--- title: "Liechtenstein Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/liechtenstein/ source_html: /jurisdictions/liechtenstein/index.html description: "Liechtenstein data protection and privacy regulation: 10 categories, 64 claims, updated 2026-10-25." generated_at: 2026-11-07T14:58:19Z content_sha256: 0ab57f6bea131330a4d0061580392808ab90e1e7b572656740d0f4b57f1914d3 generator: "fe-fleet/md-twin@1.0" --- # Liechtenstein Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-10-25 · 10 categories · 64 claims · 27 sources in the cumulative register Download report (PDF) Expand all Liechtenstein's Datenschutzstelle (DSS) is participating this cycle as one of 32 European supervisory authorities in the European Data Protection Board's 2025 Coordinated Enforcement Framework examining the practical implementation of the right to erasure under Article 17 GDPR. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Data Subject Rights, Controller/Processor Duties, Sectoral Watch, AdTech & Commercial Privacy (4 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=LIECHTENSTEIN)[Build Report](/reports/?j=LIECHTENSTEIN)[Compare](/compare/?j=LIECHTENSTEIN) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Datenschutzstelle (DSS) / Data Protection Authority, Principality of Liechtenstein Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 64 Claims 7 Tier-1 sources Traffic-light mix 5 green 5 amber (sums to 10 rendered categories; click to filter) No red categories; 10 sub-modules are flagged red. Law made at European Economic Area (Bloc) level that applies in Liechtenstein is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Liechtenstein’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction lead brief ###### Latest update · 25 October 2026 #### Lead Signal The Liechtenstein government has confirmed that the cyberattack on the Register of Beneficial Owners (VwbP), which occurred on 29 and 30 July 2026, constitutes a personal data breach within the meaning of Article 33 GDPR, triggering notification obligations. The breach affected copies of beneficial-ownership data tied to approximately 31,000 legal entities. Since 4 August 2026, the government has been discharging its Article 34 obligation to inform affected data subjects by sending letters to the legal entities concerned, asking them in turn to inform their own beneficial owners that their personal data was compromised. This is a government-run controller response to one of the larger data-breach events to touch Liechtenstein's public registers, and it remains ongoing: as at 5 October 2026, external access to the VwbP itself had resumed only in a restricted form, via in-person identification at the Giessen Service Centre in Vaduz with reduced technical functions. The breach sits at the intersection of two obligation sets that happen to apply to the same underlying dataset: the VwbP exists to satisfy beneficial-ownership transparency requirements, and the personal data it holds is simultaneously subject to GDPR as directly applied in Liechtenstein via EEA incorporation. The government's own classification of the incident as an Article 33 event, and its initiation of an Article 34 downstream-notification chain through the affected legal entities rather than direct notification to individual beneficial owners, is itself a notable operational choice given the scale of the affected population. #### Other Developments No DSS fine or formal decision against a private controller was identified. The dominant enforcement-and-redress development remains the government's own compliance response, as controller, to the VwbP breach, rather than any supervisory action by the Datenschutzstelle against a private party. #### Cross-Monitor Connections The VwbP breach is also tracked on the financial-integrity monitor as a beneficial-ownership transparency disruption, and intersects with the world-payments monitor insofar as payment and e-money firms rely on the same register for customer due diligence. Readers following those monitors should treat this as the same underlying incident assessed through different obligation lenses rather than as three unrelated developments. #### Outlook The Article 34 notification process to beneficial owners, routed through the affected legal entities since 4 August 2026, appears to remain ongoing as at the most recent government statement, with no confirmed completion date identified. Whether the Datenschutzstelle takes any further formal supervisory step in response to the breach, beyond the government's own notification activity, is not yet known. 