Panama

Article 5 of Law 81 of 2019 sets the reach: databases situated in Panamanian territory holding personal data of nationals or foreigners, or where the controller is domiciled in the country. This is a location-and-establishment test, not the 'targeting' test used by Europe's General Data Protection Regulation or by India. In practice most foreign cloud-using businesses are caught anyway, because their Panamanian customer, subsidiary or supplier is caught. Article 5 also carves out an important exception: databases of entities regulated by special laws are excluded from Law 81 where those special laws already set minimum technical standards for protecting and processing personal data. That is why banks are effectively governed by banking secrecy rules rather than by the general privacy law.

Article 33 of Law 81 lists thirteen alternative grounds. They are alternatives, not cumulative: meeting one is enough. Article 5 adds a general condition that whoever stores or transfers confidential, sensitive or restricted data originating in Panama must meet Panama's protection standards or show they meet equal or higher ones, with exceptions for consent, contract necessity, banking and securities transfers, and transfers required by ratified treaties. Sector by sector, checked on 19 August 2026: BANKING — no localisation, but outsourcing that touches confidentiality, integrity, availability or custody of client assets needs prior written approval from the Superintendency of Banks, and the regulator's own 2006 circular openly contemplates banks whose technology processing centres sit abroad. SECURITIES — no localisation rule found on the regulator's index of Acuerdos. INSURANCE — no localisation rule found; the regulator's site would not load without JavaScript, so this is a weaker finding. HEALTH — no localisation rule found. TELECOM — no localisation or call-record retention rule found on the regulator's own telecom pages. GOVERNMENT — no localisation rule found, but state bodies must pass a cybersecurity control checklist and get the state technology authority's authorisation before a citizen-facing platform goes live. GAMING and MAPPING — the gaming board's website was unreachable from our network, so those two are unverified.

Resolucion No. ANTAI-DG-003-2026 of 26 March 2026, published in the Official Gazette on 8 June 2026, adopts the model contractual clauses of the Ibero-American Data Protection Network in two versions: controller-to-controller and controller-to-processor. Point TWO of the resolution states that users of the clauses do not need to seek prior authorisation from the Directorate General for international transfers, provided the transfer complies with Law 81, Decree 285 and other applicable rules. Point THREE requires the clauses to be used without altering their wording except for the personalisation the models themselves indicate. Point FOUR allows them to be embedded in wider contracts or supplemented with extra guarantees, so long as nothing contradicts them or lowers protection. Point FIVE recognises them as an adequate safeguard, without prejudice to the regulator's supervisory powers. The regulator can also recognise a destination as offering equivalent or higher protection, but we found no published list of such destinations, so in practice that route is unused.

The authority is usually called ANTAI, from its Spanish name Autoridad Nacional de Transparencia y Acceso a la Informacion. Article 36 of Law 81 gives its data protection directorate the power to sanction both the controller and the database custodian. Article 43 grades penalties: minor breaches bring a summons; serious breaches bring proportionate fines; very serious breaches bring closure of the database registry or temporary or permanent suspension of data storage and processing, plus a fine. Very serious sanctions require a formal opinion from the Personal Data Protection Council before the authority can act, and the authority may call on the police to enforce a closure. That extra step, plus the absence of published decisions, is why we rate enforcement as waking rather than active. Sector regulators are a different story: the Superintendency of Banks and the state technology authority are both plainly operational and issuing binding instruments in 2026. Separately, individuals can bypass the regulator entirely and go to court through the constitutional habeas data action.

The purpose-limitation principle in article 2(2) of Law 81 forbids keeping data for longer than needed. Article 28 is the unusual one and is easy to miss: it bans transferring or communicating data relating to an identified or identifiable person once seven years have passed since the legal obligation to keep it ended, unless the person expressly requests otherwise. Article 16 gives a person the right to demand deletion where storage has no legal basis, was never authorised, or the data has gone stale, and the response deadline for an access request is ten working days. Under Law 51 of 2008, records of electronic certificates must be kept for seven years, and providers of technological document storage must keep the records and practice statements at least as long as the law requires the stored document to be kept. We did not verify Panama's tax and commercial book-keeping floors from a government source in this pass, so treat those as open.

The 72-hour deadline comes from the implementing decree, Decreto Ejecutivo No. 285 of 28 May 2021, and was restated in ANTAI's Circular No. DS-002-2026 of 15 April 2026. That circular is formally addressed to the public sector, from ministers down to mayors, but it recites the general obligation on any controller. Articles 36, 37 and 38 of the same decree require security measures to be established, operated, monitored, reviewed, maintained and continuously improved on a recurring basis. Watch for a second clock if you are a bank or a state body: state entities operate under the Government Security Operations Centre created by Decreto Ejecutivo No. 53 of 11 June 2025 and run by the state technology authority. We did not find a published nationwide cyber-incident reporting deadline separate from the 72-hour data breach rule, so unlike India or Singapore there does not appear to be a second, much shorter clock for the private sector.

(1) Article 44 of the Constitution creates habeas data as a summary court process, expressly available without a lawyer, to obtain, correct, update, delete or keep confidential personal information held by public or private record-keepers, where the private holder is a business providing a service to the public or supplying information. Article 42 gives a constitutional right of access, rectification, protection and deletion. This runs in parallel with the regulator and is the more likely source of real-world exposure while the regulator is still warming up. (2) Article 43 of Law 81 makes closure of the database registry and temporary or permanent suspension of storage or processing the sanctions for very serious breaches. Commercially that outweighs any fine. (3) Article 5 of Law 81 excludes databases of entities governed by special laws where those laws already set minimum technical standards, which is a real carve-out and not a formality. (4) The seven-year onward-transfer ban in article 28 has no equivalent in most privacy laws and is easy to overlook. (5) Under the banking regulator's Acuerdo No. 009-2005 all outsourcing except a short list of administrative and general services needs prior authorisation, and its Circular No. 064-2006 requires a draft of the contract to be sent to the regulator before it is signed. The regulator has 30 working days to decide and the bank may not start until it is notified.

Dormant switches, all already in law and usable without consultation. First, the regulator can recognise a country or international body as offering equivalent or higher protection, or withdraw that view. No list has ever been published, so both directions are open. Second, the implementing decree lets the regulator validate and adopt model contractual clauses as a condition of lawfulness for transfers, inside and outside the country. It used that power for the first time in 2026 and can amend or replace the clauses the same way. Third, the state technology authority can add to the mandatory cybersecurity control list for public bodies by resolution, and did so in May 2026 with a 30-day self-assessment deadline and a 45-day remediation deadline. Fourth, since June 2026 it can refuse to authorise, or order the suspension of, any citizen-facing state digital platform. Fifth, the very serious sanctions in the privacy law, database closure and suspension of processing, have never been used publicly, so the first use will be a step change rather than a legal change.