Countries › Dominican Republic › Guide › 13. Regulation › Cybercrime and cybersecurity

Cybercrime and cybersecurity

Last verified: 2026-10-30 · Status: Stable

Ley 53-07 punishes illegal access, data damage, fraud and identity theft, and makes companies answer for failures of supervision. The new Penal Code repeals only its conflicting parts. No general cybersecurity law exists for private companies yet: a bill is in Congress, and the national center works under decrees.

USD figures use the Banco Central de la República Dominicana reference selling rate of RD$60.9007 per US dollar, as shown on its home page on 30 October 2026, rounded to the cent.

Key facts

Provider data retention, minimum	90 daysLey 53-07 art. 56, as of 2026-10-30 · in force
General cybersecurity law for private firms	None in force; bill in study textCNCS report, as of 2026-10-30 · pending
Statutory incident notice for private firms	None found textCNCS report, as of 2026-10-30 · in force

The rule

1. Accessing a system without or beyond authorization costs three months to a year in prison and 1 to 200 minimum salaries. If data is deleted, altered or leaked, one to three years and 2 to 400.
Example: Lowest tariff reading: up to RD$6,797,280 / US$111,612.51Ley 53-07 sobre Crímenes y Delitos de Alta Tecnología, art. 6 and paragraph I, 2007-04-23 official text · verified 2026-10-30

2. Taking funds by coercing a user costs three to ten years and 100 to 500 minimum salaries. Transfers through illicit use of access codes cost one to five years and 2 to 200.Ley 53-07 sobre Crímenes y Delitos de Alta Tecnología, art. 14 and paragraph, 2007-04-23 official text · verified 2026-10-30

3. Identity theft by electronic means costs three months to seven years and 2 to 200 minimum salaries.Ley 53-07 sobre Crímenes y Delitos de Alta Tecnología, art. 17, 2007-04-23 official text · verified 2026-10-30

4. Minimum salary means the lowest national minimum for the non sectorized private sector.Ley 53-07 sobre Crímenes y Delitos de Alta Tecnología, art. 4, 2007-04-23 official text · verified 2026-10-30

5. Service providers must keep traffic, connection and access data for at least 90 days.Ley 53-07 sobre Crímenes y Delitos de Alta Tecnología, art. 56, 2007-04-23 official text · verified 2026-10-30

6. Companies are civilly liable for acts of their organs or representatives, and for lack of oversight that made an offense possible. Liability extends to those who ordered it or knowingly let it happen.Ley 53-07 sobre Crímenes y Delitos de Alta Tecnología, art. 60 and paragraph, 2007-04-23 official text · verified 2026-10-30

7. Where a company is a vehicle for a crime: up to double the fine, dissolution, bans, closure, debarment, confiscation.Ley 53-07 sobre Crímenes y Delitos de Alta Tecnología, art. 60 literals a to i, 2007-04-23 official text · verified 2026-10-30

8. The Penal Code repeals provisions of Ley 53-07 that contradict it.Ley 74-25, Código Penal, art. 391 numeral 7, 2025-08-03 official text · verified 2026-10-30

9. Decreto 612-24 frames cybersecurity as national security, places the Centro Nacional de Ciberseguridad as consultative body to the Security Council under the Dirección Nacional de Inteligencia's oversight, and creates the Instituto Criptográfico Nacional.Decreto 612-24, as described by the CNCS, CNCS report 2022 to 2025, 2024 official text · verified 2026-10-30

10. The national strategy to 2030 was approved by Decreto 313-22.Decreto 313-22, as described by the CNCS, CNCS report 2022 to 2025, 2022 official text · verified 2026-10-30

11. PENDING. The CNCS says the Ley de Gestión de la Ciberseguridad bill is still under study in a legislative chamber.Bill, CNCS report, not applicable, 2026-03-01 official text · verified 2026-10-30

Step by step

Assign an owner for security and incident response.
Set access controls and logs that can serve as evidence.
If you provide services, keep traffic data at least 90 days.
Preserve evidence and go to the Ministerio Público's unit on a crime.
Train staff against wire fraud.

Common traps

Some Ley 53-07 offenses now overlap the Penal Code, so check which applies. Only the conflicting parts fell.
Oversight failure alone can make a company civilly liable.
Sector regulators can add their own rules.
Sector and press accounts differ on the bill's stage, so check Congress.
Decretos 612-24 and 313-22 were read through the CNCS report, not their official text.

Sources

← E-commerce and electronic signaturesTrademarks, patents and industrial property →

Get rule changes weekly

Free. One email a week from The LatAm Thread.

One more step after you press the button: we take you to Substack, where your email is already filled in. Confirm there to start. No spam, unsubscribe anytime, we never share your address. By subscribing you agree to the privacy policy.