1 earlier update not shown here. ###### Standing brief · as of 28 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Liechtenstein's Datenschutzstelle (DSS) is participating this cycle as one of 32 European supervisory authorities in the European Data Protection Board's 2025 Coordinated Enforcement Framework examining the practical implementation of the right to erasure under Article 17 GDPR. This places Liechtenstein inside an active, EU/EEA-wide supervisory exercise focused specifically on data subject rights, rather than in a purely domestic or isolated enforcement posture. #### Other Developments The erasure-rights exercise is the principal development for this cycle. The DSS's participation in the Coordinated Enforcement Framework indicates that erasure requests, and the practical mechanics by which controllers in Liechtenstein respond to them, are under heightened supervisory attention this period, consistent with the framework's stated focus on Article 17 implementation across participating authorities. #### Cross-Monitor Connections No cross-monitor routing signal was identified for this development this cycle. #### Outlook The Coordinated Enforcement Framework exercise is ongoing across participating authorities; the results and any consequent guidance or enforcement activity from the DSS specific to erasure-request handling in Liechtenstein would be the next indicator to watch for a shift in this module's posture. Read full brief · 616 words Key regulatory facts for Liechtenstein Regulatory Dimension Liechtenstein Standing Position Jurisdiction Liechtenstein (LI) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 64 sourced findings) Regulator & Framework Full GDPR incorporation with a closely-aligned national implementing act and an active, EDPB-integrated supervisory authority; no material derogations identified. Lawful Processing & Special Data Full GDPR-aligned lawful-basis and special-category regime; DSS has issued specific guidance filling practical gaps (e.g., incapacitated adults). Data Subject Rights Rights regime is fully GDPR-aligned with active DSS interpretive guidance; standard one-month response deadlines apply via direct GDPR incorporation. Controller/Processor Duties Comprehensive GDPR-aligned controller/processor duties with an active, EDPB-coordinated DPIA guidance framework and functioning breach-notification channel. Primary Instruments Cited Datenschutzstelle / EDPB, EDPB, DataGuidance, Liechtenstein Official Instrument (dataprotection.gi liechtenstein), Liechtenstein Official Instrument (globallawexperts.com data-protection-crypto-liechtens) Last Confirmed / Updated 2026-10-25 (27 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Liechtenstein: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Full GDPR incorporation with a closely-aligned national implementing act and an active, EDPB-integrated supervisory authority; no material derogations identified. Primary framework GDPR (EU) 2016/679 as incorporated into the EEA Agreement, implemented via the Liechtenstein Data Protection Act (DSG) of 4 October 2018 and Data Protection Ordinance (DSV) of 11 December 2018 Supervisory authority [Datenschutzstelle (DSS) / Data Protection Authority, Principality of Liechtenstein](https://www.datenschutzstelle.li) Traffic-light rationale — Green Full GDPR incorporation with a closely-aligned national implementing act and an active, EDPB-integrated supervisory authority; no material derogations identified. #### Sub-modules (5) #### Regulator And AuthorityGreen The DSS (Kirchstrasse 8, Vaduz) is the sole national supervisory authority, headed by Dr Marie-Louise Gächter, and is a full member of the EDPB with regard to GDPR matters (without voting rights). Claims (5): - The Datenschutzstelle (DSS), based in Vaduz, is Liechtenstein's national data protection supervisory authority responsible for GDPR enforcement. - The supervisory authorities of the EFTA EEA States, including Liechtenstein, Iceland and Norway, are EDPB members with regard to GDPR-related matters, without voting rights. - The Datenschutzstelle (DSS) is Liechtenstein's national GDPR supervisory authority. - Datenschutzstelle (DSS) — Liechtenstein's national data protection supervisory authority, based in Vaduz - Datenschutzstelle (DSS) — The DSS, resident in Vaduz, is the national Data Protection Authority for Liechtenstein and enforces GDPR #### Act And InstrumentsGreen GDPR applies directly via EEA incorporation; the DSG and DSV are the domestic implementing instruments. Claims (5): - Liechtenstein implemented the GDPR through the Data Protection Act of 4 October 2018 (DSG) and the Data Protection Ordinance of 11 December 2018 (DSV), both effective 9 January 2019. - The EEA Joint Committee adopted Decision No. 154/2018 incorporating the GDPR into the EEA Agreement, making the GDPR directly applicable in Liechtenstein. - GDPR applies in Liechtenstein via EEA incorporation and the DSG. - Datenschutzgesetz (DSG) — GDPR applies in Liechtenstein via EEA incorporation, enforced domestically through the DSG - GDPR / DSG / DSV — GDPR became directly applicable in Liechtenstein via EEA Joint Committee Decision No. 154/2018; DSG (4 Oct 2018) and DSV (11 Dec 2018) implement it nationally, closely aligned with Germany's BDSG #### Material ScopeGreen The DSG tracks GDPR material scope with no major derogations, covering legal bases, data subject rights, and transfer rules. Claims (1): - The DSG does not contain major derogations from the GDPR and details legal bases for processing, data subject rights, and requirements for data transfers, and is closely aligned with the German BDSG. #### Territorial ScopeGreen