What Is Qualified Law 29/2021 on Personal Data Protection?
The operative framework is Qualified Law 29/2021 on Personal Data Protection, effective 17 May 2022. It repealed Law 15/2003 and the former public register of data files. The current consolidated-status record identifies Text refós 2, effective 5 December 2024, incorporating Law 12/2024 and Law 16/2024 amendments. No additional 2025-2026 amendment was located. The LQPD is expressly structured around GDPR concepts. Its implementing regulation is Decree 391/2022, showing a 2023 amendment. The European Commission’s official 2024 review concluded that Andorra continues to provide an adequate level of protection; that adequacy decision concerns EU-to-Andorra transfers and does not mean that GDPR universally governs domestic Andorran processing. The APDA provides the complaint, investigative, corrective, and sanctioning framework. Controllers generally have one month to respond to rights requests, extendable by up to two additional months. No fixed deadline for filing an APDA complaint or numeric statutory deadline for the APDA’s merits decision was located.
At a glance
- Full name
- Qualified Law 29/2021 on Personal Data Protection
- Short code
- LQPD
- Jurisdiction
- Andorra
- Enacted
- 2021
- Last major update
- Text refós 2, effective 5 December 2024, incorporates Law 12/2024 and Law 16/2024 amendments; no additional 2025-2026 amendment was located
- Regulator
- Agència Andorrana de Protecció de Dades (APDA)
- Private right of action
- Yes
- Statutory citation
- Qualified Law 29/2021 on Personal Data Protection (LQPD)
Scope, who LQPD covers
Protected data
Data subject rights
Right to information and transparency about purposes, legal basis, retention, recipients, transfer safeguards, automated-decision logic, and the source of indirectly collected data
Right of access, confirmation of processing, copies, and related processing information
Right to rectification and completion of inaccurate or incomplete data
Right to deletion or erasure, including search-engine dereferencing and reasonable downstream notification where data was publicized
Right to restriction of processing
Right to portability for qualifying automated processing based on consent or contract
Right to object based on a particular situation, to direct marketing, and to related profiling
Right to withdraw consent at any time
Right to compensation, judicial remedies, and complaint to APDA
Notable features
Andorra’s law is closely aligned with GDPR concepts, including deletion, portability, objection, automated-decision safeguards, and an APDA complaint route. The EU recognizes Andorra as providing an adequate level of protection for EU-to-Andorra transfers. Public-record rights are not uniform: Law 16/2025 excludes opposition, deletion, and portability for specified parish-census data.
Enforcement & penalties
Regulator: Agència Andorrana de Protecció de Dades (APDA)
Penalties: Under LQPD Article 73, light infringements carry €500-€15,000, serious infringements €15,001-€30,000, and very serious infringements €30,001-€100,000. APDA may also issue warnings, reprimands, rights-compliance orders, rectification, deletion or restriction orders, processing restrictions or prohibitions, transfer suspensions, and other corrective measures. The implementing regulation permits economic sanctions to increase up to 2% of a company’s global annual turnover where two or more very serious LQPD infringements are involved.
Private right of action: The LQPD provides compensation and judicial remedies for unlawful processing. A person may complain to APDA under Article 61 and challenge rejection or negative administrative silence under the Administrative Code. A one-year period for a damages action from the final declaration of responsibility was located, but no fixed deadline for filing an APDA complaint.
Relevance to data brokers
No data-broker-specific complaint, registration, or deletion route was located. No general public-record-specific deletion procedure was located either. The general LQPD route may apply where a controller holds publicly sourced data, including access, rectification, restriction, objection, and deletion subject to exceptions. For specified parish-census data, opposition, deletion, and portability are expressly excluded.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
What privacy rights does Andorra’s LQPD provide?+
The LQPD provides information, access, rectification, deletion, restriction, portability, objection, consent-withdrawal, automated-decision safeguards, compensation, and complaint rights. These rights are subject to statutory exceptions, including criminal-justice, public-interest, legal-obligation, research, and public-record limitations.
How long does an Andorran controller have to answer a privacy request?+
The general response period is one month from the day after receipt. It may be extended by up to two additional months for complexity or request volume, with notice and reasons within the first month.
Is there a data-broker deletion route in Andorra?+
No data-broker-specific complaint, registration, or deletion route was located. The general LQPD rights route may apply to a broker where applicable, but specified parish-census data is subject to a statutory exclusion of opposition, deletion, and portability.
Official sources & citations
Other international privacy regimes
LQPD sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: