Andorra Cyber and Data Agencies Sign Incident Coordination Protocol

Andorra Digital, through the National Cybersecurity Agency (ANC-AD), and the Andorran Data Protection Agency (APDA) have formalised an agreement to strengthen coordination when handling incidents that affect both cybersecurity and personal data protection.

The two bodies said the protocol will allow them to exchange information securely and spare affected people and companies from having to submit the same documentation more than once.

Under the arrangement, an initial assessment of incidents should be carried out within 24 hours, while gathering the data needed to analyse them has a reference period of under 72 hours. These deadlines are indicative and do not alter existing legal notification obligations.

Each incident covered by the protocol will be assigned a unique identifier to make it easier to track.

The protocol also provides for a shared form that will let those affected report an incident through either agency without repeating the initial procedure. Submitting the form will not replace specific notifications required by law, and each body will keep its own competences.

The agreement keeps the two agencies' roles separate. The ANC-AD, through its CSIRT-AD incident response team, acts on cybersecurity and the security of networks and information systems, while the APDA carries out control, supervision and investigation functions for personal data protection. Through the accord, both bodies aim to speed up communication and coordination on incidents affecting the two areas, seeking a faster and more efficient response without changing either agency's competences.