AndorraLQPD, transfers of personal data to third countries or international organisations
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 17 May 2022.
A cross border transfer rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Before transferring personal data to a country or international organisation outside Andorra, confirm the destination offers an adequate level of protection under Article 43, or put appropriate safeguards in place under Article 44, such as standard data-protection clauses or binding corporate rules.
- Where no adequacy finding or appropriate safeguard applies, transfer personal data only under an Article 45(1) derogation, such as the data subject's informed explicit consent or contractual necessity, or, failing that, only under Article 45(2)'s narrow compelling-legitimate-interest exception, informing the Agency and the data subject.
- Expect the Agency's adequacy and safeguards assessment to weigh the destination's rule of law and human rights record, its data protection and professional rules and security measures, and whether data subjects there have effective, enforceable rights and redress.
- Document in your processing register the assessment and safeguards behind any transfer you make under Article 45(2).
What it reaches
Obligation class
Transfer, Access restriction
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 42(1) bars international transfers of personal data where the destination country's or international organisation's rules do not establish a level of protection for personal data at least equivalent to this law's own. Article 43 treats a country, territory or sector the European Union has found adequate, or a state effectively subject to Council of Europe Convention 108+, as offering an adequate level of protection, and treats every European Union member state as offering one.
Article 44 lets a transfer proceed without an adequacy finding where appropriate safeguards exist and data subjects have enforceable rights and effective legal remedies, evidenced by a binding legal instrument between public authorities, binding corporate rules, standard data-protection clauses, a code of conduct with binding commitments, an approved certification mechanism with binding commitments, contractual clauses, or administrative arrangements with enforceable data-subject rights.
Article 44(2) directs the Andorran Data Protection Agency to weigh the rule of law and human rights record, relevant general and sectoral legislation including public-authority access to personal data, data protection and professional rules and security measures, case law, and effective administrative and judicial redress for data subjects, in assessing whether those safeguards are adequate.
Article 45(1) lets a transfer proceed without an adequacy finding or appropriate safeguards only under a listed derogation, including the data subject's informed explicit consent, contractual necessity, important public interest, legal claims, or vital interests.
Article 45(2) lets a transfer proceed on compelling legitimate interests where no adequacy finding, safeguard or Article 45(1) derogation applies, but only if it is not repetitive, affects a limited number of data subjects, and the controller has assessed the circumstances, offered adequate safeguards, and informed both the supervisory authority and the data subject.
Article 12 exempts processing for academic, artistic or literary expression, or professional journalistic activity, from this whole transfer chapter, to the extent necessary to reconcile data protection with freedom of expression and information.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotprocesses_biometrics
Read the law
Consolidated statute text at portaljuridicandorra.ad
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.