![\"\"](\"https:\/\/apdp.mc\/wp-content\/uploads\/2025\/01\/loupe.png\")
<\/p>\n
The obligation to appoint a representative <\/strong>: all data controllers or processors not established in Monaco, must, apart from the exceptions provided by Law<\/span>, appoint a representative in the Principality or, failing that, within a member state of the European Union, if they:<\/p>\n This person will be the contact for both the data subjects concerned by the processing and the APDP, to respond to all questions<\/strong>.<\/p>\n [For more information, refer to the factsheet <\/span>The key players in data protection in the Principality<\/b><\/a>]<\/span><\/p>\n The obligation to maintain a record of processing activities <\/strong>: all data controllers or processors must, apart from the exceptions provided by Law, maintain a record of processing activities carried out under their responsibility if they have at least 50 employees<\/span>.<\/p>\n WARNING<\/strong> this threshold of 50 employees does not apply if the processing is not occasional (example of occasional processing: sending e-mails specifically for the launch of a new product).<\/p>\n This record aims to replace a large part of the preliminary formalities<\/strong> established by Law No. 1.165 of December 23, 1993, as amended.<\/p>\n [For more information, refer to the factsheet The record of processing activities in 10 questions and answers<\/strong><\/a>]<\/p>\n The obligation to appoint a Data Protection Officer<\/strong>:\u00a0 mandatory in certain organizations and often recommended in others, the Data Protection Officer (DPO) facilitates compliance with the data protection legislation and acts both as the primary point of contact for all questions related to personal data, whether internal or arising from an individual affected by a processing operation, and as the correspondent for the Data Protection Authority.<\/p>\n [For more information, refer to the factsheet Job description of the Data Protection Officer<\/strong><\/a>]<\/p>\n The obligation to ensure the level of security appropriate to the risks <\/strong>: all data controllers or processors must take appropriate technical and organizational measures to ensure a level of security appropriate to the risks to the rights and freedoms of individuals.<\/p>\n The adoption of these measures requires an analysis to identify the risks and then determine their level of probability and severity.<\/p>\n [For more information, refer to the FAQ What are the obligations of the data controller?<\/strong> and What are the obligations of the data processor?<\/strong><\/a>]<\/p>\n The obligation to supervise any use of processors <\/strong>: whenever a data controller uses a processor, the latter must provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures to ensure the protection of personal data and the respect for the rights of the data subjects.<\/p>\n Any use of a processor must be governed by a contract that is in written form<\/strong>, with the minimum clauses provided for in Article 26 of Law No. 1.565 of December 3, 2024.<\/p>\n [For more information, refer to the factsheet The key players in data protection in the Principality<\/b><\/a><\/span>]<\/p>\n <\/p>\n The obligation to ensure data protection by design <\/strong>: the data controller must implement appropriate technical and organizational measures both at the time of determining the means of processing and at the time of the processing itself<\/strong> to ensure a high level of protection<\/strong> of the personal data.<\/p>\n [For more information, refer to the FAQ What are the obligations of the data controller?<\/strong><\/a>]<\/p>\n The obligation to ensure data protection by default <\/strong>: the data controller must implement appropriate technical and organizational measures to ensure that only the personal data necessary<\/strong> for each specific purpose of processing<\/strong> are processed.<\/p>\n [For more information, refer to the FAQ What are the obligations of the data controller?<\/strong><\/a>]<\/p>\n The obligation to conduct an impact assessment when processing is likely to result in a high risk to the rights and freedoms of data subjects<\/strong>: a Data Protection Impact Assessment (DPIA or AIPD in French) is a study whose objective is to identify and analyze how the privacy, security, or availability of data would be affected by a given action or activity.<\/p>\n [For more information, refer to the factsheet Impact assessment on personal data protection<\/strong><\/a>]<\/p>\n The obligation to notify data breaches <\/strong>: the data controller must notify the APDP of any breach of personal data of which it is aware where such a breach is likely to cause a risk to the rights and freedoms of the data subjects.<\/strong><\/p>\n This notification must be done without undue delay<\/strong>, and if possible within a maximum of seventy-two hours after becoming aware of it<\/strong>.<\/p>\n This notification may also be accompanied, in certain cases, by a communication to the impacted data subjects.<\/p>\n\n
![\"\"](\"https:\/\/apdp.mc\/wp-content\/uploads\/2025\/01\/missions.png\")
<\/strong><\/p>\n![\"\"](\"https:\/\/apdp.mc\/wp-content\/uploads\/2025\/01\/protectiondonnees.png\")
<\/strong><\/p>\n![\"\"](\"https:\/\/apdp.mc\/wp-content\/uploads\/2025\/01\/securite-2.png\")
<\/strong><\/p>\n![\"\"](\"https:\/\/apdp.mc\/wp-content\/uploads\/2025\/01\/encadrer.png\")
<\/strong><\/p>\nThe obligations specific to data controllers<\/strong><\/h2>\n
![\"\"](\"https:\/\/apdp.mc\/wp-content\/uploads\/2025\/01\/cerveau.png\")
<\/strong><\/p>\n![\"\"](\"https:\/\/apdp.mc\/wp-content\/uploads\/2025\/01\/protection.png\")
<\/strong><\/p>\n![\"\"](\"https:\/\/apdp.mc\/wp-content\/uploads\/2025\/01\/analyse.png\")
<\/strong><\/p>\n![\"\"](\"https:\/\/apdp.mc\/wp-content\/uploads\/2025\/01\/notif.png\")
<\/strong><\/p>\n
![\"\"](\"https:\/\/apdp.mc\/wp-content\/uploads\/2025\/01\/lettre.png\")
<\/strong><\/p>\n