GDPR Article 3 territorial scope applies as incorporated into the EEA Agreement; no LI-specific narrowing was identified in the sources reviewed. #### Regulator Registration And FilingAmber Consistent with the GDPR model, Liechtenstein does not operate a general prior-registration/notification regime for controllers; accountability is discharged through internal records (ROPA) rather than filings with the DSS. Claims (1): - Liechtenstein's GDPR-aligned regime relies on internal accountability documentation (e.g., records of processing) rather than a general prior-notification/registration duty to the DSS. Liechtenstein is an EEA-EFTA state that has incorporated the GDPR directly via EEA Joint Committee Decision No. 154/2018, giving the Regulation direct legal effect. The domestic implementing framework is the Data Protection Act (Datenschutzgesetz, DSG) of 4 October 2018 and the Data Protection Ordinance (DSV) of 11 December 2018, both effective 9 January 2019, closely modelled on Germany's BDSG. The Datenschutzstelle (DSS) is the national supervisory authority, an EDPB member (non-voting, as an EFTA-EEA state alongside Iceland and Norway). Sources and claims (12) - [Datenschutzstelle / EDPB](https://www.datenschutzstelle.li) — The Datenschutzstelle (DSS), based in Vaduz, is Liechtenstein's national data protection supervisory authority responsible for GDPR enforcement. - [EDPB](https://www.edpb.europa.eu/about-edpb/about-edpb/members_en) — The supervisory authorities of the EFTA EEA States, including Liechtenstein, Iceland and Norway, are EDPB members with regard to GDPR-related matters, without voting rights. - [DataGuidance](https://www.dataguidance.com/jurisdiction/liechtenstein) — Liechtenstein implemented the GDPR through the Data Protection Act of 4 October 2018 (DSG) and the Data Protection Ordinance of 11 December 2018 (DSV), both effective 9 January 2019. - [DataGuidance](https://www.dataguidance.com/jurisdiction/liechtenstein) — The EEA Joint Committee adopted Decision No. 154/2018 incorporating the GDPR into the EEA Agreement, making the GDPR directly applicable in Liechtenstein. - [DataGuidance](https://www.dataguidance.com/jurisdiction/liechtenstein) — The DSG does not contain major derogations from the GDPR and details legal bases for processing, data subject rights, and requirements for data transfers, and is closely aligned with the German BDSG. - [DataGuidance](https://www.dataguidance.com/jurisdiction/liechtenstein) — Liechtenstein's GDPR-aligned regime relies on internal accountability documentation (e.g., records of processing) rather than a general prior-notification/registration duty to the DSS. - [https://dataprotection.gi/jurisdictions/liechtenstein/](https://dataprotection.gi/jurisdictions/liechtenstein/) — The Datenschutzstelle (DSS) is Liechtenstein's national GDPR supervisory authority. - [https://globallawexperts.com/data-protection-crypto-liechtenstein/](https://globallawexperts.com/data-protection-crypto-liechtenstein/) — GDPR applies in Liechtenstein via EEA incorporation and the DSG. - [Datenschutzstelle Liechtenstein](https://www.datenschutzstelle.li/) — Datenschutzstelle (DSS) — Liechtenstein's national data protection supervisory authority, based in Vaduz - [Global Law Experts](https://globallawexperts.com/data-protection-crypto-liechtenstein/) — Datenschutzgesetz (DSG) — GDPR applies in Liechtenstein via EEA incorporation, enforced domestically through the DSG - [GDPRhub - Datenschutzstelle (Liechtenstein)](https://gdprhub.eu/Datenschutzstelle_(Liechtenstein)) — Datenschutzstelle (DSS) — The DSS, resident in Vaduz, is the national Data Protection Authority for Liechtenstein and enforces GDPR - [Datenschutzgesetz (DSG) - official English translation](https://www.datenschutzstelle.li/application/files/4515/8641/2923/DSG_English_final.pdf) — GDPR / DSG / DSV — GDPR became directly applicable in Liechtenstein via EEA Joint Committee Decision No. 154/2018; DSG (4 Oct 2018) and DSV (11 Dec 2018) implement it nationally, closely aligned with Germany's BDSG ### Liechtenstein: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Full GDPR-aligned lawful-basis and special-category regime; DSS has issued specific guidance filling practical gaps (e.g., incapacitated adults). Primary framework GDPR Articles 6, 7, 9 as incorporated via EEA Agreement; DSG Supervisory authority [Datenschutzstelle (DSS)](https://www.datenschutzstelle.li) Traffic-light rationale — Green Full GDPR-aligned lawful-basis and special-category regime; DSS has issued specific guidance filling practical gaps (e.g., incapacitated adults). D2 · Lawful Processing — Full Module Record 4 sub-modules · 34 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Liechtenstein: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Rights regime is fully GDPR-aligned with active DSS interpretive guidance; standard one-month response deadlines apply via direct GDPR incorporation. Primary framework GDPR Articles 12-23 as incorporated via EEA Agreement; DSG Supervisory authority [Datenschutzstelle (DSS)](https://www.datenschutzstelle.li) Traffic-light rationale — Green Rights