Hosting your website and email in Andorra makes sense when your users and team are mostly in the Principality and you want a nearby provider that serves you in your own language. Outside Andorra may fit better if you need scale or very specific services. The decision rests on five criteria: law, latency, support, backups and exit.
We declare our interest: BDR Group offers hosting through Hosting Andorra and managed cloud through Andorra Cloud, with a datacentre in Andorra. That is why we take our examples from their public websites, and why we also say when hosting in the Principality is not the right choice.
Which law applies to the data you host?
If the website or email contain personal data of customers, employees or suppliers, the company is the controller and the hosting provider is the processor. This requires a written contract with documented instructions, security measures, control of sub-processors and deletion or return of the data when the service ends (Article 31 of Llei 29/2021, Andorra’s qualified law on personal data protection, in Andorra; Article 28 of Regulation (EU) 2016/679, the General Data Protection Regulation or GDPR, in the EU).
The location of the server also decides whether there is an international transfer of data. From Andorra, Llei 29/2021 of 28 October (BOPA no. 119, 17 November 2021; the BOPA, Butlletí Oficial del Principat d’Andorra, is Andorra’s official gazette) prohibits disclosing data to countries without an equivalent level of protection (Article 42), treats EU Member States and the countries on the Union’s list of adequacy decisions as adequate (Article 43) and, for all other countries, requires appropriate safeguards (Article 44). An Andorran company can contract hosting in the EU without any transfer procedure; the one that takes work is a service outside the EU and without an adequacy decision.
Conversely, a company in Catalonia or Spain can host data in Andorra. The European Commission decided on 19 October 2010 that Andorra ensures an adequate level of protection (Decision 2010/625/EU), and a transfer based on an adequacy decision does not require any specific authorisation (Article 45(1) GDPR). In the first review of the decisions that predate the GDPR, published on 15 January 2024, the Commission concluded that Andorra continues to offer an adequate level (COM(2024) 7 final). The processor contract remains mandatory.
Adequacy is not a permanent guarantee. Under the GDPR the Commission monitors the countries with a decision on an ongoing basis and may amend, suspend or repeal it (Article 45(4) and (5)), and one of the elements it assesses is the existence of an independent supervisory authority (Article 45(2)(b)). In its 2024 annual report, the Andorran Data Protection Agency (APDA) pointed out that an amendment to Llei 29/2021 made that year raised doubts about that independence. As of 25 October 2026 the decision is in force, but it is worth following.
Llei 22/2022 also affects whoever contracts the hosting
Llei 22/2022 of 9 June, Andorra’s act on measures for the security of networks and information systems (BOPA no. 76, 22 June 2022), includes cloud computing service providers and data centre providers among the essential entities (Annex I, sector 7). It applies to entities that reach the thresholds of Article 2.1: 50 people, or more than ten million euros in turnover or balance sheet total. If your provider is subject to it, it has obligations on risk management and incident notification (Articles 12 to 15). And if you are the essential or important entity, the law asks you to take the security of your supply chain into account, including data storage providers (Article 13.3.e). It is worth asking: is it subject to this law, and how does it handle incident notification?
Latency and connectivity: what can be stated and what must be measured
We have not found public, independent latency measurements between Andorra and the cities where Andorran companies have customers, nor published data on the capacity of international connections, so we give no figures. The reliable way to find out is to measure from where your users are, with your current provider and with the one you are considering.
This is something you test, not something you read. Ask for a test environment and measure the response time (ping, traceroute, or the time to first byte shown by the browser’s developer tools) from where your users are and at different times of day. Look at your own website as well: a slow page is usually slow because of heavy images, a content management system without a cache or an overloaded database, and changing country does not fix that. In our view, if most visits come from outside the Principality, a well-configured content delivery network matters more than the country of the server. Also ask how many operators carry the datacentre’s traffic out, and what happens if one connection goes down.
Support: language, hours and who has access
Support is the criterion you notice most when there is an incident and the one that appears least in comparison sites. You need to know in which language they answer, during which hours, through which channel and who you are talking to: a person who can log in to your server, or a first level that passes the request on. Response times are only worth anything if they are contractual.
As an example of how to read this: according to the Hosting Andorra website, consulted on 25 October 2026, the service has its own technical team, ticket support from the customer area or the contact form, phone support Monday to Friday from 8:30 to 18:30 (except public holidays) and a website in Catalan, Spanish, English and French. For virtual servers, the same website distinguishes management levels, including a weekday one and one extended to weekends and public holidays. The actual hours therefore depend on the level you contract, and that has to be checked with any provider, including us.
Backups: where they are, who checks them and who restores them
Llei 29/2021 asks for measures that allow access to personal data to be restored quickly after a physical or technical incident, and a process for regularly verifying that those measures work (Article 35.1.c and d), following the same logic as Article 32 GDPR. In a hosting contract this translates into four questions: where the copy is (not on the same server or in the same account as the original), how long it is kept, who can restore it and whether a restore has actually been tested.
You also need to read what each plan includes, because not all hosting includes managed backups. At Hosting Andorra, for example, with web hosting the customer can make and download backups of their website from Plesk, and managed backups are contracted as a specific service, with the main copy in Andorra and an optional third copy in a second datacentre. There is a decision with consequences that is worth knowing about: if you encrypt the backups with your own key, nobody else can read them, but nobody can verify or restore them for you either. This has to be clarified with any provider before taking it for granted that a backup exists.
