Data protection & privacy law in Liechtenstein (2026)
Data protection in Liechtenstein: comprehensive law.
Liechtenstein has a comprehensive GDPR-equivalent data-protection regime. The EU GDPR was incorporated into the EEA Agreement by Joint Committee Decision No 154/2018 and became directly applicable in Liechtenstein on 20 July 2018, while the national Data Protection Act (DSG) and Ordinance (DSV) — both in force since 1 January 2019 — exercise GDPR's opening clauses for areas such as employment, public-sector processing, video surveillance, journalism and criminal data. The Datenschutzstelle (DSS), based in Vaduz, is the independent supervisory authority and a full (non-voting) EDPB member.
Legal framework
GDPR (Regulation (EU) 2016/679) directly applicable via EEA Joint Committee Decision No 154/2018, complemented nationally by the Data Protection Act (Datenschutzgesetz – DSG) of 4 October 2018 and the Data Protection Ordinance (Datenschutzverordnung – DSV) of 11 December 2018; supervised by the Datenschutzstelle (DSS).
GDPR & data protection in Liechtenstein
In Liechtenstein, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Data Protection Authority (Datenschutzstelle).
- Framework
- the GDPR (Regulation (EU) 2016/679) plus the national data-protection act
- Supervisory authority
- the Data Protection Authority (Datenschutzstelle)
- Applies to
- any organisation processing the personal data of people in Liechtenstein, wherever the organisation is based
- Maximum fine
- €20 million or 4% of global annual turnover, whichever is higher
- Breach notification
- within 72 hours of becoming aware, to the supervisory authority
- DPO
- required for large-scale monitoring or large-scale special-category processing
The GDPR is bloc-wide; Liechtenstein supplements it with a national data-protection act and its own supervisory authority.
Key points: data & privacy in Liechtenstein
GDPR applies via EEA
Regulation (EU) 2016/679 was incorporated into the EEA Agreement by EEA Joint Committee Decision No 154/2018 of 6 July 2018 and has been directly applicable in Liechtenstein since 20 July 2018, giving the country a Union-law-equivalent regime.
National DSG and DSV
The Datenschutzgesetz (DSG) of 4 October 2018 and the Datenschutzverordnung (DSV) of 11 December 2018, both in force since 1 January 2019, implement GDPR opening clauses on employment data, public-sector processing, journalistic/artistic expression, video surveillance and processing in the criminal-justice area.
Supervisory authority: Datenschutzstelle (DSS)
The Datenschutzstelle (Kirchstrasse 8, FL-9490 Vaduz) is the independent national supervisory authority established under GDPR Art. 51 as transposed via the EEA, headed by a Data Protection Commissioner appointed by the Landtag for a renewable five-year term, and is a full (non-voting) member of the European Data Protection Board.
Data-subject rights and obligations
Controllers must observe GDPR obligations in full: lawful basis, transparency, DPIAs for high-risk processing, records of processing, 72-hour breach notification to the DSS, DPO appointment where required, and respect for data-subject rights (access, rectification, erasure, portability, restriction, objection).
Enforcement powers and fines
The DSS may conduct audits, issue binding orders and impose GDPR two-tier administrative fines (up to EUR 10 million or 2% of global annual turnover for lesser violations; up to EUR 20 million or 4% for serious violations). Public enforcement has been modest — the main reported fine remains a EUR 4,100 penalty from 2020 — and the 2024 activity report shows no new fines but increased focus on AI, CCTV and employment data.
International transfers
As an EEA state, Liechtenstein treats transfers within the EU/EEA as domestic. Transfers to third countries rely on GDPR Chapter V mechanisms — adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules or Art. 49 derogations — enforced and supervised by the DSS in line with EDPB guidance.
GDPR in Liechtenstein: FAQ
Does the GDPR apply in Liechtenstein?
Yes. As an EU/EEA member, Liechtenstein applies the GDPR (Regulation (EU) 2016/679) directly, enforced by the Data Protection Authority (Datenschutzstelle).
Who enforces data protection law in Liechtenstein?
The Data Protection Authority (Datenschutzstelle).
What are the GDPR fines in Liechtenstein?
Up to €20 million or 4% of global annual turnover, whichever is higher.
Do you need a Data Protection Officer in Liechtenstein?
A DPO is required where you carry out large-scale monitoring or process special-category data at scale.
How quickly must a data breach be reported in Liechtenstein?
Personal-data breaches must be notified to the supervisory authority within 72 hours of becoming aware.
Timeline of decisions
- Guidance · officialData Protection Authority publishes 2024 activity report
The Datenschutzstelle issued its Tätigkeitsbericht 2024, documenting growing caseloads, data-breach notifications and the authority's supervisory and advisory work. It is the most recent official snapshot of how GDPR is being enforced and applied in Liechtenstein.