regime is fully GDPR-aligned with active DSS interpretive guidance; standard one-month response deadlines apply via direct GDPR incorporation. #### Sub-modules (5) #### Access RightGreen DSS has issued guidance on employee email access requests and general subject-access mechanics. Claims (1): - The DSS has provided guidance on employee email access requests. #### Rectification And ErasureGreen DSS guidance clarifies GDPR obligations for data deletion and erasure, including storage-limitation recommendations. Claims (2): - DSS guidance clarifies GDPR obligations for data deletion and erasure, emphasizing conditions and storage recommendations. - Datenschutzstelle (DSS) — EDPB 2025 Coordinated Enforcement Framework action on the right to erasure (Art. 17 GDPR); implementation report adopted 18 February 2026 #### Restriction And ObjectionGreen DSS has addressed the right to object in the context of Google Street View image collection, and issued a newsletter on court rulings concerning abusive exercise of data subject rights. Claims (2): - DSS has discussed Google's Street View image collection and individuals' rights to object under GDPR. - DSS newsletter highlighted court rulings on abusive exercise of data subject rights under GDPR. #### Data PortabilityAmber No LI-specific portability guidance beyond the direct GDPR Article 20 baseline was identified. #### Deadlines And Response WindowsGreen The standard one-month (extendable to three months for complex requests) GDPR response deadline applies directly via EEA incorporation; no LI-specific shortening or lengthening was identified. Data subject rights (access, rectification, erasure, restriction, objection, portability) follow GDPR Articles 15-22 directly, with the DSS issuing practical guidance on access requests, erasure/deletion, and objection rights (e.g., regarding Google Street View), plus newsletter commentary on abusive exercise of data subject rights. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (5) - [DataGuidance](https://www.dataguidance.com/jurisdiction/liechtenstein) — The DSS has provided guidance on employee email access requests. - [DataGuidance](https://www.dataguidance.com/jurisdiction/liechtenstein) — DSS guidance clarifies GDPR obligations for data deletion and erasure, emphasizing conditions and storage recommendations. - [DataGuidance](https://www.dataguidance.com/jurisdiction/liechtenstein) — DSS has discussed Google's Street View image collection and individuals' rights to object under GDPR. - [DataGuidance](https://www.dataguidance.com/jurisdiction/liechtenstein) — DSS newsletter highlighted court rulings on abusive exercise of data subject rights under GDPR. - [European Data Protection Board](https://www.edpb.europa.eu/documents/coordinated-enforcement-framework/coordinated-enforcement-action-implementation-of-the-0_en) — Datenschutzstelle (DSS) — EDPB 2025 Coordinated Enforcement Framework action on the right to erasure (Art. 17 GDPR); implementation report adopted 18 February 2026 ### Liechtenstein: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive GDPR-aligned controller/processor duties with an active, EDPB-coordinated DPIA guidance framework and functioning breach-notification channel. Primary framework GDPR Articles 24-39 as incorporated via EEA Agreement; DSG/DSV Supervisory authority [Datenschutzstelle (DSS)](https://www.datenschutzstelle.li) Traffic-light rationale — Green Comprehensive GDPR-aligned controller/processor duties with an active, EDPB-coordinated DPIA guidance framework and functioning breach-notification channel. D4 · Controller & Processor — Full Module Record 7 sub-modules · 56 words · 8 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Liechtenstein: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Full GDPR Chapter V transfer regime applies via EEA incorporation, with active DSS transfer guidance and enforcement notices, plus recognition as a qualifying state under the EU-U.S. DPF. Primary framework GDPR Articles 44-49 as incorporated via EEA Agreement Supervisory authority [Datenschutzstelle (DSS)](https://www.datenschutzstelle.li) Traffic-light rationale — Green Full GDPR Chapter V transfer regime applies via EEA incorporation, with active DSS transfer guidance and enforcement notices, plus recognition as a qualifying state under the EU-U.S. DPF. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 92 words · 9 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Liechtenstein: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial, health, telecoms/cookie and employment overlays are evidenced via DSS guidance/reports; credit-scoring, education, and insurance sub-modules lack dedicated LI sources. Primary framework GDPR as incorporated via EEA Agreement, overlaid with sector-specific Liechtenstein financial-market and other sectoral rules Supervisory authority [Datenschutzstelle (DSS)](https://www.datenschutzstelle.li) Traffic-light rationale — Amber Financial, health, telecoms/cookie and employment overlays are evidenced via DSS guidance/reports; credit-scoring, education, and insurance sub-modules lack dedicated LI sources. