Panama's data protection law, Law No. 81 on Personal Data Protection 2019, and its implementing regulation, Executive Order 285/2021, establish the applicability of the law based on the location of databases and the domicile of data controllers.

The law applies in two main scenarios:

1. When databases are located within Panama's territory, regardless of the nationality of the data subjects. This is evident from the phrase "Databases located in the territory of the Republic of Panama, storing or containing personal data of nationals or foreigners" in Law No. 81 Art.5(1).
2. When the data controller is domiciled in Panama, as stated in the same article: "if the data controller is domiciled in the country".

Executive Order 285/2021 Art.2(3) further clarifies that the law applies to "treatments data whose origin or storage is the territory of the Republic of Panama". This provision expands the scope to include not only data storage but also data originating from Panama.

It's important to note that while these provisions relate to the use of equipment within the jurisdiction, they do not explicitly mention "equipment" or "processing". Instead, they focus on the location of databases and the origin of data. This approach differs from some other jurisdictions that specifically mention the use of equipment for processing.

Implications

The implications of these provisions for businesses are significant:

1. Companies storing personal data in databases located in Panama must comply with the law, regardless of where the company itself is based or the nationality of the data subjects.
2. Data controllers domiciled in Panama must comply with the law for all their data processing activities, even if the data is stored outside the country.
3. Businesses that collect or generate data within Panama's territory may be subject to the law, even if the data is subsequently transferred out of the country.
4. International companies without a physical presence in Panama may still be subject to the law if they use databases or equipment located in Panama for data processing.
5. Companies must be aware of the physical location of their data storage and processing facilities, as well as the origin of the data they handle, to determine whether Panama's data protection law applies to their operations.