Panama's data protection framework, established by Law No. 81 on Personal Data Protection 2019 and Executive Order 285/2021, defines its scope through both material and territorial applicability factors.

Material Applicability

The law's material scope is defined by the following factors:

• Automated Means Criterion
• Personal and Domestic Use Exemption
• National Security and Law Enforcement Exemption
• Judicial Proceedings Exemption
• Government and Public Agency Exemption
• Central Bank and Financial Institutions Exclusion
• Sectoral Exceptions

Automated Means Criterion

Executive Order 285/2021 Art.2(4):

"The data processing carried out in the context of a commercial activity - by Internet or any other means of electronic or digital communication, in accordance with Law 51 of 2008, to guarantee the protection of personal data in activities aimed at the Panamanian market."

The law applies to data processing through automated means, specifically targeting commercial activities conducted via electronic or digital communications.

Personal and Domestic Use Exemption

Law No. 81 Art.3(1):

"Excluded from the scope of this Law are those treatments expressly regulated by special laws or by the regulations that develop them, in addition to the following personal data treatments: 1. Those carried out by a natural person for exclusively personal or domestic activities."

This exemption excludes purely personal or domestic data processing activities from the law's scope.

Law Enforcement and National Security Exemption

Law No. 81 Art.3(2-3):

"2. Those carried out by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. 3. Those carried out for the analysis of financial intelligence and related to national security in accordance with the laws, treaties or international agreements that regulate these matters."

Territorial Applicability

The territorial scope is determined by:

• Processing in Jurisdiction
• Location of Individual who Processes Data
• Offering Goods and Services to Data Subjects
• Use of Equipment Within Jurisdiction

Processing in Jurisdiction

Law No. 81 Art.5:

"Databases located in the territory of the Republic of Panama, storing or containing personal data of nationals or foreigners, or if the data controller is domiciled in the country, are subject to the rules established in this Law or its regulations."

Offering Goods and Services

Executive Order 285/2021 Art.2(4):

"The data processing carried out in the context of a commercial activity [...] in activities aimed at the Panamanian market."