Andorra Data Agency Issues Video Surveillance Compliance Rules

The Andorran Data Protection Agency (APDA) has released detailed guidance reminding individuals, businesses, and public entities of their obligations when installing and operating video surveillance systems in the Principat.

Capturing images or sounds of identifiable people qualifies as personal data processing, so systems must comply with data protection rules alongside public security laws. Before deployment, operators need to specify the system's purpose—limited to legitimate aims like protecting people, property, buildings, or access points—justify its necessity, establish the legal basis, define coverage areas, set access controls, determine storage periods, and implement security measures.

All installations must follow principles of necessity, proportionality, and minimal intervention, using the fewest cameras possible with the narrowest field of view, and avoiding less intrusive alternatives. Prohibited areas include third-party private homes, bathrooms, changing rooms, or rest zones. Private cameras cannot film public roads except in exceptional, authorised cases.

Administrative steps vary: prior Interior Ministry approval, backed by a National Video Surveillance Commission report, is required for systems covering public roads, public spaces, or areas open to the public. Private-space-only systems need prior notification. Significant changes, such as expanding the view or adding audio, trigger new notifications or approvals.

Visible signage must inform entrants about the system, controller, purpose, legal basis, and rights exercise methods. Audio recording stays off by default, activating only when strictly necessary and proportional, without less intrusive options, and never capturing private conversations unless legally allowed.

Recordings face a one-month deletion maximum, unless linked to police probes, judicial or administrative proceedings, or public order offences—in which case relevant footage requires separate secure storage with restricted access. Access limits to authorised personnel via internal protocols; sharing or publicising is banned outside legal exceptions. Operators must use strong passwords, encryption, access controls, and automatic deletion, plus log the activity, conduct risk analyses, and perform data protection impact assessments for high-risk setups.

The rules extend to external contractors, workers' rights, and workplace specifics. The APDA will launch a September awareness drive on social media, including an infographic to educate citizens and controllers on these requirements.