Exit: being able to leave without depending on the provider
The processor contract must provide that, at the controller’s choice, the provider deletes or returns all data when the service ends (Article 31.4.g of Llei 29/2021; Article 28(3)(g) GDPR). Before signing, find out in what format and by when they hand it over and whether it has a cost. Three things depend on you and not on the provider: that the domain is registered in the company’s name, that you have access to the DNS and that email can be exported. Run an exit test before you need it: restore a backup in another environment and check that the website and email work there.
Andorra or abroad: summary by criteria
| Criterion | In Andorra | Outside Andorra |
|---|---|---|
| Legal framework | Llei 29/2021; from the EU, the transfer is covered by the adequacy decision | In the EU, no procedure (Article 43); outside the EU, adequacy or safeguards (Article 44) |
| Latency | Needs to be measured; an advantage if users are in the Principality | Depends on distance; a content delivery network can compensate |
| Support | Local language and hours, depending on the level contracted | May be global; check language and hours in writing |
| Backups | Check where the main copy is and whether there is a separate one | The same, and under which jurisdiction |
| Scale | Generally, a narrower catalogue | Generally, more regions and services |
When it makes sense to host outside Andorra
We have an interest in favour of local hosting, which is why we say this: it is not always the best option. If your main audience is outside the Principality, if you need services that only the large providers offer (several regions, on-demand computing) or if you work with tools that are hosted wherever their manufacturer decides, hosting abroad can be reasonable. Just make sure it comes with a processor contract, a justified transfer and a separate backup.
What to do now
- Make an inventory of what you host (web, email, ERP, backups) and mark what contains personal data.
- For each service, note where the data is, who the provider is and whether there is a processor contract.
- Measure the response time from where your users are before comparing providers.
- Ask in writing about support (language, hours, channel), where the backups are, who restores them and within what time.
- Run a restore test and check that the domain and the DNS are yours.
Frequently asked questions
Can I host the data of a company in Catalonia in Andorra?
Yes. Andorra has an adequacy decision from the European Commission, and a transfer based on such a decision does not require specific authorisation. The processor contract remains mandatory.
Can an Andorran company use hosting in the EU?
Yes. Llei 29/2021 treats EU Member States as adequate. You need to watch for services that, although contracted in Europe, send data to third countries without an adequacy decision.
Does any law require me to keep data in Andorra?
We have not found that obligation in the text of Llei 29/2021 or in the text of Llei 22/2022 as published in the BOPA. On 23 June 2026 the Government approved a draft bill amending Llei 22/2022 that we have not been able to review in full text; if you are an essential or important entity, check it.
Are Hosting Andorra and Andorra Cloud the same thing?
No. Hosting Andorra is the BDR Group brand for web hosting, email, .ad domains and virtual servers. Andorra Cloud offers tailored managed cloud for companies (servers, backups and monitoring). Both belong to BDR Group, which is why we declared our interest.
Sources
- General Council of Andorra. Llei 29/2021, of 28 October, qualified law on personal data protection (in Catalan), Articles 31, 35 and 42 to 44. BOPA no. 119, 17 November 2021. Accessed: 25 October 2026. https://www.apda.ad/assets/pdf/CGL20211115_08_58_32.pdf
- European Parliament and Council. Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 28, 32 and 45. OJ L 119, 4 May 2016. Accessed: 25 October 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
- European Commission. Report on the first review of the adequacy decisions, COM(2024) 7 final, 15 January 2024, sections 1 and 4.1 (identifies Decision 2010/625/EU, OJ L 277, 21 October 2010). Accessed: 25 October 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52024DC0007
- European Commission. Adequacy decisions (list of countries with an adequacy decision). Accessed: 25 October 2026. https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
- Andorran Data Protection Agency. Annual report 2024 (in Catalan). Accessed: 25 October 2026. https://www.apda.ad/storage/memories/ULYH2MikkCOWzrH241VfOzUNgpB8UD62FePmsD05.pdf
- General Council of Andorra. Llei 22/2022, of 9 June, on measures for the security of networks and information systems (in Catalan), Articles 2, 12 to 15, Annex I. BOPA no. 76, 22 June 2022. Accessed: 25 October 2026. https://www.consellgeneral.ad/fitxers/documents/lleis-2022/llei-22-2022-del-9-de-juny-de-mesures-per-a-la-seguretat-de-les-xarxes-i-dels-sistemes-d2019informacio
- Government of Andorra. The Government strengthens the cybersecurity framework to adapt it to the evolution of the digital environment (in Catalan), 23 June 2026. Accessed: 25 October 2026. https://www.govern.ad/ca/w/el-govern-reforca-el-marc-de-ciberseguretat-per-adaptar-lo-a-l-evolucio-de-l-entorn-digital
- Hosting Andorra. Home, backup and contact pages (public website). Accessed: 25 October 2026. https://www.hostingandorra.com/
Want to review where your information is hosted?
If you want to know where your infrastructure is and what options you have in Andorra, start with the service page: Managed business cloud in Andorra. For web, email and domains, the brand is Hosting Andorra.