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 50 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Liechtenstein: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookie/tracker consent is actively covered by DSS guidance; several other sub-modules (dark patterns, opt-out signals, clean rooms, cross-context advertising, direct marketing specifics) lack dedicated LI sources and rely on the GDPR/ePrivacy baseline. Primary framework GDPR + EU ePrivacy Directive as applied in Liechtenstein via EEA incorporation Supervisory authority [Datenschutzstelle (DSS)](https://www.datenschutzstelle.li) Traffic-light rationale — Amber Cookie/tracker consent is actively covered by DSS guidance; several other sub-modules (dark patterns, opt-out signals, clean rooms, cross-context advertising, direct marketing specifics) lack dedicated LI sources and rely on the GDPR/ePrivacy baseline. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 47 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Liechtenstein: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Profiling/ADM and AI-risk sub-modules are well evidenced via active DSS guidance; biometric, genetic-data, and state-surveillance sub-modules rely more heavily on the general GDPR baseline. Primary framework GDPR Article 22 and Articles 9-10 as incorporated via EEA Agreement Supervisory authority [Datenschutzstelle (DSS)](https://www.datenschutzstelle.li) Traffic-light rationale — Amber Profiling/ADM and AI-risk sub-modules are well evidenced via active DSS guidance; biometric, genetic-data, and state-surveillance sub-modules rely more heavily on the general GDPR baseline. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 57 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Liechtenstein: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Age-verification, minor-profiling and dependent-adult sub-modules are evidenced via active DSS guidance; parental-consent-age specifics and education-settings rules rely on the unlocalised GDPR Article 8 baseline. Primary framework GDPR Article 8 as incorporated via EEA Agreement; DSG Supervisory authority [Datenschutzstelle (DSS)](https://www.datenschutzstelle.li) Traffic-light rationale — Amber Age-verification, minor-profiling and dependent-adult sub-modules are evidenced via active DSS guidance; parental-consent-age specifics and education-settings rules rely on the unlocalised GDPR Article 8 baseline. D9 · Children's Privacy — Full Module Record 5 sub-modules · 51 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Liechtenstein: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Enforcement powers and recent developments are well evidenced; specific collective-redress/private-right-of-action mechanics and regulator funding/headcount data for Liechtenstein were not separately sourced. Primary framework GDPR Articles 58, 77-84 as incorporated via EEA Agreement; DSG Supervisory authority [Datenschutzstelle (DSS)](https://www.datenschutzstelle.li) Traffic-light rationale — Amber Enforcement powers and recent developments are well evidenced; specific collective-redress/private-right-of-action mechanics and regulator funding/headcount data for Liechtenstein were not separately sourced. Periodic update · new data 2026-10-25 #### Enforcement & Redress The dominant enforcement-and-redress development for Liechtenstein is not a Datenschutzstelle fine or formal decision against a private controller, but the government's own compliance response, as controller, to the VwbP cyberattack. No DSS fine or formal enforcement decision against a private party was identified. Instead, the activity of note is the government discharging its own Article 33 and Article 34 obligations following its classification of the VwbP cyberattack as a personal data breach, with notification to affected legal entities ongoing since 4 August 2026 regarding beneficial owners of approximately 31,000 legal entities whose data was compromised. This is a notable framing point: in a cycle where the single largest and most consequential data-protection event concerns a government-run register, the relevant redress and accountability mechanism in play is the government's own self-reporting and notification conduct as controller, rather than supervisory enforcement directed at it or at a third party. The Datenschutzstelle's breach notification procedure requires reporting without delay and, where possible, within 72 hours of the controller becoming aware of the breach, administered through the DSS's own online notification form; whether the government's own notification to the DSS met this standard was not confirmed. #### Outlook Whether the Datenschutzstelle takes any further formal supervisory step in response to the VwbP breach, beyond the government's own notification and remediation activity, is not yet known. The absence of any announced DSS decision or fine as should be read as the current state of the record rather than as an indication that no further action is possible. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 102 words · 11 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties