Law: Act No. 1.165 on the Protection of Personal Data (23 December 1993) (the Act)

Regulator: Monegasque data protection authority (CCIN)

Summary: Monaco's data protection framework is regulated by the Act No. 1.165 on the Protection of Personal Data (23 December 1993) (the Act) which is similar to the GDPR in several aspects, such as lawful bases for processing, requirements for data transfers, and data subject access rights. The Act has been revised several times, most notably in 2008 to grant the Monegasque data protection authority (CCIN) the status of an independent authority, and in 2015, to create a constitutionally compliant legal framework for the CCIN's investigatory powers.

Notably, on January 28, 2022, the CCIN stated that a bill relating to the protection of personal data (only available in French here), which is intended to replace the Act, was submitted to the Monaco Office of the National Council. In particular, the bill consists of 114 Articles replacing the 26 Articles present in the law and aims to integrate into domestic law international standards resulting from Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (the Convention 108+) of the Council of Europe and the GDPR.