Andorra Social Democrats Submit 15 Amendments to Bolster Cybersecurity Law

Andorra's social democratic parliamentary group (GPS/PS) has tabled 15 amendments to the proposed revisions of the cybersecurity law, aiming to bolster digital protections through targeted measures while ensuring proportionality, legal safeguards, and obligations tailored to local needs.

Laia Moliné, a General Council member, outlined the proposals on Tuesday, highlighting the importance of precise regulations that promote technological neutrality and avoid excessive demands on individuals and companies. The GPS/PS emphasises strengthening cybersecurity without creating unnecessary pressures.

Key proposals require critical entities to operate a Security Operations Centre (SOC), either internally or via a specialised external service. The amendments would remove the mandate for data hosting exclusively in Andorra, allowing foreign storage provided equivalent protection levels and supervision are maintained.

They also restrict monitoring and information sharing to cybersecurity essentials, protecting personal data, private messages, and business secrets. Incident reporting duties would apply selectively to entities typically outside the law's scope, preventing overly broad requirements and potential penalties.

The group seeks tighter oversight for exceptional cybersecurity steps, stipulating they must be necessary, proportionate, time-limited, and justified. On sanctions, the proposals advocate legality, culpability, proportionality, and preserved judicial review, even with credits for self-reporting.

Significant obligations and penalties, the PS contends, should derive from laws or regulations, not technical guidelines or directives. The amendments promote alignment with European cybersecurity standards and bodies, stressing confidentiality, privacy, independence, and Andorra's priorities. Rollout would be phased, with allowances for extensions, technical support, and sector input.