Datenschutzstelle Liechtenstein
- Guidance · officialAuthority warns on Meta AI training, sets 26 May objection deadline
The Datenschutzstelle alerted residents that Meta would use public Facebook/Instagram data to train its generative-AI models and explained how to object before 26 May 2025. It marked the regulator's first prominent public stance on AI training and personal data.
Datenschutzstelle Liechtenstein
- Guidance · officialData Protection Authority publishes 2023 activity report
The Datenschutzstelle released its Tätigkeitsbericht 2023, reporting on complaints handled, breach notifications and consultations. The report reflects the authority's pattern of resolving most cases informally rather than through fines.
Datenschutzstelle Liechtenstein
- Law · officialRevised Data Protection Act (DSG) Enters into Force, Aligned with GDPR
The totally revised Datenschutzgesetz, modelled on Germany's BDSG, brought Liechtenstein's data-protection regime into full conformity with the EEA-incorporated GDPR; enforcement authority was transferred from the regional court to the Data Protection Authority (Datenschutzstelle Liechtenstein), which gained new investigative and sanctioning powers.
Datenschutzstelle Liechtenstein
- Law · officialNew Data Protection Act and Ordinance enter into force
Liechtenstein's totally revised Datenschutzgesetz (DSG) and Datenschutzverordnung (DSV) took effect, supplementing the directly applicable GDPR with national rules and confirming the Datenschutzstelle as supervisory authority. This is the backbone of the framework in force today.
Datenschutzstelle Liechtenstein
- Law · officialData Protection Act (DSG) enters into force
Liechtenstein's Datenschutzgesetz of 4 October 2018 and its ordinance took effect, implementing the GDPR into national law and confirming the Datenschutzstelle as supervisory authority responsible for data-security obligations.
Lilex – Liechtenstein Law Database
- Law · officialNew Liechtenstein Data Protection Act (DSG) enters into force
The revised Datenschutzgesetz (enacted 4 Oct 2018) and Data Protection Ordinance took effect, implementing GDPR enabling clauses nationally and providing the legal basis the Datenschutzstelle now uses to oversee AI/data processing.
Liechtenstein law portal (gesetze.li)
- Law · officialData Protection Ordinance (DSV) adopted
The government issued the Datenschutzverordnung implementing detailed procedural and substantive rules under the new DSG. It operationalised the GDPR's opening clauses in domestic law.
Datenschutzstelle Liechtenstein
- Law · officialGDPR Incorporated into EEA Agreement, Directly Applicable in Liechtenstein
EEA Joint Committee Decision No. 154/2018 incorporated the General Data Protection Regulation (EU 2016/679) into the EEA Agreement, making the GDPR directly applicable in Liechtenstein and triggering an urgent total revision of the national Data Protection Act to close the resulting regulatory gap.
EFTA EEA-Lex
- Law · officialGDPR becomes directly applicable in Liechtenstein
Following EEA incorporation, the GDPR entered into force for the EEA-EFTA states Liechtenstein, Iceland and Norway and became directly applicable. This extended EU-level data-protection standards and the one-stop-shop system to Liechtenstein.
EUR-Lex (EEA Joint Committee)
- Law · officialGDPR becomes applicable in Liechtenstein via the EEA
Following EEA Joint Committee Decision No. 154/2018, the EU General Data Protection Regulation entered into force for Liechtenstein, Iceland and Norway, establishing binding personal-data security and breach-notification duties.
Datenschutzstelle Liechtenstein
- Law · officialGDPR becomes applicable in Liechtenstein via the EEA Agreement
Following incorporation into the EEA Agreement, the GDPR became directly applicable in Liechtenstein, establishing the data-protection regime that currently governs most AI systems processing personal data in the country.
EFTA
- Decision · officialEEA Joint Committee Decision No 154/2018 incorporates GDPR
The EEA Joint Committee adopted Decision No 154/2018, amending Annex XI of the EEA Agreement to incorporate Regulation (EU) 2016/679 (GDPR). This is the legal act that brought the GDPR into the EEA legal order binding Liechtenstein.
EFTA
- Law · officialFirst comprehensive Data Protection Act enacted
Liechtenstein adopted its first modern Datenschutzgesetz, transposing EU Directive 95/46/EC into national law via the EEA Agreement and establishing a dedicated data-protection authority. It set the template later replaced by the GDPR-era 2018 law.
WIPO Lex
Sources
- datenschutzstelle.li/
- datenschutzstelle.li/application/files/4515/8641/2923/DSG_English_final.pdf
- linklaters.com/en/insights/data-protected/data-protected---liechtenstein
- whitecase.com/insight-our-thinking/gdpr-guide-national-implementation-liechtenstein
- free.dataguidance.com/laws/liechtenstein-national-data-protection-law/
- vlolawfirm.com/legal-updates/liechtenstein-2026-q1-data-protection
Next for Liechtenstein: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 18 Oct 2026. Methodology & how to cite · State of Technology Regulation 2026