Agència Andorrana de Protecció de Dades

The Agència Andorrana de Protecció de Dades (APDA) is Andorra's national data protection authority. It oversees compliance with personal data regulations. APDA receives complaints from political parties and leaders about AI surveillance and body cameras. It issued rules for CCTV operators requiring prior approvals for public areas, visible signage, and one-month data retention limits. APDA reminds data controllers to notify breaches within 72 hours if risks to rights exist. Political parties proposed replacing APDA with a CSJ-affiliated body in justice reform bills.

Key Points

• The Agència Andorrana de Protecció de Dades (APDA) is Andorra's data protection agency responsible for overseeing compliance with personal data regulations.
• APDA receives complaints from the Pirate Party and opposition leaders regarding AI surveillance systems and body cameras in parishes like Encamp and La Massana.
• APDA issued rules requiring CCTV operators in Andorra to obtain prior approvals for public areas, use visible signage, and limit data retention to one month.
• APDA reminds data controllers of the duty to notify breaches within 72 hours if they pose risks to individuals' rights and freedoms.
• Andorran political parties propose replacing APDA with a new CSJ-affiliated body for judicial data oversight in justice reform bills.

Timeline

1. 2026-07-23

   APDA Releases Video Surveillance Compliance Guidelines

   APDA mandated compliance rules for video surveillance systems, requiring justification of purpose, prior approvals for public filming, signage, one-month retention limits, and encryption.

   Andorra Data Agency Issues Video Surveillance Compliance Rules
2. 2026-03-10

   APDA Issues 72-Hour Data Breach Notification Reminder

   APDA published guidance reminding data controllers to report personal data breaches within 72 hours if they present risks to rights, covering errors like mis-sent emails or unauthorized access.

   Andorran Data Protection Agency Reminds Controllers of 72-Hour Breach Notification Duty

Related Entities