Act 2021
Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals (Qualified Law 29/2021 on personal data protection)
Issued by Agència Andorrana de Protecció de Dades
Plain-English summary
Sets lawful bases, data subject rights, controller duties and breach notification, and the sanction regime enforced by the APDA. It was approved on 28 October 2021 and published in BOPA no. 119 on 17 November 2021.
Who it applies to
All industries
Topics
Data Protection & Privacy
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Lawful basis, privacy notice and data subject rights | Ongoing | APDA | official | |
Art. 6(1) lists the lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests). Data subject rights include access (Art. 18), rectification (19), erasure (20), restriction (22), portability (23), objection (24) and protection against automated decisions (25). |
||||
| Personal data breach notification to the APDA | Deadline Within a maximum of 72 hours of becoming aware (Art. 36) | APDA | official | |
Art. 36(1) requires the controller to notify the Agency of a personal data breach within a maximum of 72 hours after becoming aware of it. The APDA relied on Arts. 36 and 72.2.e in its 2025 Andorra Telecom reprimand. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.