AI and personal data in Monaco: what Law No. 1.565 changes
Which law governs the use of AI on personal data in Monaco?
In Monaco it is Law No. 1.565 of 3 December 2024 on the protection of personal data, supervised by the Personal Data Protection Authority (APDP). It requires a lawful basis, information for the people concerned, security, a record of processing and respect for individual rights. PRAGMA designs its AI tools within this framework and shows you how from the free audit onwards.
Connecting AI to your mailbox, CRM or contracts means processing personal data: names, contact details, conversations, sometimes sensitive information. In Monaco this falls under a recent law. This article sums up what it requires of a company, based on the official text published on Legimonaco, then explains how PRAGMA applies it in its projects.
Law No. 1.565 of 3 December 2024 at a glance
Law No. 1.565 of 3 December 2024 on the protection of personal data (loi relative à la protection des données personnelles) was published in the Journal de Monaco on 13 December 2024. It repeals Law No. 1.165 of 23 December 1993 on the protection of nominative information, which had governed the subject in the Principality until then.
Its Article 37 creates an independent administrative authority, the Personal Data Protection Authority (Autorité de Protection des Données Personnelles, APDP), which checks that personal data is processed in line with the law. Under Article 107, the APDP succeeds the former Commission de Contrôle des Informations Nominatives (CCIN) in all its rights and obligations. Its website, apdp.mc, publishes its decisions, forms and guidance for businesses.
The text follows a logic close to the GDPR: a company must be able to demonstrate that it complies with the principles of the law, rather than merely completing formalities.
A lawful basis for every processing operation
Article 5 provides that processing is lawful only if it meets at least one requirement. For a private company, the most common ones are these.
- The consent of the person, for one or more specific purposes.
- The performance of a contract the person is party to, or of pre-contractual steps taken at their request.
- Compliance with a legal obligation the company is subject to.
- The legitimate interest of the company or of a third party, unless the person’s interests or fundamental rights prevail.
In practice, before letting AI sort your client email or draft your follow-ups, you need to know which basis the processing rests on and for which precise purpose. An AI that reused that data for something unrelated to the original purpose would step outside the framework.
Informing people and respecting their rights
When data is collected directly from a person, Article 11 requires the company to give them, at the time of collection, a set of information: the identity of the controller, the purposes and legal basis, the categories of data, the retention period, the recipients, and whether data is transferred outside the Principality.
The law then guarantees rights the company must be able to honour: access to the data, with an answer within one month of the request (Article 12), rectification, erasure, restriction of processing, objection and portability. Article 19 also gives the right not to be subject to a decision that produces legal effects, or significantly affects the person, based solely on automated processing, including profiling, save for the exceptions the text provides.
For an AI tool, this means being able to find all of a person’s data quickly, correct or delete it, and keep a human in the loop for decisions that matter.
Security, records and data breaches
Article 31 requires the controller and the processor to take technical and organisational measures suited to the risks, citing pseudonymisation and encryption among them. Article 26 requires a processor to offer sufficient guarantees and its work to be governed by a written contract.
Article 27 requires a written record of processing activities: purposes, categories of people and data, recipients, retention periods, security measures and transfers outside the Principality. In the event of a data breach, Article 32 provides for notification to the APDP without undue delay and, where possible, within 72 hours, unless the breach is unlikely to create a risk for the people concerned.
Finally, Article 35 calls for a prior impact assessment when processing, particularly through new technologies, is likely to create a high risk to people’s rights and freedoms. An AI project that evaluates or profiles clients should therefore ask that question from the start.
Transfers outside Monaco: the sensitive point for AI
Many AI tools send data to servers located abroad. The law devotes a whole chapter to these transfers. Under Article 97, a transfer is allowed to a country offering an adequate level of protection, and EU member states are deemed to offer it. The APDP has announced the publication of the ministerial order listing the countries, territories and international organisations recognised as adequate.
For a country without that level, Article 98 requires safeguards, such as standard clauses approved by the APDP or approved binding corporate rules. Before adopting an AI tool, you therefore need to know exactly where the data goes, not just where the vendor has its head office.
How PRAGMA applies these rules
Our AI tools are designed so that these obligations are met by construction, not bolted on afterwards.
- Approval before every send: an AI agent prepares, and nothing goes to a client without the go-ahead of someone on your team.
- Scoped access: an agent only reaches the tools and files you open to it, and each colleague sees what their role requires.
- Logs: every access and every action is recorded, whether it comes from a person or an agent, and can be reviewed.
- Hosting: your tools run today on European servers that we administer ourselves. Hosting in Monaco is in preparation for data that must not leave the Principality.
- Your data is not used to train an outside model.
These principles matter even more in professions bound by confidentiality, as our page on AI for family offices and firms in Monaco shows. For the full offer, see AI in Monaco with PRAGMA.
This article is general information based on the text published on Legimonaco and on the APDP website. It is not legal advice: for your specific situation, consult a lawyer or the APDP.
Frequently asked questions
Does Law No. 1.565 replace the old law on nominative information?
Yes. It repeals Law No. 1.165 of 23 December 1993 on the protection of nominative information, and the APDP succeeds the CCIN.
Does a small business in Monaco need a record of processing?
The law requires the controller to keep a written record of processing activities. An AI tool that handles client data belongs in it, with its purpose, its data and its security measures.
Can we use an AI tool hosted outside Monaco?
Yes, if the transfer follows the rules of the law: a country recognised as adequate, or appropriate safeguards. At PRAGMA, your tools run today on European servers that we administer ourselves, and hosting in Monaco is in preparation.
Can an AI make decisions about a client on its own?
The law gives everyone the right not to be subject to a decision with legal or similarly significant effects based solely on automated processing, save for exceptions. At PRAGMA, a person approves every message sent.
What should we do after a data leak?
The controller notifies the breach to the APDP without undue delay and, where possible, within 72 hours, unless there is no risk for the people concerned. Action logs help establish what happened.
To check your AI project against these rules, describe in the contact form the data involved and the tools where it lives. We come back to you with the free audit and prototype, before any commercial discussion.