The framework
The operative statute in Liechtenstein is the GDPR (via EEA) + Data Protection Act 2018, enforced by Datenschutzstelle.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
GDPR (via EEA) + Data Protection Act 2018
Applies the GDPR in full through the EEA.
Marketing and advertising
GDPR applies through the EEA Agreement; ePrivacy consent for cookies. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
GDPR Chapter V applies in full, so personal data leaves the EEA only under an adequacy decision, standard contractual clauses, binding corporate rules or a narrow derogation, with a transfer impact assessment expected where the destination has surveillance-law exposure. The mechanics are identical across the bloc, so a transfer stack built for one member state travels to all of them.
Enforcement and penalties
The GDPR's ceiling applies, with fines up to EUR 20M or 4% of global annual turnover, whichever is higher, levied by the national supervisory authority, and the EDPB can force a harder line through the dispute mechanism. Member states share the ceiling and differ in enforcement appetite.