Liechtenstein Data Privacy Laws: GDPR via EEA Guide (2026)

Liechtenstein, the small principality located between Switzerland and Austria, applies the EU General Data Protection Regulation (GDPR) through its membership in the European Economic Area (EEA). The GDPR was incorporated into the EEA Agreement through Joint Committee Decision No. 154/2018 and became applicable in Liechtenstein on July 20, 2018.

The Liechtenstein Data Protection Act (Datenschutzgesetz, or DSG), enacted in 2018 to replace the earlier 2002 data protection law, provides the national framework that supplements the GDPR. The DSG addresses areas where the GDPR allows member states to adopt specific provisions, including employment data, journalistic and academic expression, public sector processing, and national identification numbers.

This guide covers Liechtenstein's data privacy framework, including the application of the GDPR through the EEA, the DSG's specific derogations, the Data Protection Authority's role, cross-border data transfers, and the particular compliance considerations arising from Liechtenstein's position as a financial center.

GDPR Application Through the EEA

Liechtenstein is not an EU member state, but as a member of the EEA (alongside Norway and Iceland), it is obligated to incorporate EU single market legislation, including the GDPR, into its domestic legal order.

How the GDPR Applies

The EEA Joint Committee incorporated the GDPR into Annex XI of the EEA Agreement. This means the GDPR applies in Liechtenstein with the same legal force as in EU member states. The regulation's provisions on data processing principles, data subject rights, controller and processor obligations, data protection officers, data breach notification, and cross-border transfers all apply directly.

The key difference is the legal basis for application. In EU member states, the GDPR applies as EU law. In Liechtenstein, it applies as EEA law, transposed through the EEA Agreement and given effect by the national DSG.

EEA-Specific Adaptations

Several technical adaptations apply to the GDPR in the EEA context:

• References to "the Union" in the GDPR are read as references to "the EEA"
• References to "member states" include the three EEA EFTA states (Liechtenstein, Norway, Iceland)
• The European Data Protection Board (EDPB) includes representatives from EEA EFTA supervisory authorities, though EEA EFTA representatives participate without voting rights
• Adequacy decisions by the European Commission apply in the EEA, and the EEA EFTA states may also adopt their own adequacy assessments

The Data Protection Act (DSG)

The Liechtenstein Data Protection Act (DSG) entered into force on January 1, 2019. It replaced the previous Data Protection Act of 2002 and serves as the national implementing legislation for the GDPR.

Areas of National Derogation

The DSG exercises several derogations permitted by the GDPR:

Age of consent for information society services: Liechtenstein sets the age at 16, consistent with the GDPR's default. A child below 16 requires parental or guardian consent for data processing in relation to information society services.

Employment data: The DSG includes provisions governing the processing of employee personal data, specifying the conditions under which employers may process employee data for employment-related purposes. Employers must inform employees about data processing and its purposes.

Journalistic and academic expression: The DSG provides derogations for data processing for journalistic, academic, artistic, and literary purposes. These derogations balance data protection with the right to freedom of expression and information.

Public sector processing: The DSG establishes specific rules for data processing by public bodies, including the legal bases for processing by government agencies, courts, and public institutions.

National identification numbers: The DSG regulates the processing of national identification numbers (the AHV number used for social insurance), restricting their use to specific authorized purposes.

Criminal conviction data: Processing of personal data relating to criminal convictions and offenses is limited to specific conditions set out in the DSG, consistent with GDPR Article 10.

Additional DSG Provisions

The DSG also addresses:

• Video surveillance: Rules governing the use of video surveillance systems by public and private entities
• Data Protection Officer appointment: Clarification of DPO requirements for Liechtenstein-based organizations
• Penalties: National penalty provisions supplementing the GDPR's administrative fines framework

Data Subject Rights

As the GDPR applies fully in Liechtenstein, data subjects enjoy the complete set of GDPR rights.

Right to information (Articles 13-14 GDPR): Data subjects must be informed about the identity of the controller, purposes and legal basis of processing, data recipients, retention periods, and their rights at the time of data collection.

Right of access (Article 15 GDPR): Individuals may request confirmation of whether their data is processed and obtain a copy. Controllers must respond within one month, extendable by two months for complex requests.

Right to rectification (Article 16 GDPR): Data subjects may request correction of inaccurate data and completion of incomplete data.

Right to erasure (Article 17 GDPR): Individuals may request deletion when data is no longer necessary, consent is withdrawn, the data subject objects, or processing is unlawful. Exceptions apply for legal obligations, public interest, and legal claims.

Right to restriction (Article 18 GDPR): Data subjects may request limitation of processing in specific circumstances.

Right to data portability (Article 20 GDPR): Individuals may receive their data in a structured, commonly used, and machine-readable format and transmit it to another controller.

Right to object (Article 21 GDPR): Data subjects may object to processing based on public interest or legitimate interests, including profiling. They have an unconditional right to object to direct marketing.

Rights regarding automated decision-making (Article 22 GDPR): Individuals have the right not to be subject to solely automated decisions with legal or similarly significant effects, with limited exceptions.

The Data Protection Authority (DSS)

The Datenschutzstelle (DSS) is Liechtenstein's independent supervisory authority for data protection. The DSS operates with full independence as required by GDPR Article 51.

Organization and Independence

The DSS is headed by the Data Protection Commissioner, who is appointed by the Liechtenstein Parliament (Landtag) for a renewable five-year term. The Commissioner exercises functions independently of the government and other public authorities.

Given Liechtenstein's small size, the DSS is a compact authority. Despite its size, it exercises the full range of supervisory, investigative, and corrective powers required by the GDPR.

Powers and Functions

The DSS exercises all powers mandated by GDPR Articles 57-58:

• Investigative powers: The DSS may order controllers and processors to provide information, conduct data protection audits, and access premises
• Corrective powers: The DSS may issue warnings, reprimands, and orders to bring processing into compliance. It may impose temporary or permanent bans on processing and order data erasure
• Advisory powers: The DSS advises the government and parliament on legislative proposals affecting data protection
• Authorization powers: The DSS authorizes processing operations that require prior consultation under GDPR Article 36
• Complaint handling: The DSS receives and investigates complaints from data subjects

European Cooperation

As an EEA EFTA supervisory authority, the DSS participates in the European Data Protection Board (EDPB) and the one-stop-shop mechanism for cross-border data processing cases. The DSS cooperates with EU supervisory authorities on cross-border enforcement matters, though it participates in EDPB decision-making without formal voting rights.

The DSS also maintains bilateral cooperation with the data protection authorities of neighboring countries, particularly Austria and Switzerland.

Cross-Border Data Transfers

Cross-border data transfers from Liechtenstein follow the GDPR's Chapter V framework, with EEA-specific considerations.

Transfers Within the EEA

Personal data may flow freely between Liechtenstein and EU/EEA member states without additional safeguards, as the GDPR provides a uniform level of protection across the entire EEA.

Transfers to Third Countries

Transfers to countries outside the EEA require one of the following mechanisms:

Adequacy decisions: The European Commission's adequacy decisions (covering countries such as Japan, South Korea, the United Kingdom, and others) apply in Liechtenstein through the EEA Agreement.

Standard contractual clauses (SCCs): Controllers and processors may use SCCs approved by the European Commission for transfers to non-adequate countries.

Binding corporate rules (BCRs): Multinational groups may adopt BCRs approved by the competent supervisory authority.

Derogations: In specific situations, transfers may proceed based on explicit consent, contractual necessity, public interest, legal claims, vital interests, or from a public register.

Switzerland-Specific Considerations

Liechtenstein maintains particularly close ties with Switzerland through the customs union and various bilateral agreements. Switzerland holds an EU adequacy decision, so personal data flows freely between Liechtenstein and Switzerland. This is significant given that many Liechtenstein-based businesses have close operational connections with Switzerland.

Enforcement and Penalties

The GDPR's penalty framework applies in Liechtenstein, supplemented by the DSG's national provisions.

GDPR Administrative Fines

The DSS may impose administrative fines under GDPR Articles 83:

Violation Category	Maximum Fine
Less serious (Article 83(4))	Up to 10 million euros or 2% of total worldwide annual turnover
More serious (Article 83(5-6))	Up to 20 million euros or 4% of total worldwide annual turnover

National Criminal Penalties

The DSG supplements the GDPR's administrative fine provisions with criminal penalties for specific offenses:

• Intentional violations of data protection obligations may carry criminal fines
• Unauthorized access to personal data systems may constitute a criminal offense
• Obstruction of the DSS's supervisory activities is a punishable offense

Enforcement in Practice

Given Liechtenstein's small population and concentrated business landscape, the DSS's enforcement approach tends to emphasize guidance, compliance support, and proportionate intervention. The DSS has imposed administrative fines, though the public record of significant enforcement actions is limited compared to larger EU member states.

The DSS publishes an annual activity report (Tatigkeitsbericht) detailing its enforcement activities, guidance issued, and cooperation with European authorities.

Financial Sector Compliance

Liechtenstein's role as a major financial center creates distinctive data protection compliance challenges.

Banking and Financial Data

Liechtenstein's banking sector, which manages substantial international assets, processes large volumes of personal and financial data. Financial institutions must comply with both GDPR data protection requirements and financial regulatory obligations, including anti-money laundering (AML) rules, tax information exchange agreements, and banking secrecy provisions.

Interaction with Financial Regulation

The Financial Market Authority (FMA) supervises Liechtenstein's financial sector. Data protection requirements apply alongside financial regulatory obligations. Where conflicts arise between data protection and financial regulatory requirements, specific legal provisions (such as mandatory AML reporting) may override data protection rules within their defined scope.

Fund and Trust Services

Liechtenstein's significant fund administration and trust services industry processes personal data of beneficiaries and investors across multiple jurisdictions. Organizations in this sector must navigate GDPR cross-border transfer rules alongside the specific regulatory frameworks governing trust and fund administration.

Recent Developments

Liechtenstein's data protection landscape evolves in lockstep with EU developments through the EEA mechanism.

EU AI Act implementation: As the EU AI Act (Regulation 2024/1689) enters force, Liechtenstein will incorporate it into the EEA Agreement. The interplay between AI regulation and GDPR data protection requirements is a growing area of focus for the DSS.

GDPR enforcement evolution: The EDPB's evolving guidance on issues such as cookie consent, legitimate interests, and data transfers affects Liechtenstein's compliance landscape directly.

Digital services legislation: The EU Digital Services Act and Digital Markets Act, once incorporated into the EEA Agreement, will create additional compliance obligations with data protection implications for Liechtenstein-based digital service providers.

Cross-border cooperation: The DSS has participated in cross-border enforcement actions coordinated through the EDPB's one-stop-shop mechanism, reflecting Liechtenstein's integration into the European enforcement framework.

Blockchain and fintech: Liechtenstein's Blockchain Act (Token and VT Service Provider Act, adopted in 2019) has attracted blockchain and fintech businesses to the principality. These businesses must reconcile blockchain's inherent characteristics (immutability, decentralization) with GDPR requirements such as the right to erasure, creating novel compliance questions.

Sources and References