{ "jurisdiction_id": "LI", "jurisdiction": "Liechtenstein", "url": "https://dataprotection.gi/jurisdictions/liechtenstein/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-05", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 44, "sub_modules": 57, "source_register": 13 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/liechtenstein/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Full GDPR incorporation with a closely-aligned national implementing act and an active, EDPB-integrated supervisory authority; no material derogations identified.", "claims": [ { "statement": "The Datenschutzstelle (DSS), based in Vaduz, is Liechtenstein's national data protection supervisory authority responsible for GDPR enforcement.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Datenschutzstelle / EDPB", "source_url": "https://www.datenschutzstelle.li", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The supervisory authorities of the EFTA EEA States, including Liechtenstein, Iceland and Norway, are EDPB members with regard to GDPR-related matters, without voting rights.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "EDPB", "source_url": "https://www.edpb.europa.eu/about-edpb/about-edpb/members_en", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Liechtenstein implemented the GDPR through the Data Protection Act of 4 October 2018 (DSG) and the Data Protection Ordinance of 11 December 2018 (DSV), both effective 9 January 2019.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The EEA Joint Committee adopted Decision No. 154/2018 incorporating the GDPR into the EEA Agreement, making the GDPR directly applicable in Liechtenstein.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The DSG does not contain major derogations from the GDPR and details legal bases for processing, data subject rights, and requirements for data transfers, and is closely aligned with the German BDSG.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Liechtenstein's GDPR-aligned regime relies on internal accountability documentation (e.g., records of processing) rather than a general prior-notification/registration duty to the DSS.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "green", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/liechtenstein/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Full GDPR-aligned lawful-basis and special-category regime; DSS has issued specific guidance filling practical gaps (e.g., incapacitated adults).", "claims": [ { "statement": "Liechtenstein's DSS newsletter summarised recent court rulings on GDPR and DSG covering, among other things, legitimate interest principles.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The DSS issued guidance on obtaining valid consent for adults incapable of giving consent under GDPR.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "DSS DPIA guidance identifies processing of special categories of data under Article 9 and data referred to in Article 10 GDPR as requiring heightened scrutiny and, in certain circumstances, a mandatory DPIA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Datenschutzstelle / hosted via EDPB", "source_url": "https://www.edpb.europa.eu/sites/default/files/decisions/dsfa_-_dpia.pdf", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "green", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/liechtenstein/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Rights regime is fully GDPR-aligned with active DSS interpretive guidance; standard one-month response deadlines apply via direct GDPR incorporation.", "claims": [ { "statement": "The DSS has provided guidance on employee email access requests.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "DSS guidance clarifies GDPR obligations for data deletion and erasure, emphasizing conditions and storage recommendations.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "DSS has discussed Google's Street View image collection and individuals' rights to object under GDPR.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "DSS newsletter highlighted court rulings on abusive exercise of data subject rights under GDPR.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "green", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/liechtenstein/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Comprehensive GDPR-aligned controller/processor duties with an active, EDPB-coordinated DPIA guidance framework and functioning breach-notification channel.", "claims": [ { "statement": "The Datenschutzstelle's DPIA guidance identifies types of processing (e.g., large-scale evaluation of authority-collected data forwarded to law enforcement, or processing of children's/vulnerable individuals' data for marketing, profiling or automated decision-making) as requiring a DPIA even where not otherwise 'extensive' within Article 35(3)(b) GDPR.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Datenschutzstelle / hosted via EDPB", "source_url": "https://www.edpb.europa.eu/sites/default/files/decisions/dsfa_-_dpia.pdf", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Generally, any form of processing bearing a high risk to the rights and freedoms of individuals because of its nature, scope, circumstances and purpose, particularly when using new technologies, requires a prior DPIA under the DSS framework.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Datenschutzstelle / hosted via EDPB", "source_url": "https://www.edpb.europa.eu/sites/default/files/decisions/dsfa_-_dpia.pdf", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "A DSS newsletter summarised recent national court rulings on GDPR and DSG covering DPO dismissal, health data handling, and legitimate interest principles.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Liechtenstein's Data Protection Authority accepts data breach notifications in German or English.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EDPB", "source_url": "https://edpb.europa.eu/notify-data-breach_en", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Liechtenstein's data protection regime ends with death, with other (non-DP) laws governing the handling of deceased persons' data.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "green", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/liechtenstein/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "Full GDPR Chapter V transfer regime applies via EEA incorporation, with active DSS transfer guidance and enforcement notices, plus recognition as a qualifying state under the EU-U.S. DPF.", "claims": [ { "statement": "The DSS has published guidance on international data transfers and adequacy applicable in Liechtenstein.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Under the EU-U.S. Data Privacy Framework, EU member states along with Iceland, Liechtenstein and Norway are designated 'qualifying states', whose citizens can seek redress through the U.S. Data Protection Review Court.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/european-commission-adopts-eu-u-s-adequacy-decision", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The UK's EU adequacy decisions apply to personal data transferred from all EEA countries, defined to include Iceland, Liechtenstein and Norway, allowing flows to the UK without additional safeguards.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "ICO", "source_url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The EDPB has adopted Article 64 opinions on Binding Corporate Rules with Liechtenstein as a concerned member state, indicating active national BCR coordination.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Datenschutzstelle / EDPB", "source_url": "https://www.datenschutzstelle.li", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The DSS issued a notice on TikTok's unlawful data transfers to third countries, recommending organizations assess transfer risks and inform users.