Dominican Republic

Law 172-13 says its rules are of public order and apply in all the national territory. It does not reach out to companies abroad the way Brazil's or Europe's laws do. It has no duty to appoint a local representative, and no threshold test. The law leaves four things out. Purely personal or household files. Files held by the intelligence and criminal investigation bodies. Files about people who have died. And data about companies, including the name, job title, work address, work phone and work email of the people who work for them. So if you are a foreign business with no local presence, your real exposure is criminal law and private lawsuits, not a regulator.

Industry by industry, checked on 19 August 2026. BANKING AND PAYMENTS: the Monetary Board's Cybersecurity and Information Security Regulation of 1 November 2018 expressly allows cloud services. It asks only for a written policy and a risk analysis. It sets no location requirement. The Operational Risk Regulation approved on 27 November 2025 lets a bank outsource all or part of its data handling. But the contract must let the Superintendency of Banks inspect the supplier, and the Superintendency may object to the arrangement. That is supervision, not a rule about where data sits. SECURITIES: the securities regulator's website blocked automated access on 19 August 2026, so we could not read its technology rules. It is listed in the unconfirmed section. INSURANCE, HEALTH, EDUCATION, GAMBLING, MAPPING: we found no rule about keeping data in the country in the official national law repository. Health adds a duty to keep patient records confidential, but says nothing about where they sit. TELECOMMUNICATIONS: internet and telecom providers must keep traffic, connection and access data for at least ninety days. The law does not say where. GOVERNMENT: the June 2026 interoperability decree tightly controls who may touch public-sector data. It forbids private contractors from keeping or reusing it once their purpose ends. Again, it does not fix a location. WHO REALLY OWNS A COMPANY: the anti-money-laundering law rewrote the Tax Code. Every Dominican company, and some foreign ones, must hold up-to-date information on the real human owners. The law says a regulation will set where it must be kept, 'within Dominican territory'. That is the country's only true rule about data staying put. We could not confirm that the regulation putting it into effect has been issued.

The law controls your reason for the transfer, not the destination. No country has ever been named as banned or as approved. The law contains no power to name one. There is no equivalent of Europe's approved-country decisions, or of India's banned list. The file to keep is evidence of consent. On top of that, anyone who touches personal data at any stage owes a duty of secrecy. That duty lasts after the relationship ends. One drafting quirk is worth knowing. The transfer article opens by talking about transfers 'that require the consent of the person the data is about'. So transfers resting on another legal reason sit in a dark corner of the text. Nobody has the authority to settle that question today.

Law 172-13 names the Superintendency of Banks as the body that can punish credit information companies. Fines run from ten to one hundred minimum monthly wages. It can also withdraw an operating permit. The law gives that power to nobody else, and over nobody else. There is no register of companies that hold data. There is no complaint desk for general privacy matters. There are no published enforcement decisions applying the general parts of the law, and no guidance from a supervisor. Three routes do work. First, a habeas data claim in the courts, which the law itself creates. Second, a criminal complaint, because the law makes several kinds of misuse a crime. Third, for regulated firms, ordinary supervision by the Superintendency of Banks or the telecommunications institute. Calling enforcement dormant here is a statement about the general law. It is not about the financial regulator, which is active.

The ten-year minimums come from the anti-money-laundering law for regulated businesses. That same law rewrote the Tax Code to add a ten-year minimum for taxpayers. It covers accounting books, special registers, receipts and any document about the taxpayer's operations, on paper or electronic. The ninety-day minimum comes from the high-technology crimes law. It binds service providers, including internet providers. A prosecutor can extend it with a preservation order of up to ninety days, which can be renewed. The six-month minimum covers the written permission to run a credit check. During that time the person cannot deny having authorised it. The forty-eight-month limit is the credit reporting window. The general law's erasure right is switched off where a contract or a law requires you to keep the data. That is how the conflict is resolved.

The lack of a private-sector breach duty is the most surprising feature here. No regulator has filled the gap with guidance, because there is no regulator. That does not make silence safe. The general duties of security and secrecy still apply. Someone affected can sue you for damages. Knowingly revealing data you were legally bound to keep secret is a crime. Deliberately or dishonestly getting into a personal database without permission is a separate crime. The twenty-four hour public sector clock comes from the November 2022 decree on cyber maturity in public administration. That decree also requires follow-up reports as soon as new information appears. It warns that steps to contain an incident must not destroy evidence.

A sixth trap. Your internet or hosting provider must be able to produce ninety days of traffic and access records on demand. That sits badly with systems that delete logs after thirty days. A seventh trap. This law sets no special age for children at all. It simply points to the children's code, the penal code and other special laws. So there is no clear digital age of consent to design for. An eighth trap. Credit reference companies are fenced off. They must be authorised by the Monetary Board. They must be listed in a public register held by the Superintendency of Banks. No bank or other deposit-taking institution may own shares in one. Anyone misusing a credit report faces prison.

Three switches that could be flipped matter more than the pending bills. First, the anti-money-laundering law already says a regulation will fix where inside Dominican territory records of company owners must be kept. Issuing that regulation would turn a quiet phrase in the law into a real storage requirement overnight. Second, the June 2026 interoperability and data governance decree gives the Ministry of Public Administration open-ended power. It can issue binding standards, guides and minimum controls for public sector data. That covers private contractors who touch it. The text sets no consultation step. Third, the same decree makes the Comptroller General the auditor of compliance. That creates a way to enforce rules on public sector data that did not exist before. Watch the National Cybersecurity Centre too. It sits inside the national intelligence directorate. It widened its remit through decrees in 2022 and 2024.