Processes personal data, in Nicaragua

Ley No. 787, 29-Mar-2012, Gaceta Oficial No. 61, arts. 1-6, 9, 11-13, 19, 22-24, 27 · Read the law's page

• Before processing personal data, obtain the data subject's consent, unless a listed exception applies.
• Process personal data only to the extent adequate, proportional, and necessary for the stated purpose, and adopt technical and organizational security measures against unauthorized access, use, alteration, loss, disclosure, transfer, or dissemination.
• Keep personal data confidential under a duty of professional secrecy that survives the end of your relationship with the data controller, releasable only by judicial order for reasons of national security, national defense, public security, or public health.
• Register with the data file register the Direccion de Proteccion de Datos Personales keeps before operating a data file, and wait for its registration decision within thirty days.
• Do not retain personal data for longer than five years, or the term your contract with the data subject sets, once the data are no longer adequate, proportional, or necessary for their purpose.
• Assign or transfer personal data domestically only for a purpose directly related to your legitimate interest and that of the recipient, and only with the data subject's prior, informed, and revocable consent, unless a listed exception applies.

Ley No. 787, art. 11 (security incident notice to the affected institution) · Read the law's page

• Where the personal data affected belong to a member of the National Police or the Army of Nicaragua, and the security measures the law requires fail or are not observed, immediately inform the affected institution of the breach.

Ley No. 787, arts. 14-15 (cross border transfer of data) · Read the law's page

• Before transferring personal data outside Nicaragua, confirm the receiving country or organization provides an adequate level of security and protection, or that the transfer fits one of the law's listed exceptions, such as international judicial cooperation, a health data exchange for epidemiological investigation, a banking or securities transfer, a ratified treaty commitment, or intelligence cooperation against organized crime or drug trafficking.
• Before making the transfer, verify that both you and the recipient meet the applicable security and confidentiality measures, inform the data subject of the request and its purpose for their consent, prevent the data from reaching a third party, and notify the Direccion de Proteccion de Datos Personales of the transfer you made.

Ley No. 787, arts. 28-29, 34-35, 44-52 (supervision, sanctions, and complaints) · Read the law's page

• Expect the Direccion de Proteccion de Datos Personales to advise, issue rules, request information, and impose administrative sanctions on you for a violation of this Act, and to accredit inspectors to verify your compliance.
• Cooperate with an accredited inspector's visit by allowing access to your data files, supplying the requested information and documents, including your registration and security measures, and allowing your equipment to be reviewed.
• Expect a warning or suspension of your processing operations for a minor infraction, such as processing without the required consent or failing to act on a data subject's request, and expect closure or cancellation of the data file, temporary or permanent, for a serious infraction, such as processing by fraudulent means, breaching professional secrecy, or keeping a file without the required security conditions.
• Expect a data subject to be able to bring an administrative protection action before the Direccion de Proteccion de Datos Personales and, once that route is exhausted, a constitutional amparo action before the courts.

Ley No. 787, arts. 3(g), 7(l), 8 (sensitive categories of data) · Read the law's page

• Process sensitive personal data (racial or ethnic origin, political affiliation, religious or philosophical belief, union membership, health or sex life, criminal record, or financial and credit information) only on a general-interest ground recognized by law, the data subject's consent, or a judicial order.
• Do not create a data file that stores sensitive personal data except as this Act provides, even though a commercial company or nonprofit association may still keep a file of its own members' data.
• Process a person's criminal record or administrative infraction data only if you are a competent public authority acting within your own powers.
• Where you are a hospital, clinic, health center, or health professional, limit the health data you process to a patient's physical or mental health information, and process it under professional secrecy.
• Disclose a company's commercial data about its customers, suppliers, or human resources only with the data subject's consent, under an express law of social interest, or by judicial order.
• Do not compel a data subject to supply their sensitive personal data, except where this Act's own exceptions apply.

Ley No. 787, arts. 7, 10, 16-21, 25-26 (rights of data subjects) · Read the law's page

• Before obtaining a data subject's personal data, tell them, expressly and clearly, the purpose and possible recipients, the existence and location of the file and who is responsible for it, whether answering is mandatory or optional, the consequences of refusing or of giving inaccurate data, and their rights of access, rectification, and cancellation.
• On a data subject's request, suppress and cancel their personal data from a social network, browser, or server, and, once your contractual relationship with them ends, suppress and cancel the personal data you collected during it.
• Tell a data subject about the privacy policies you adopt and notify them of any change to those policies.
• Answer a data subject's request for information about their personal data within ten business days, in writing, electronically, by phone, by image, or by another means they choose, clearly and covering the whole of their own data without revealing a third party's.
• Rectify, modify, suppress, complement, include, update, or cancel a data subject's personal data on request within five business days, notify any assignee of the correction within five business days, block the disputed data while you verify a claimed error, and do this free of charge; you may refuse only where a judicial decision orders you not to modify the data, and you must then tell the data subject of that decision.
• Include personal data in a file built for advertising, promotions, offers, or direct sale only with the data subject's consent or from a publicly accessible source, give the data subject free access to it, and let them request removal from it at any time.
• Do not send electronic advertising to a person who has expressly stated they do not want to receive it, offer every recipient of an electronic advertisement the means to refuse further advertising or revoke consent, and keep a contract proving the personal data you use for marketing were obtained with consent or from a public access source.