Loi sur la Protection des Données Personnelles, données sensibles et mineurs

Loi n. 1.565 du 3 decembre 2024, arts. 2, 6-8, 77 (sensitive data, biometric data and minors)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 13 December 2024.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process sensitive data, meaning data revealing political, religious, philosophical, or trade union opinions, racial or ethnic origin, genetic data, biometric data used to identify a person uniquely, or data about health, sex life, or sexual orientation, unless one of the listed exceptions applies.
Where you rely on a person's explicit consent to process their sensitive data, keep evidence that the consent was specific, informed, and given by a clear positive act, since a law can also bar that prohibition from ever being lifted by consent alone.
As an employer, use a biometric identifier only where it is strictly necessary to control access to the workplace or to the devices and applications your employees use for their duties, and only for that purpose.
Where you process personal data of a minor for an information society service on the basis of consent and the minor is under 15, take consent from the minor together with the authorisation of whoever holds parental authority, and make reasonable efforts to verify that the authorisation genuinely came from a parent or guardian.
As an administrative or judicial authority acting in the exercise of your public powers, do not process genetic or biometric data for authentication or identity control without first obtaining the Authority's opinion, and store the raw biometric data separately from any template derived from it.
Do not interconnect data from the judicial criminal record with any other file or processing operation.
Put safeguards in place to prevent discrimination or another risk to a person's rights and freedoms wherever an exception lets you process their sensitive data on a public interest, medical, or archival, research, or statistical ground.

What it reaches

Obligation class

Prohibition, Consent, Biometric, Age verification

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 2 defines sensitive data as data revealing political, religious, philosophical, or trade union opinions or affiliations, racial or ethnic origin, genetic data, biometric data used to uniquely identify a person, or data about health, sex life, or sexual orientation, and defines biometric data broadly enough to include a facial image or fingerprint data.

Article 7 opens by prohibiting the processing of sensitive data outright, then lists the exceptions that lift the ban, including the person's explicit consent, vital interests, a religious or political body's own members, data the person has manifestly made public, a legal claim, an important public interest ground set by Monegasque law, preventive or occupational medicine and public health, archiving, research, or statistics, and a narrow employer exception for biometric data strictly necessary to control access to the workplace and to the devices and applications employees use for their duties.

Article 6 sets a separate consent floor for a minor using an information society service, and where the minor is under 15 the processing is lawful only with consent from the minor together with the authorisation of whoever holds parental authority.

Article 77 adds a narrower rule reaching only administrative and judicial authorities acting in the exercise of their public powers, requiring the Authority's opinion before they process genetic or biometric data for authentication or identity control, and requiring organisational safeguards such as storing raw biometric data separately from any template derived from it. Article 8 bars any interconnection between the judicial criminal record and any other file or processing operation.

Reading the statute did not surface a general private sector biometric identifier statute of the kind Illinois or Washington enact; Monaco instead treats biometric and genetic data as one item within its ordinary special category regime.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_voice
processes_biometrics
serves_minors
handles_health_records

Read the law

Journal de Monaco n. 8725 and the consolidated text at legimonaco.mc, both read in full (179,076 characters at legimonaco.mc, not truncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app