Law note · Andorra
LQPD, Llei 29/2021 del 28 d'octubre
The LQPD repealed the prior Llei 15/2003 and follows the General Data Protection Regulation (GDPR)'s structure of lawful-basis requirements, controller and processor obligations, and an independent supervisory authority, per its consolidated text and the supervisory authority's own entry-into-force announcement.
Primary text confirms biometric data as a GDPR Article 4(14)-style special category at Article 4(17), prohibited for unique identification under Article 9(1) except under enumerated exceptions, of which only the consent exception, Article 9(2)(a), was independently confirmed. Primary text also confirms, from the law's own table of contents, a full GDPR Chapter V-style cross-border transfer chapter at Articles 42 to 45.
Article 71, captioned Dret a indemnitzacio i responsabilitat (Right to compensation and liability), parallels GDPR Article 82 on its face, but this research read only the heading, not the article's operative text, so the private right of action finding below is medium confidence. Andorra separately holds an EU adequacy decision (2010/625/EC), retained in the European Commission's January 2024 review, referenced by Article 43 itself as a transfer basis.
Llei 12/2024's own content and effective date, response timelines for data-subject rights and breach notification, and whether voice is named anywhere in the biometric definition beyond its general wording were not established.
What it asks of an app
- Establish a lawful basis and allocate controller and processor duties before processing personal data of a person in Andorra under the LQPD.
- Obtain explicit consent or another Article 9(2) exception before capturing or storing a biometric identifier, including a faceprint, of a person in Andorra; biometric data is an explicit special category under Article 9(1).
- Rely on the EU adequacy decision covering Andorra, a Council of Europe Convention 108+ basis, or an appropriate safeguard before transferring personal data of a person in Andorra outside the country, under Articles 42 to 45.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: Consolidated statute text at portaljuridicandorra.ad, read through crawler infrastructure
apda.ad entry-into-force announcement