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/liechtenstein-dss-issues-notice-tiktoks-transfer", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Personal data relating to dactyloscopic (fingerprint) data may be supplied by EU Member States to Switzerland and Liechtenstein from 1 July 2026 under a dedicated Council Implementing Decision, reflecting sector-specific (law-enforcement) cross-border data-sharing arrangements rather than general data localisation.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex / Official Journal of the EU", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32026D1459", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/liechtenstein/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Financial, health, telecoms/cookie and employment overlays are evidenced via DSS guidance/reports; credit-scoring, education, and insurance sub-modules lack dedicated LI sources.", "claims": [ { "statement": "DataGuidance publishes a dedicated analysis of data protection in Liechtenstein's financial sector, reflecting the interplay between GDPR/DSG and financial-market regulation in the jurisdiction.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/liechtenstein-data-protection-financial-sector", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "A DSS newsletter summarising recent court rulings on GDPR and DSG covered health data handling among other topics.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "DSS updated guidance on cookies clarifies consent requirements and the conditions under which legitimate interest may be used for cookie-based tracking.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The DSS's 2024 report highlights inquiries on AI data processing, video surveillance, and employment data, with no fines imposed despite several formal measures.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "amber", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/liechtenstein/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "Cookie/tracker consent is actively covered by DSS guidance; several other sub-modules (dark patterns, opt-out signals, clean rooms, cross-context advertising, direct marketing specifics) lack dedicated LI sources and rely on the GDPR/ePrivacy baseline.", "claims": [ { "statement": "The DSS has published guidance on international data transfers and adequacy, and on the application of European case law concerning cookies in Liechtenstein.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/liechtenstein/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "Profiling/ADM and AI-risk sub-modules are well evidenced via active DSS guidance; biometric, genetic-data, and state-surveillance sub-modules rely more heavily on the general GDPR baseline.", "claims": [ { "statement": "DSS DPIA guidance identifies processing of children's or other vulnerable individuals' data for marketing or profiling for automated decision-making as requiring a DPIA even where not 'extensive' under Article 35(3)(b) GDPR.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Datenschutzstelle / hosted via EDPB", "source_url": "https://www.edpb.europa.eu/sites/default/files/decisions/dsfa_-_dpia.pdf", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The DSS's DPIA blacklist references automated decision-making as a high-risk processing trigger requiring assessment consistent with Article 22 and Article 35 GDPR.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Datenschutzstelle / hosted via EDPB", "source_url": "https://www.edpb.europa.eu/sites/default/files/decisions/dsfa_-_dpia.pdf", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The DSS warned of data protection risks associated with the AI service DeepSeek R1 and advised the use of GDPR-compliant tools.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The DSS announced Meta's plan to use public data from European users for AI training and provided a window for objections until 26 May 2025.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The DSS updated its guidance on video surveillance, addressing limitations on the practice.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/liechtenstein/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Age-verification, minor-profiling and dependent-adult sub-modules are evidenced via active DSS guidance; parental-consent-age specifics and education-settings rules rely on the unlocalised GDPR Article 8 baseline.", "claims": [ { "statement": "The DSS provides GDPR compliance guidance on data access and social media age restrictions.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Processing of personal data of children or other vulnerable individuals for marketing, profiling for automated decision-making, or the offer of online services requires a DPIA under DSS guidance even where not 'extensive' under Article 35(3)(b) GDPR.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Datenschutzstelle / hosted via EDPB", "source_url": "https://www.edpb.europa.eu/sites/default/files/decisions/dsfa_-_dpia.pdf", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The DSS issued guidance on obtaining valid consent for adults incapable of giving consent under GDPR.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/liechtenstein/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Enforcement powers and recent developments are well evidenced; specific collective-redress/private-right-of-action mechanics and regulator funding/headcount data for Liechtenstein were not separately sourced.", "claims": [ { "statement": "Each GDPR supervisory authority, including the DSS as incorporated via the EEA Agreement, has corrective powers under Article 58(2) including the power to impose administrative fines under Article 83.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex / CJEU", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62023CJ0383", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The DSS's 2024 report highlights inquiries on AI data processing, video surveillance, and employment data, with no fines imposed despite several formal measures.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Liechtenstein's DSS 2023 report covers inquiries on GDPR compliance, AI services, video surveillance, and data protection breaches.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdiction/liechtenstein", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "An individual has the right to lodge a complaint with a data protection authority of an EEA Member State, which includes the EU countries plus Iceland, Liechtenstein and Norway.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EDPB", "source_url": "https://edpb.europa.eu/sme-data-protection-guide/steps-individuals-can-take-against-you_en", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The DSS issued a notice on TikTok's unlawful transfer of personal data to third countries, recommending organizations assess risks and inform users.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/liechtenstein-dss-issues-notice-tiktoks-transfer", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "At the IAPP Global Summit 2026, US and EU officials provided an update on the status of the EU-U.S. Data Privacy Framework, under which Liechtenstein remains a designated qualifying state.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/european-commission-adopts-eu-u-s-adequacy-decision", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Council Implementing Decision (EU) 2026/1459 of 25 June 2026 set 1 July 2026 as the date from which personal data relating to dactyloscopic data may be supplied by EU Member States to Switzerland and Liechtenstein.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex / Official Journal of the EU", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32026D1459", "source_tier": null, "observed_at": "2026-08-05" } ] } ] }