On May 28, 2021, entered into effect Executive Decree No. 285 of May 28, 2021 (the “Regulation”) which regulates Law No. 81 of March 26, 2019 (the "PPD Law") which establishes mandatory guidelines for the Protection of Personal Data.

To whom it applies to?

The PPD Law and Regulation applies to:

• Databases that store or contain personal data of nationals or foreigners that are in the territory of the Republic of Panama.
• The responsible for processing the data domiciled in the Republic of Panama.
• The processing of data whose origin or storage is in the territory of the Republic of Panama.
• Data processing is carried out within the framework of a commercial activity, through the Internet or other electronic or digital means of communication, in connection with activities aimed at the Panamanian market.

What is personal data?

Any information concerning individuals, which identifies them or makes them identifiable.

Anyone who has access to or is involved in the processing of personal data should maintain confidentiality. This obligation does not cease even if they no longer perform their activities or are not related to the processing of data.

Parties involved in the processing of personal data

Data Owner: Individual to whom the data refer.

Data Controller: The person who makes the decisions related to data processing (i.e. purposes, means, scope, etc.).

Database Custodian: The person who acts in the name and on behalf of the data controller and is responsible for the custody of the database.

Data Protection Officer:

• Public entities: it will be the official designated to attend the liaison unit.
• Private entities: may designate a person to be subscribed with the data controller or custodian of the data. In the case of private entities, the designation is not mandatory; however, it will be taken into consideration as criterion for the graduation of sanctions.

Receiver: natural or legal person, public authority, service, or agency to which personal data is transferred.

Exporter: natural or juridical person of a public or private nature, domiciled in the Republic of Panama, that transfers personal data cross-border.

Obligations of the parties involved in the processing of personal data

The Regulation introduces obligations for the parties, such as:

• Organizational measures to be implemented.
• Mandatory content in communications to the Data Owner.
• Requirements and procedure for obtaining authorization from the Data Owner.
• Protocols to be implemented for the exercise of the rights granted by the PPD Law.
• Technical Specification Sheet to be maintained by the Data Controller and/or Database Custodian.
• Register of databases transferred to third parties.
• Notification and documentation of security breaches.
• Database Custodian Agreement.

For more information, you can contact us.