Is a lender, in Nicaragua

Ley No. 787, arts. 14-15 (cross border transfer of data) · Read the law's page

• Before transferring personal data outside Nicaragua, confirm the receiving country or organization provides an adequate level of security and protection, or that the transfer fits one of the law's listed exceptions, such as international judicial cooperation, a health data exchange for epidemiological investigation, a banking or securities transfer, a ratified treaty commitment, or intelligence cooperation against organized crime or drug trafficking.
• Before making the transfer, verify that both you and the recipient meet the applicable security and confidentiality measures, inform the data subject of the request and its purpose for their consent, prevent the data from reaching a third party, and notify the Direccion de Proteccion de Datos Personales of the transfer you made.

Ley No. 787, arts. 3(g), 7(l), 8 (sensitive categories of data) · Read the law's page

• Process sensitive personal data (racial or ethnic origin, political affiliation, religious or philosophical belief, union membership, health or sex life, criminal record, or financial and credit information) only on a general-interest ground recognized by law, the data subject's consent, or a judicial order.
• Do not create a data file that stores sensitive personal data except as this Act provides, even though a commercial company or nonprofit association may still keep a file of its own members' data.
• Process a person's criminal record or administrative infraction data only if you are a competent public authority acting within your own powers.
• Where you are a hospital, clinic, health center, or health professional, limit the health data you process to a patient's physical or mental health information, and process it under professional secrecy.
• Disclose a company's commercial data about its customers, suppliers, or human resources only with the data subject's consent, under an express law of social interest, or by judicial order.
• Do not compel a data subject to supply their sensitive personal data, except where this Act's own exceptions apply.

Norma sobre Gestión de Riesgo Tecnológico, Resolución CD-SIBOIF-500-1-SEP19-2007, art. 42 · Read the law's page

• This binds the banks and the non-bank financial institutions subject to the authorization, supervision and oversight of the Superintendencia de Bancos y de Otras Instituciones Financieras, to the extent that the norm applies to them (reached by declaring that you provide financial services).
• Inform the Superintendent formally and immediately of a successful external attack on, or penetration of, your systems through network and communication services, and within the following 24 hours send the detail of the result and the actions taken to correct it (article 42(a)).
• Inform the Superintendent immediately of the activation of your information technology contingency plans or recovery strategies, and of an interruption of your main operating systems and application software that affects service to clients, and within the following 24 hours send the result and the corrective actions (article 42(b) and (c)).
• Inform the Superintendent immediately of a formal decision to change your central operating platform or the technology platform you use to provide financial services by electronic means (article 42(d) and (e)).

Norma sobre Gestión de Riesgo Tecnológico, Resolución CD-SIBOIF-500-1-SEP19-2007, arts. 2 y 3 · Read the law's page

• This binds the banks and the non-bank financial institutions subject to the authorization, supervision and oversight of the Superintendencia de Bancos y de Otras Instituciones Financieras, to the extent that the norm applies to them (reached by declaring that you provide financial services).
• Apply the norm's minimum criteria to the management of the risks, the security, the use and the controls of your information technology (article 2).