Countries › Dominican Republic › Guide › 13. Regulation › International data transfers

International data transfers

Last verified: 2026-10-30 · Status: Stable

Ley 172-13 has no adequacy list, no standard clauses and no regulator approval for sending data abroad. A transfer that needs consent goes ahead only with that consent or under a listed case, such as performing a contract with the person. Cloud and group sharing therefore rest on notices and contract wording.

Key facts

Adequacy list	None in the text textLey 172-13 art. 80, as of 2026-10-30 · in force
Regulator approval for transfers	None in the text textLey 172-13 art. 80, as of 2026-10-30 · in force

The rule

1. A transfer of personal data to countries or international bodies that requires consent takes place only in the listed cases.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 80, 2013-12-13 official text · verified 2026-10-30

2. Listed cases: free consent or a law allowing it; medical exchange; bank or securities transfers; a treaty or free trade agreement; intelligence cooperation against crime; a contract between the person and the controller, or pre contract steps; public interest or a legal claim, or a request from a tax or customs authority; judicial assistance; and requests by an international body with an interest from a public register.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 80 numerals 1 to 9, 2013-12-13 official text · verified 2026-10-30

3. Sharing with a third party needs to serve legitimate interests of both and, as a rule, prior consent.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 28, 2013-12-13 official text · verified 2026-10-30

4. Those handling data keep secrecy, and security duties reach processors as well.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 5 numerals 5 and 6, 2013-12-13 official text · verified 2026-10-30

Step by step

List every flow out of the country, including cloud vendors, group payroll and support desks.
Assign an art. 80 case to each flow.
Add transfer wording and a named recipient class to consents and notices.
Sign contracts with vendors on security and secrecy.
Keep records of each basis.

Common traps

The contract case covers contracts between the person and the controller. A vendor contract does not qualify by itself.
The law refers to transfers that need consent. If an art. 27 exception covers the processing, read art. 80 with care and document your view, as the law does not spell this out.
Free trade agreements are a listed basis only where the transfer was agreed or provided for under them.
A reform could add new tools, so keep contracts easy to amend.

Sources

Ley 172-13, OGTIC copy

← Data subject rights and habeas dataAnti money laundering rules →

Get rule changes weekly

Free. One email a week from The LatAm Thread.

One more step after you press the button: we take you to Substack, where your email is already filled in. Confirm there to start. No spam, unsubscribe anytime, we never share your address. By subscribing you agree to the privacy policy.