Countries › Panama › Guide › 13. Regulation › Personal data protection in Panama: Ley 81 de 2019, ANTAI enforcement, 72 hour breach notice and cross border transfers

Personal data protection in Panama: Ley 81 de 2019, ANTAI enforcement, 72 hour breach notice and cross border transfers

Last verified: 2026-10-29 · Status: Stable

Ley 81 de 2019, in force since March 2021, applies to databases in Panama and to controllers domiciled there. Processing needs consent or another legal basis, data subjects have access, rectification, cancellation, objection and portability rights, and transfers abroad need consent, equivalent protection or another listed ground. ANTAI enforces it; security breaches must be notified to ANTAI and to affected people within 72 hours.

Panama's currency, the balboa (B/.), is at par with the US dollar, which circulates as legal tender; the Superintendencia de Bancos states that the balboa's value is on a par with the US dollar (checked 29 October 2026). USD figures therefore equal the balboa figures.

Key facts

Main personal data law	Ley 81 de 2019 textLey 81 de 2019, as of 2026-10-29 · in force
Data protection authority	ANTAI (Autoridad Nacional de Transparencia y Acceso a la Información) textLey 81 de 2019 arts. 7 and 36, as of 2026-10-29 · in force
Breach notification deadline	72 hoursDecreto Ejecutivo 285 de 2021 art. 37, as of 2026-10-29 · in force
Data protection officer mandatory for private companies	No textDecreto Ejecutivo 285 de 2021 art. 42, as of 2026-10-29 · in force
Intragroup transfers allowed without consent	Yes, for the original purposes textLey 81 de 2019 art. 33 num. 5, as of 2026-10-29 · in force

The rule

1. The law applies to databases located in Panama holding personal data of nationals or foreigners, or whose controller is domiciled in Panama. Databases of entities regulated by special laws are excluded only if those laws set minimum standards consistent with Ley 81.Ley 81 de 26 de marzo de 2019, art. 5, 2019-03-26 official text · verified 2026-10-29

2. Processing is lawful only with at least one basis: the data subject's consent, performance of a contract to which the subject is party, a legal obligation of the controller, or authorisation by a special law. Consent must be informed, traceable and revocable without retroactive effect.Ley 81 de 2019, art. 6, 2019-03-26 official text · verified 2026-10-29

3. Cross border storage or transfer of confidential, sensitive or restricted data originating in Panama is allowed if the controller or custodian meets Ley 81 standards or equivalent or higher ones; exceptions include consent, contract performance, banking and securities transfers and treaty obligations.Ley 81 de 2019, art. 5, 2019-03-26 official text · verified 2026-10-29

4. A transfer is lawful if at least one applies: consent; the recipient country or body gives equivalent or higher protection; a law or treaty provides for it; health care needs; transfer to a company of the same group for the original purposes; or a contract in the clear interest of the data subject.Ley 81 de 2019, art. 33, 2019-03-26 official text · verified 2026-10-29

5. Controllers that transfer data to third parties must keep a register of those databases (purpose, legal basis, recipients, security measures, retention, persons with access) available to ANTAI.Ley 81 de 2019, art. 31, 2019-03-26 official text · verified 2026-10-29

6. Infringements are minor, serious or very serious. Minor: summons before ANTAI; serious: fines in proportion; very serious: closure of the database registers and temporary or permanent suspension of processing, plus a fine. Repeating the same infringement within three years is recidivism.Ley 81 de 2019, arts. 38 and 43, 2019-03-26 official text · verified 2026-10-29

7. Ley 81 entered into force two years after its promulgation on 26 March 2019.Ley 81 de 2019, art. 47, 2019-03-26 official text · verified 2026-10-29

8. When the controller learns of a security breach that puts personal data at risk, it must notify ANTAI and affected data subjects without delay, within 72 hours of knowing of the incident, stating the nature of the incident, the data involved, corrective actions and recommendations. Processors must inform the controller immediately. Every breach must be documented.
Example: Breach detected Monday at 9:00: notices to ANTAI and to affected people are due by Thursday at 9:00. / No filing fee in balboas or US dollars.Decreto Ejecutivo 285 de 28 de mayo de 2021, arts. 37 and 38, 2021-05-28 official text · verified 2026-10-29

9. Private entities may, but need not, appoint a data protection officer; the appointment counts in mitigation when sanctions are graded and is valid only once formally notified to ANTAI.
Cost to do it: No fee to register a data protection officer; the cost is staff or an external contract.Decreto Ejecutivo 285 de 2021, arts. 42, 43 and 62 num. 10, 2021-05-28 official text · verified 2026-10-29

10. ANTAI may order a data protection impact assessment depending on risk and the novelty of the technology.Decreto Ejecutivo 285 de 2021, art. 41, 2021-05-28 official text · verified 2026-10-29

11. Infringement actions prescribe after one year (minor), three years (serious) and five years (very serious); serious sanctions prescribe in five years and very serious sanctions never prescribe.Decreto Ejecutivo 285 de 2021, arts. 63 and 64, 2021-05-28 official text · verified 2026-10-29

Worked example

A US software company with no Panamanian office or database, serving Panamanian clients from abroad, is outside art. 5 as written, but a Panamanian subsidiary holding customer data is fully covered.
A Panamanian subsidiary sending HR data to its US parent can rely on the intragroup ground of art. 33 num. 5, provided the data are used for the same purposes.

Step by step

Map databases located in Panama and choose a legal basis for each processing activity.
Keep the art. 31 transfer register and document cross border transfers against art. 33.
Set a 72 hour breach response plan with ANTAI and data subject templates.
Consider appointing and notifying a data protection officer, which mitigates sanctions.

Common traps

Serious infringement fines have no fixed ceiling in Ley 81; ANTAI grades them by criteria including turnover affected (DE 285 art. 62).
Very serious sanctions can shut down processing entirely, which for data driven businesses is worse than a fine.
Regulated sectors (banks, insurers, securities) also face their own regulator's data rules; data subjects go to that regulator first.

Sources

← Consumer protection in Panama: ACODECO, price display, warranties, door to door sales and the 2027 pricing changesAnti money laundering in Panama: Ley 23 de 2015, UAF reporting, B/.10,000 cash reports and fines up to B/.5,000,000 →

Get rule changes weekly

Free. One email a week from The LatAm Thread.

One more step after you press the button: we take you to Substack, where your email is already filled in. Confirm there to start. No spam, unsubscribe anytime, we never share your address. By subscribing you agree to the privacy policy.