Countries › Dominican Republic › Guide › 13. Regulation › Personal data protection

Personal data protection

Last verified: 2026-10-30 · Status: Changing

Ley 172-13 applies to public and private databases, but was built mostly around credit bureaus. Processing needs free, express and informed consent unless an exception applies, and there is no general data authority, registry or breach notice rule. Enforcement comes through courts, habeas data and damages, while banks' regulator covers only credit bureaus.

USD figures use the Banco Central de la República Dominicana reference selling rate of RD$60.9007 per US dollar, as shown on its home page on 30 October 2026, rounded to the cent.

Key facts

General data protection authority	None; Superintendencia de Bancos covers only credit information companies textLey 172-13 art. 81, as of 2026-10-30 · in force
Law dated	2013-12-13 dateLey 172-13, as of 2026-10-30 · in force
Base rule for processing	Free, express and informed consent, with exceptions textLey 172-13 art. 5 and 27, as of 2026-10-30 · in force
General registration of private databases	None in the text textLey 172-13 art. 41 and 42, as of 2026-10-30 · in force
Fine for individuals, art. 84, top	50 minimum salariesLey 172-13 art. 84, as of 2026-10-30 · in force
Statutory breach notice period	None in the text textLey 172-13, as of 2026-10-30 · in force

The rule

1. The law protects personal data in files, public registers, databases and other technical means, public or private, and also regulates credit information companies. It applies across the country and is a matter of public order.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 1 to art. 3, 2013-12-13 official text · verified 2026-10-30

2. It does not apply to household files, intelligence files, deceased persons, data on legal persons, or files holding only the name, role and work contact details of company staff.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 4, 2013-12-13 official text · verified 2026-10-30

3. Processing and transfer are unlawful without free, express and informed consent, in writing or an equivalent. Where given with other statements, consent must stand out, after notice.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 5 numeral 4, 2013-12-13 official text · verified 2026-10-30

4. Before collecting, tell the person the purpose, recipients, the file and its controller's identity and address, and how to use access, rectification and deletion rights.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 5 numeral 3, 2013-12-13 official text · verified 2026-10-30

5. No consent is needed for public sources; State functions or a legal duty; marketing lists limited to name, ID number, tax ID and biographical data; data from a commercial, labor, contractual, scientific or professional relationship and needed for it; financial and credit data cases; a law that says so; and data dissociated so people cannot be identified.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 27, 2013-12-13 official text · verified 2026-10-30

6. Data must be true, adequate, relevant, accurate and collected for explicit, legitimate purposes, by fair means.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 5 numerals 2, 7 and 8, 2013-12-13 official text · verified 2026-10-30

7. Controllers and processors must adopt technical, organizational and security measures against alteration, loss and unauthorized access, and they keep a duty of secrecy that survives the relationship.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 5 numerals 5 and 6, 2013-12-13 official text · verified 2026-10-30

8. Controllers must adopt an internal manual of policies and procedures, especially for handling queries and claims, and every database must have adequate information policies.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 13 numeral 5 and art. 42, 2013-12-13 official text · verified 2026-10-30

9. Private parties who build files for other than personal use must meet the law's requirements. Art. 42 is headed registration, but its text only requires policies; the law creates no general filing for private databases.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 41 and art. 42, 2013-12-13 official text · verified 2026-10-30

10. Sensitive data cannot be forced. Opinions, beliefs, union membership, health and sex life need express written consent, and files of that data need consent freely given.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 75 and art. 76, 2013-12-13 official text · verified 2026-10-30

11. Data on minors follows the children's code, the Penal Code and special laws.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 79, 2013-12-13 official text · verified 2026-10-30

12. Direct marketing may use data from public documents, supplied by the person, or held with consent. Access is free and the person may ask to be removed at any time.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 71, 2013-12-13 official text · verified 2026-10-30

13. The administrative regime names the Superintendencia de Bancos, and only for credit information companies, with fines of 10 to 100 minimum salaries for serious or repeat breach of final judgments.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 81, 2013-12-13 official text · verified 2026-10-30

14. An individual who knowingly inserts false data, leaks data under a secrecy duty, or breaks into a database faces 10 to 50 minimum salaries, plus damages.
Example: Reading the definition as the lowest tariff: RD$169,932 to RD$849,660 / US$2,790.31 to US$13,951.56Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 84, 2013-12-13 official text · verified 2026-10-30

15. Minimum salary means the lowest national minimum for the non sectorized private sector, set by the Comité Nacional de Salarios.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 6 numeral 22, 2013-12-13 official text · verified 2026-10-30

16. Those harmed by a breach are entitled to compensation under ordinary law.Ley 172-13 sobre Protección de Datos de Carácter Personal, art. 16, 2013-12-13 official text · verified 2026-10-30

17. PENDING. Bills to amend the law or to create a data agency exist in the Senate archive, and a reform was reported under discussion in 2026. No bill number or stage was confirmed at 30 October 2026.Bills in Congress, Senate archive and law firm note, not applicable, 2026-05-01 official text · verified 2026-10-30

Use	Basis	Rule
Customer contract	Relationship, needed for it	art. 27 numeral 4
Payroll and HR	Labor relationship, needed for it	art. 27 numeral 4
Tax and AML records	Legal duty	art. 27 numeral 2
Marketing to customers	Consent, or data they gave, with removal right	art. 71
Health data of staff	Express written consent	art. 76
Sharing with a third party	Consent, for legitimate interests of both	art. 28

Legal bases at a glance

Step by step

Map what personal data you hold, why, and where it sits.
For each use, pick consent or an art. 27 exception and record it.
Rewrite privacy notices to carry the art. 5 numeral 3 items.
Adopt the art. 13 manual with a route for claims inside 10 working days.
Set security measures and vendor secrecy clauses.
Check the transfers page before sending data abroad.

Common traps

Multinationals used to a data officer or filing find none required here, but that does not remove duties. Exposure comes through court actions and damages.
The law has no duty to report breaches. Still act fast: secrecy, security and damages rules apply, and sector rules can add duties.
Consent must stand out from other terms; buried consent is weak.
The marketing list exception covers only name, ID, tax ID and biographical data. It does not cover purchase history.
The art. 84 fine hits individuals. The law sets no general administrative fine for ordinary companies.
Do not treat a GDPR program as enough without a local consent check, since legitimate interest is not listed as a general basis.

Sources

← Unfair competitionData subject rights and habeas data →

Get rule changes weekly

Free. One email a week from The LatAm Thread.

One more step after you press the button: we take you to Substack, where your email is already filled in. Confirm there to start. No spam, unsubscribe anytime, we never share your address. By subscribing you agree to the privacy policy.