Andorra Qualified Law 29/2021 on Personal Data Protection

National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.


Short name	AD LQPD
Region	Europe
Country or scope	Andorra
Sector	Privacy
In your workspace	Off until you switch it on in Compliance › Manage.

How Safeguard covers AD LQPD

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`AD-LQPD-SEC` Security of Processing	Controllers and processors must implement technical measures appropriate to the risk, ensuring confidentiality, integrity and resilience of processing systems; integrity hashes on software components evidence this control (Law 29/2021 GDPR Art. 32-equivalent security obligation)	Scan
`AD-LQPD-ROP` Records of Processing Activities	Controllers and processors must maintain records of their processing activities, which presupposes an inventory of the software systems and components performing the processing (Law 29/2021 GDPR Art. 30-equivalent records obligation)	Scan
`AD-LQPD-PROC` Processor Guarantees	Processing may be entrusted only to processors offering sufficient guarantees of appropriate safeguards, requiring visibility into who supplies the software components used for processing (Law 29/2021 GDPR Art. 28-equivalent processor obligation)	Scan
`AD-LQPD-BRE` Breach Notification Readiness	Personal data breaches must be notified to the APDA within 72 hours, requiring the ability to identify precisely which software components were affected (Law 29/2021 GDPR Art. 33-equivalent breach obligation)	Scan
`AD-LQPD-DOC` Demonstrable Accountability	Controllers must be able to demonstrate compliance with their protection duties, supported by a formally identified, timestamped record of the software processing personal data (Law 29/2021 accountability principle)	Scan

All 22 from the standard set, adapted to AD LQPD.