Status
In force
Consent model
Opt-in
Primary law
Qualified Law 29/2021 on Personal Data Protection
Year
2021
Authority
APDA
Marketing consent
GDPR-modeled consent and legal bases.
Transfers
Andorra holds an EU adequacy decision, so data from the EEA flows in without extra safeguards.
Penalties
Fines reach EUR 100,000 per infringement.
The framework
Andorra's framework rests on the Qualified Law 29/2021 on Personal Data Protection, with the APDA as the supervisory authority.
That puts Andorra in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Qualified Law 29/2021 on Personal Data Protection
2021 · In force
Andorra rewrote its law in 2021 to mirror the GDPR and holds one of the EU's adequacy decisions, so data flows from the EU freely.
Marketing and advertising
GDPR-modeled consent and legal bases. In practice that means consent before tracking or marketing outreach, documented well enough to show a regulator.
Cross-border transfers
Andorra holds an EU adequacy decision, so data from the EEA flows in without extra safeguards.
Enforcement and penalties
Fines reach EUR 100,000 per infringement. Read the ceiling together with the authority's track record, which prices the risk.
Primary sources
Cite this page: "Andorra Data Privacy Laws." Digital Privacy Regulations, September 28, 2026, https://digitalprivacyregs.com/andorra.html. Accessed [date].