Requirements to comply with the LQPD in Andorra: data protection guide
Updated in June 2026
Data protection in Andorra has its own legal framework that every company or professional operating in the Principality must know and comply with. Law 29/2021, of October 28, on the protection of personal data, known as the LQPD , is the regulation governing the processing of personal data since its entry into force in May 2022. Being a small company or having its headquarters outside Andorra is no excuse if data is processed here. Understanding the specific requirements is the first step to avoid penalties and operate with legal certainty.
What is the LQPD and who is subject to data protection in Andorra?
Law 29/2021 replaced the previous legislation of 2003 and brought the Principality into compliance with the standards of the Council of Europe's Convention 108+ and, to a large extent, with the European GDPR. The practical result is that Andorra is recognized by the European Commission as a country with an adequate level of protection, which greatly facilitates data flows with companies in the European Union.
The law applies to any entity, public or private, that processes personal data within Andorran territory. This includes companies with their registered office in Andorra, companies incorporated under Andorran law, and also foreign organizations that process data within the Principality. A law firm in Andorra la Vella, a clinic in Escaldes, or an e-commerce business with servers or staff in the country all fall under its scope.
Size doesn't matter either. Article 3 of the Data Protection Act (LQPD) doesn't establish exceptions based on turnover or number of employees. What the law does allow is the application of the principle of proportionality: the measures must be appropriate to the level of risk involved in the processing. A self-employed individual managing a client list doesn't have the same obligations as an insurance company handling medical records.
LQPD and GDPR: practical similarities and differences
The Andorran Data Protection Act (LQPD) closely follows the structure of the European GDPR. It shares the same principles of Article 5, recognizes identical rights for data subjects, and requires proactive accountability. The most relevant difference in practice is the supervisory authority: in Andorra, it is the Andorran Data Protection Agency (APDA), not the Spanish Data Protection Agency (AEPD) or any European agency.
A digital company established in Andorra that offers services to citizens of the European Union may be subject to both the LQPD and the GDPR. In that case, it must comply with both regulations. This is an increasingly common situation among tech startups that choose Andorra for its tax advantages and then discover that data protection has its own local complexities.
Principles of data processing according to the LQPD
Article 5 of the LQPD establishes the principles governing any processing operation. Compliance is mandatory, and violations may result in disciplinary proceedings before the APDA. The main principles are:
- Legality, loyalty and transparency: Data can only be processed if there is a valid legal basis and the data subject is aware of the terms of the processing.
- Limitation of purpose: Data collected for a specific purpose cannot be reused for another incompatible purpose.
- Minimization: Only the data strictly necessary for the stated purpose should be collected.
- Accuracy: The data must be kept up to date and corrected when inaccurate.
- Conservation period limitation: They cannot be stored indefinitely; justified time limits must be set.
- Integrity and confidentiality: Technical and organizational measures must be implemented to protect data against unauthorized access, loss, or destruction.
The legal basis for processing is another requirement that the GDPR mandates be justified in writing for each purpose. Consent is the most well-known, but it has a significant limitation: it can be withdrawn at any time. Therefore, many organizations prefer to rely on other bases, such as the performance of a contract or legitimate interest, when the processing allows it.
The minimum age for a minor to give valid consent in Andorra is 16 years. Below that age, authorization from parents or legal guardians is required.
Rights of interested parties: deadlines and response obligations
The LQPD grants citizens the same rights as the European GDPR: access, rectification, erasure, objection, restriction of processing, and data portability. These rights are regulated in Articles 15 to 22 of the law and are directly enforceable.
The maximum time allowed to respond to a request to exercise rights is one month from receipt. If the request is complex or the volume of requests is high, this period may be extended by two more months, but the interested party must be notified within the first month. Failure to respond in a timely manner constitutes an administrative offense.
In practice, many of the clients we serve at Andorra Services discover that their web contact forms or employee contracts do not include the required information about these rights. Updating these documents is one of the first actions we recommend in any compliance review.
