Dominican Republic

Law 172-13 states that its rules are of public order and apply in all the national territory. It contains no extraterritorial hook of the kind found in Brazil's or Europe's laws, no local-representative duty and no threshold test. The law excludes four things from its scope: purely personal or household files, files held by the intelligence and criminal investigation bodies, files about dead people, and data about companies (including the name, job title, work address, work phone and work email of the people who work for them). Practical consequence: for a foreign business with no local presence, the binding exposure comes from criminal law and from private lawsuits rather than from a regulator.

Sector by sector, checked on 19 August 2026. BANKING AND PAYMENTS: the Monetary Board's Cybersecurity and Information Security Regulation of 1 November 2018 expressly contemplates cloud services, requiring only a documented policy and a risk analysis; it contains no location requirement. The Operational Risk Regulation approved on 27 November 2025 allows a bank to outsource all or part of its data processing, but the contract must let the Superintendency of Banks inspect the provider, and the Superintendency may object to the arrangement. That is supervision, not localisation. SECURITIES: the securities regulator's website blocked automated access on 19 August 2026, so its technology rules were not read; listed in the unconfirmed section. INSURANCE, HEALTH, EDUCATION, GAMBLING, MAPPING: no localisation instrument found in the official national law repository. HEALTH adds a confidentiality duty over patient records but says nothing about where they sit. TELECOMMUNICATIONS: internet and telecom providers must keep traffic, connection and access data for at least ninety days, but the law does not say where. GOVERNMENT: the June 2026 interoperability decree tightly controls who may touch public-sector data and forbids private contractors from keeping or reusing it once their purpose ends, but again does not fix a location. BENEFICIAL OWNERSHIP: the anti-money-laundering law rewrote the Tax Code so that every Dominican company, and some foreign ones, must hold up-to-date information on the real human owners, and says a regulation will set the place where it must be kept 'within Dominican territory'. That is the country's only true residency rule, and we could not confirm the implementing regulation has been issued.

The law controls the reason for the transfer, not the destination. No country has ever been named as banned or as approved, because the statute contains no power to name one — there is no equivalent of Europe's adequacy decisions or of India's blacklist. The practical file to keep is evidence of consent, plus the ordinary duty of secrecy that binds anyone who touches personal data at any stage and survives the end of the relationship. Note one drafting quirk: article 80 opens with transfers 'that require the consent of the data subject', so transfers resting on another lawful basis sit in an unlit corner of the text. Nobody has authoritative power to resolve that ambiguity today.

Law 172-13 names the Superintendency of Banks as the body competent to sanction administrative breaches committed by credit information companies, with fines of ten to one hundred minimum monthly wages and the power to withdraw an operating permit. It gives that power to no one else and over no one else. There is no register of data controllers, no complaint desk for general privacy matters, no published enforcement decisions applying the general provisions of the law, and no supervisory guidance. The routes that do work are: a habeas data claim before the courts, which the law itself creates; a criminal complaint, since the law makes several kinds of misuse a crime; and, for regulated firms, ordinary supervision by the Superintendency of Banks or the telecommunications institute. Rating this regime dormant is a statement about the general law, not about the financial regulator, which is active.

Ten-year floors: article 43 of the anti-money-laundering law for regulated businesses, and article 50(h) of the Tax Code as rewritten by article 105 of the same law, covering accounting books, special registers, receipts and any document, on paper or electronic, relating to the taxpayer's operations. Ninety-day floor: article 56 of the high-technology crimes law, which binds service providers including internet providers and can be extended by a prosecutor's preservation order of up to ninety days, renewable. Six-month floor: the credit-checking permission, during which the person cannot deny having authorised the check. Forty-eight-month ceiling: the credit reporting window. The general law's erasure right is expressly disapplied where a contractual or legal duty to retain exists, which is how the conflict resolves.

The absence of a private-sector breach duty is the single most surprising feature of this regime and the one most often misread. It is not a gap that a regulator has filled by guidance, because there is no regulator. It does not mean silence is safe: the general duties of security and secrecy still apply, an affected person can sue for damages, and knowingly revealing data you were legally bound to keep secret is a criminal offence. Deliberate or bad-faith unauthorised access to a personal database is separately criminal. The twenty-four hour public sector clock comes from the November 2022 decree on cyber maturity in public administration, which also requires follow-up reports as soon as new information emerges and warns that containment steps must not destroy evidence.

A sixth trap worth knowing: your internet or hosting provider must be able to produce ninety days of traffic and access records on demand, which sits badly with architectures that expire logs in thirty days. A seventh: children are not given a special age threshold in this law at all — it simply defers to the children's code, the penal code and other special laws, so there is no clear digital age of consent to design to. An eighth: credit reference companies are ring-fenced. They must be authorised by the Monetary Board, listed in a public register held by the Superintendency of Banks, and no bank or other deposit-taking institution may own shares in one. Anyone misusing a credit report faces prison.

Three dormant switches matter more than the pending bills. First, the anti-money-laundering law already says a regulation will fix the place inside Dominican territory where beneficial ownership records must be kept; issuing that regulation would turn a quiet statutory phrase into an operational storage requirement overnight. Second, the June 2026 interoperability and data governance decree hands the Ministry of Public Administration open-ended power to issue binding standards, guides and minimum controls for public sector data and for private contractors touching it, with no consultation step in the text. Third, the same decree makes the Comptroller General the auditor of compliance, which creates an enforcement pathway for public sector data that did not exist before. Watch also the National Cybersecurity Centre, which sits inside the national intelligence directorate and expanded its remit through decrees in 2022 and 2024.