Monaco’s new data protection landscape.

Monaco replaced its 1993 data law at the end of 2024. Law No. 1.565 of 3 December 2024 was published in the Journal de Monaco on 13 December 2024 and took the place of Law No. 1.165. Its structure will look familiar to anyone who knows the GDPR. It remains Monegasque law, with its own authority, its own transfer rules and its own implementing texts. For an institution in the Principality, the shift runs from registration to proof. The controller must be able to show what it holds, why, and who can reach it.

Scope, principles and the authority

Article 3 applies the law to controllers and processors established in Monaco, whether or not the processing takes place there. It also reaches organisations abroad that offer goods or services to people in Monaco or monitor their behaviour; subject to exceptions, those must name a representative in Monaco or in an EU member state, as the APDP sets out. Article 4 requires data to be adequate, relevant and limited to the purpose. Article 5 lists six lawful bases.

Article 37 creates the Autorité de Protection des Données Personnelles, the APDP. Its restricted formation can impose fines of up to €5 million or 2% of worldwide annual turnover under article 53, for failures such as security or breach notification, and up to €10 million or 4% under article 54, for failures on lawfulness, rights and transfers. The authority publishes formal notices; one dated 10 September 2026 appears on its site.

The obligations that shape daily work

The APDP’s summary of obligations is the practical starting point.

• Record of processing. Required from 50 employees, but the threshold does not apply when processing is not occasional. Most firms that keep client files should expect to need one.
• Data protection officer. Mandatory in the cases listed in article 29, such as core activities that require regular and systematic monitoring at scale. Often useful elsewhere.
• Security. Article 31 calls for technical and organisational measures matched to the risk.
• Protection by design and by default. Article 23 builds protection into the means of processing and limits processing to what each purpose needs.
• Impact assessment. Article 35 requires one where processing is likely to create a high risk.
• Processor contracts. Article 26 requires a written contract with minimum clauses.

Breach notification, read precisely

Article 32 requires the controller to notify the APDP without undue delay and, where possible, within 72 hours of becoming aware of a breach, unless the breach is unlikely to create a risk to people’s rights and freedoms. A late notice must give reasons for the delay. Every breach must be documented, whether notified or not. Where the risk is high, the controller must also tell the people affected, subject to listed exceptions such as encryption that renders the data unintelligible. The Sovereign Ordinance No. 11.327 allows information to follow in stages. In 2026 the APDP noted a rise in late notifications and said that waiting for technical analysis or internal investigations does not justify delay.

The transition window still open

Article 109 gave processing already carried on lawfully under the old law one year from entry into force to meet Chapter II, and one year to meet articles 27 to 30 and part of article 31. Those windows have closed. Controllers received three years to carry out the article 35 impact assessment as part of re-evaluating risk; that period is still running. Processing covered by article 64 has three years to meet the logging rules in articles 69 and 70.

Transfers: Monaco is not the EU

Under article 97, EU member states are deemed to offer adequate protection. Other destinations need a finding by the Principality, published as a ministerial list after an APDP opinion. The APDP states that, pending that order, the CCIN list of 2009 remains valid. In an opinion of 20 May 2026 it criticised the government’s draft list as a copy of the EU list without the analysis the law requires. Beyond adequacy, articles 98 to 100 allow approved safeguards, narrow derogations or APDP authorisation. An authorisation request that receives no answer within the deadline is deemed refused.

Data flowing the other way follows EU rules. Monaco did not appear on the European Commission’s adequacy list when consulted on 22 September 2026, so an EU sender needs one of the GDPR transfer tools.

From law to architecture

Several duties translate into design:

• The record becomes a live data map of systems, purposes, categories, recipients and retention.
• Minimisation becomes retrieval scope: search and AI tools see what a role needs, not the whole archive.
• The ordinance’s security objectives point to logs showing who entered or reached which data, and when.
• Article 32 points to incident timestamps, a risk assessment template and a notice drafted in advance.
• Transfer rules point to an inventory of every service that stores or processes data outside Monaco.

Keeping systems on premises or in Monaco shortens that last list. It removes none of the others.

Limits of this note

This summary reflects public texts consulted on 22 September 2026 and is not legal advice. The adequacy order is pending. By deliberation 2026-17 of 16 September 2026, the APDP gave its opinion on a draft order applying articles 83 to 85, which cover video surveillance. Texts change. Institutions with regulated activities should confirm their position with Monegasque counsel.