Comparative table: Andorran LQPD vs European GDPR
| Appearance | LQPD Andorra (Law 29/2021) | GDPR Europe (EU 2016/679) |
|---|---|---|
| Control authority | APDA (Andorran Dades Protection Agency) | National authorities of each Member State (AEPD in Spain) |
| Maximum penalty | 100.000 Euros | 20.000.000 euros or 4% of the global volume |
| Gap Notification | 72 hours to the APDA | 72 hours to the competent authority |
| Activity Log (RAT) | Mandatory for entities with more than 50 employees and public bodies | Mandatory for most managers and those in charge |
| Mandatory DPD | Public entities, large-scale processing, or special data | Public entities, large-scale processing, or special data |
| Age of consent of minors | 16 years old (with parental authorization for younger children) | 16 years (States may reduce it to 13) |
| Mutual recognition with the EU | Yes, Andorra has a level of adequacy recognized by the European Commission | Free transfers between Member States |
| Normative basis | Law 29/2021, of October 28; Decree 391/2022 | Regulation UE 2016/679 |
Record of Processing Activities (RPA): who should have it
The Record of Processing Activities, known as the RPA, is the internal document that describes all the processing operations carried out by an organization. It includes the purposes, categories of data, recipients, retention periods, and security measures applied.
The obligation to maintain an up-to-date RAT (Regulations for the Protection of Personal Data) applies to entities with more than 50 employees and to all public entities. Smaller organizations must also prepare one if they carry out processing that could pose a high risk to individuals' rights. In any case, the APDA (Spanish Data Protection Agency) recommends having one, even though it is not strictly mandatory: it is the first document they request during an inspection.
The RAT is not registered in any public registry. The LQPD eliminated this requirement that existed under the previous law. It is maintained internally and must be available if requested by the APDA. The agency publishes an official template in editable format that can be used as a starting point, although it should be adapted to the specific circumstances of each organization before any audit.
The data protection officer in Andorra: when is it mandatory
The Data Protection Officer (DPO) is the figure introduced by the GDPR as a key component of the compliance system. Their role is to advise the data controller, monitor the application of the regulation, and act as an intermediary between the organization and the Data Protection Authority.
Not all companies are required to appoint a Data Protection Officer (DPO). Article 37 of the Data Protection Act (LQPD) establishes three scenarios in which appointment is mandatory:
- Authorities and public bodies, regardless of the type of data they process.
- Controllers or processors whose main processing involves regular and systematic observation of people on a large scale.
- Controllers or processors who process special categories of data on a large scale, such as health data, biometric data or data on criminal convictions.
The LQPD does not mathematically define what constitutes a large scale . It is analyzed on a case-by-case basis, taking into account the number of data subjects affected, the volume of data, the duration of the processing, and its geographical scope. Furthermore, in April 2023, the APDA issued a binding instruction requiring healthcare professionals and lawyers to appoint a Data Protection Officer (DPO) regardless of the size of their practice.
Once appointed, the Data Protection Officer (DPO) must register with the Andorran Data Protection Authority (APDA) using the form available on its website. Their contact information must be made public. The appointment can be made to an employee of the organization itself or to an external service provider. The Andorran Data Protection Act (LQPD) does not expressly prohibit the DPO from residing outside Andorra, but in practice, it is difficult to properly fulfill coordination functions with the APDA without a physical presence in the Principality.
Functions of the data protection officer
The Data Protection Officer (DPO) advises the data controller and processor on their legal obligations. They ensure that internal privacy policies are effectively implemented. They also act as the point of contact with the Data Protection Authority (DPA) for inspections, complaints, or any requests for information.
When a security breach occurs, the Data Protection Officer (DPO) coordinates the internal response with the IT security officer and management. The DPO is responsible for ensuring that the Data Protection Authority (DPA) is notified within the legal timeframe and with the required documentation.
Another practical function that many underestimate is staff training. The DPO must ensure that employees and collaborators are aware of their data protection obligations, especially in sectors such as hospitality, healthcare, or financial services, where the processing of customer data is intensive and routine.
Security breaches and data protection impact assessments
When a security breach occurs that affects personal data, the data controller has a maximum of 72 hours to notify the Spanish Data Protection Agency (APDA) from the time they become aware of the incident. If this deadline is exceeded, the notification must be accompanied by a justification for the delay. Without such justification, the APDA may open disciplinary proceedings.
