Applicability of Panama's Law No. 81 on Personal Data Protection

Panama's data protection framework is governed by comprehensive legislation that establishes the legal foundation for personal data processing within the country. The primary role of the Law No. 81 of March 26, 2019 on Personal Data Protection (Ley No. 81 del 26 de marzo de 2019 sobre Protección de Datos Personales) is to regulate the processing of personal data and establish the rights and obligations related to personal data protection.

The law was adopted on March 26, 2019 and became effective on March 29, 2021. Panama's data protection framework is governed by primary legislation and implementing regulations. The Executive Decree No. 285 of May 28, 2021, which regulates Law No. 81 of 2019 on Personal Data Protection serves as the regulatory instrument that implements the provisions of the primary data protection law, officially known in Spanish as Decreto Ejecutivo N° 285 de 28 de mayo de 2021, que reglamenta la Ley N° 81 de 2019 de Protección de Datos Personales.

The decree was adopted on May 28, 2021, and became effective on May 28, 2021.

Panama's data protection framework, established by Law No. 81 on Personal Data Protection 2019 and Executive Order 285/2021, defines its scope through both material and territorial applicability factors.

Material Applicability

The law's material scope is defined by the following factors:

• Automated Means Criterion
• Personal and Domestic Use Exemption
• National Security and Law Enforcement Exemption
• Judicial Proceedings Exemption
• Government and Public Agency Exemption
• Central Bank and Financial Institutions Exclusion
• Sectoral Exceptions

Automated Means Criterion

Executive Order 285/2021 Art.2(4):

"The data processing carried out in the context of a commercial activity - by Internet or any other means of electronic or digital communication, in accordance with Law 51 of 2008, to guarantee the protection of personal data in activities aimed at the Panamanian market."

The law applies to data processing through automated means, specifically targeting commercial activities conducted via electronic or digital communications.

Personal and Domestic Use Exemption

Law No. 81 Art.3(1):

"Excluded from the scope of this Law are those treatments expressly regulated by special laws or by the regulations that develop them, in addition to the following personal data treatments: 1. Those carried out by a natural person for exclusively personal or domestic activities."

This exemption excludes purely personal or domestic data processing activities from the law's scope.

Law Enforcement and National Security Exemption

Law No. 81 Art.3(2-3):

"2. Those carried out by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.

3. Those carried out for the analysis of financial intelligence and related to national security in accordance with the laws, treaties or international agreements that regulate these matters."

Territorial Applicability

The territorial scope is determined by:

• Processing in Jurisdiction
• Location of Individual who Processes Data
• Offering Goods and Services to Data Subjects
• Use of Equipment Within Jurisdiction

Processing in Jurisdiction

Law No. 81 Art.5:

"Databases located in the territory of the Republic of Panama, storing or containing personal data of nationals or foreigners, or if the data controller is domiciled in the country, are subject to the rules established in this Law or its regulations."

Offering Goods and Services

Executive Order 285/2021 Art.2(4):

"The data processing carried out in the context of a commercial activity [...] in activities aimed at the Panamanian market."