Panama's data protection law, Law No. 81 on Personal Data Protection 2019, establishes its territorial scope based on two main criteria: the location of databases and the domicile of the data controller.

Article 5(1) of Law No. 81 states that the law applies to "databases located in the territory of the Republic of Panama" that store or contain personal data of nationals or foreigners. This provision clearly establishes that the physical location of the database within Panama's territory is a determining factor for the law's applicability.

Additionally, the same article extends the law's scope to situations where "the data controller is domiciled in the country". This means that even if the database is not physically located in Panama, the law still applies if the entity controlling the data is based in Panama.

Executive Order 285/2021, which further clarifies the application of Law No. 81, reinforces this territorial approach. Article 2(3) of the Executive Order states that the law applies to "treatments data whose origin or storage is the territory of the Republic of Panama". This provision expands the scope to include not only data stored in Panama but also data originating from Panama, regardless of where it is subsequently stored or processed.

Implications

The territorial scope of Panama's data protection law has several implications for businesses:

1. Companies storing or processing personal data within Panama's territory must comply with Law No. 81, regardless of their own location or the nationality of the data subjects.
2. Panamanian companies processing personal data are subject to the law, even if they store or process the data outside of Panama.
3. Foreign companies that store or process data originating from Panama may fall under the law's jurisdiction, potentially extending its reach beyond national borders.
4. Businesses operating in Panama or targeting the Panamanian market should carefully assess their data processing activities to determine whether they fall within the law's scope.
5. Companies may need to implement data localization measures or establish local entities to ensure compliance with Panamanian data protection requirements.