Notification is made electronically through the channel provided by the APDA. It is advisable to always keep a receipt as proof of compliance with the deadline. If the breach poses a high risk to the rights and freedoms of the affected individuals, it is also necessary to notify them without delay, as established in Article 37 of the Data Protection Act.
The data protection impact assessment (DPIA) is another instrument required by the LQPD when processing may generate a high risk. It applies, among other cases, to large-scale video surveillance, the processing of health data, profiling, and the systematic monitoring of employees. The DPIA must be carried out before processing begins, not afterward.
Sanctions for non-compliance with the LQPD and the role of the APDA
The Andorran Data Protection Agency (APDA) is the independent authority responsible for monitoring compliance with the LQPD. It can initiate inspections on its own initiative, resolve citizens' complaints, issue guidelines, and, when it detects non-compliance, impose administrative sanctions.
The sanctions regime of the LQPD classifies infringements into three levels according to their severity:
- Minor infractions: penalty of between 500 and 15.000 euros.
- Serious Offenses: penalty of between 15.001 and 30.000 euros.
- Very serious violations: penalty of between 30.001 and 100.000 euros.
These figures are far lower than those under the European GDPR, where fines can reach €20 million or 4% of global turnover. But in the context of the Principality, they are significant. The Andorran Data Protection Authority (APDA) has already demonstrated its effectiveness: in 2025, it sanctioned Andorra Telecom and an Andorran digital media outlet for lacking a privacy policy. The Catalan Government was reprimanded in 2023.
The proactive responsibility required by the GDPR implies not only complying with the regulations, but also being able to demonstrate that compliance at any time. A company that cannot prove it has an up-to-date Data Protection Regulation (DPR), privacy clauses in its web forms, or data processing agreements with its suppliers is at risk, even if it has not actually committed any data breaches.
FAQ
Does the LQPD apply to my company if I have headquarters in Spain but clients in Andorra?
It depends on where the data processing takes place. If your company processes personal data in Andorra, for example through a data processor established there, the LQPD (Andorran Data Protection Act) applies. Organizations not based in Andorra that process data there must also have a representative established in Andorra.
Am I required to have a data protection officer in Andorra?
Not all companies need it. The obligation arises if you are a public authority, if your main activity involves systematic monitoring of individuals on a large scale, or if you process special categories of data in large volumes. In 2023, the Data Protection Authority (APDA) extended the obligation to healthcare professionals and lawyers through a binding instruction. If you have any doubts, the safest course of action is to analyze the specific type of data processing you carry out.
What happens if I suffer a data breach at my Andorran company?
You must notify the APDA within 72 hours of becoming aware of the incident. If this deadline is exceeded without justification, the agency may initiate disciplinary proceedings. When the breach poses a high risk to those affected, they must also be notified directly and without delay.
Do I need a privacy policy on my Andorran website?
If your website collects personal data, whether through a contact form, analytics cookies, or a subscription system, you must have a legal notice, privacy policy, and cookie policy that comply with the Spanish Data Protection Act (LQPD). The Andalusian Data Protection Authority (APDA) already sanctioned an Andorran digital media outlet in 2025 precisely for not having a privacy policy.
How much can the APDA fine for breaching data protection?
The LQPD's sanctions regime establishes three levels: minor infringements (up to €15.000), serious infringements (up to €30.000), and very serious infringements (up to €100.000). In addition to fines, the APDA can issue warnings or, in serious cases, prohibitions on continuing the processing of personal data.
Complying with data protection in Andorra is not a one-off procedure. It is an ongoing process that involves reviewing documentation, keeping the RAT (Registry of Data Protection Officers) up to date, training staff, and acting swiftly when an incident occurs. The APDA (Andorran Data Protection Authority) has already demonstrated its ability to inspect and penalize, and the trend is for it to do so with increasing frequency as public awareness grows in the Principality.
If you have a business in Andorra, are considering setting up shop here, or simply need to check if your current situation complies with Law 29/2021, Andorra Services can guide you through the entire process. Contact our team and we'll evaluate your case free of charge.
