Panama

Article 5 of Law 81 of 2019 sets the reach. It covers databases in Panamanian territory that hold personal data of nationals or foreigners. It also covers the company that decides how data is used, if that company is based in Panama. The test is where you are and where the database is. It is not the 'targeting' test used by Europe's General Data Protection Regulation or by India. Most foreign businesses using cloud services get caught anyway, because their Panamanian customer, subsidiary or supplier is caught. Article 5 also has an important exception. Databases of companies covered by special laws fall outside Law 81, where those special laws already set minimum technical standards for protecting and using personal data. That is why banks answer to banking secrecy rules rather than to the general privacy law.

Article 33 of Law 81 lists thirteen grounds. You only need one of them. Article 5 adds a general condition. Whoever stores or transfers confidential, sensitive or restricted data that comes from Panama must meet Panama's protection standards, or show they meet equal or higher ones. There are exceptions for consent, contract necessity, banking and securities transfers, and transfers required by ratified treaties. Here is what we found industry by industry, checked on 19 August 2026. BANKING: data does not have to stay in the country. But outsourcing that touches confidentiality, integrity, availability or custody of client assets needs prior written approval from the Superintendency of Banks. The regulator's own 2006 circular openly accepts that some banks run their technology centres abroad. SECURITIES: we found no rule about keeping data in the country on the regulator's index of Acuerdos. INSURANCE: we found no such rule. The regulator's site would not load without JavaScript, so this finding is weaker. HEALTH: we found no such rule. TELECOM: we found no rule about keeping data in the country and no call-record keeping rule on the regulator's own telecom pages. GOVERNMENT: we found no such rule. But state bodies must pass a cybersecurity control checklist and get the state technology authority's approval before a citizen-facing platform goes live. GAMING and MAPPING: the gaming board's website was unreachable from our network, so those two are unchecked.

Resolucion No. ANTAI-DG-003-2026 of 26 March 2026 was published in the Official Gazette on 8 June 2026. It adopts the model contract clauses of the Ibero-American Data Protection Network. There are two versions. One is for two companies that each decide how the data is used. The other is for a company and the supplier that handles data on its behalf. Point TWO says that if you use the clauses you do not need prior permission from the Directorate General to send data abroad. The transfer must still follow Law 81, Decree 285 and other applicable rules. Point THREE says you must not change the wording, except where the models tell you to fill in your own details. Point FOUR lets you put the clauses inside a wider contract, or add extra guarantees. Nothing you add may contradict them or lower protection. Point FIVE recognises them as enough protection on their own. The regulator keeps its supervisory powers. The regulator can also recognise a destination country as offering equal or higher protection. We found no published list of such countries, so nobody uses that route.

The authority is usually called ANTAI, from its Spanish name Autoridad Nacional de Transparencia y Acceso a la Informacion. Article 36 of Law 81 lets its data protection directorate punish two parties. One is the company that decides how the data is used. The other is whoever keeps the database. Article 43 grades penalties. Minor breaches bring a summons. Serious breaches bring fines set in proportion to the breach. Very serious breaches bring closure of the database registry, or a temporary or permanent ban on storing and using the data, plus a fine. Before imposing a very serious penalty, the authority needs a formal opinion from the Personal Data Protection Council. It may also call on the police to enforce a closure. That extra step, plus the lack of published decisions, is why we rate enforcement as getting started rather than active. Industry regulators are a different story. The Superintendency of Banks and the state technology authority are both clearly working and issuing binding rules in 2026. People can also skip the regulator and go straight to court, using the constitutional habeas data action.

Article 2(2) of Law 81 says you must not keep data for longer than you need it. Article 28 is the unusual one and is easy to miss. It bans transferring or sharing data about an identified or identifiable person once seven years have passed since your legal duty to keep it ended. The only exception is if the person expressly asks you to. Article 16 lets a person demand deletion where storing the data has no legal basis, was never authorised, or the data has gone out of date. You must answer an access request within ten working days. Under Law 51 of 2008, records of electronic certificates must be kept for seven years. Providers of technological document storage must keep the records and practice statements at least as long as the law requires the stored document to be kept. We did not check Panama's tax and book-keeping minimums against a government source, so treat those as open.

The 72-hour deadline comes from the implementing decree, Decreto Ejecutivo No. 285 of 28 May 2021. ANTAI repeated it in Circular No. DS-002-2026 of 15 April 2026. That circular is formally addressed to the public sector, from ministers down to mayors. But it restates the general duty on any company that decides how data is used. Articles 36, 37 and 38 of the same decree say security measures must be set up, run, monitored, reviewed, maintained and improved on a repeating basis. Watch for a second clock if you are a bank or a state body. State bodies work under the Government Security Operations Centre, created by Decreto Ejecutivo No. 53 of 11 June 2025 and run by the state technology authority. We did not find a published nationwide cyber-incident reporting deadline separate from the 72-hour data breach rule. So unlike India or Singapore, there does not appear to be a second, much shorter clock for private companies.

(1) Article 44 of the Constitution creates habeas data, a fast court process. You expressly do not need a lawyer. You can use it to get, correct, update, delete or keep confidential personal information held by public or private record-keepers. For a private holder, it applies where that holder is a business providing a service to the public or supplying information. Article 42 gives a constitutional right of access, correction, protection and deletion. This runs alongside the regulator. It is the more likely source of real trouble while the regulator is still getting started. (2) Article 43 of Law 81 punishes very serious breaches by closing the database registry and banning storage or use of the data, either for a time or permanently. That hurts a business more than any fine. (3) Article 5 of Law 81 excludes databases of companies governed by special laws, where those laws already set minimum technical standards. That is a real exclusion, not a formality. (4) The seven-year ban on passing data on, in article 28, has no equivalent in most privacy laws and is easy to miss. (5) Under the banking regulator's Acuerdo No. 009-2005, all outsourcing needs prior permission, apart from a short list of administrative and general services. Its Circular No. 064-2006 requires a draft of the contract to be sent to the regulator before it is signed. The regulator has 30 working days to decide. The bank may not start until it is told.

These powers are already in the law and can be used without consultation. First, the regulator can recognise a country or international body as offering equal or higher protection, or withdraw that view. No list has ever been published, so it could go either way. Second, the implementing decree lets the regulator approve and adopt model contract clauses, and make them a condition of a lawful transfer, inside and outside the country. It used that power for the first time in 2026. It can change or replace the clauses the same way. Third, the state technology authority can add to the mandatory cybersecurity control list for public bodies by resolution. It did so in May 2026, with a 30-day self-assessment deadline and a 45-day fix deadline. Fourth, since June 2026 it can refuse to approve any citizen-facing state digital platform, or order it suspended. Fifth, the very serious penalties in the privacy law are closing a database and banning the use of data. Neither has ever been used publicly. The first use would be a big shift, even though the law itself would not change.