/publications/legislation/council-europe-conv
- apda.ad/noticia/l-apda-verifica-el-compliment-de-la-normativa-andorrana-de-pr
Next for Andorra: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026