The Andorran data protection authority ('APDA') announced, on 17 May 2022, that Law 29/2021, of 28 October, of Personal Data Protection ('the Law') entered into force. In particular, the APDA noted that the Law modernises Andorra's data protection regulations, and includes new obligations for data controllers and new rights for data subjects. Furthermore, the ADPA notes that the Law allows better control of data by data subjects, while complying with it will help companies to foster customer confidence, increase security, and improve data management and transparency, among other things.

In addition, the Law notes that its purpose is to update the regulations relating to the processing of personal data for individuals, private entities, and the Andorran Public Administration in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). Furthermore, the Law includes principles applicable to the processing of personal data which align with the GDPR, such as lawfulness, fairness, transparency, purpose limitation, data minimisation, and accuracy. Specifically, the Law also lays out a number of rights for data subjects, such as the right to rectification, right of access, and the right to data portability, as well as provisions relating to Data Protection by Design and Default.

You can read the press release here and the Law here, both only available in Catalan.