Andorra

LQPD, Llei 29/2021 del 28 d'octubre

The LQPD repealed the prior Llei 15/2003 and follows the General Data Protection Regulation (GDPR)'s structure of lawful-basis requirements, controller and processor obligations, and an independent supervisory authority, per its consolidated text and the supervisory authority's own entry-into-force announcement.

Primary text confirms biometric data as a GDPR Article 4(14)-style special category at Article 4(17), prohibited for unique identification under Article 9(1) except under enumerated exceptions, of which only the consent exception, Article 9(2)(a), was independently confirmed. Primary text also confirms, from the law's own table of contents, a full GDPR Chapter V-style cross-border transfer chapter at Articles 42 to 45.

Article 71, captioned Dret a indemnitzacio i responsabilitat (Right to compensation and liability), parallels GDPR Article 82 on its face, but this research read only the heading, not the article's operative text, so the private right of action finding below is medium confidence. Andorra separately holds an EU adequacy decision (2010/625/EC), retained in the European Commission's January 2024 review, referenced by Article 43 itself as a transfer basis.

Llei 12/2024's own content and effective date, response timelines for data-subject rights and breach notification, and whether voice is named anywhere in the biometric definition beyond its general wording were not established.