Is a payment provider, in the Dominican Republic

Ley No. 172-13, Gaceta Oficial No. 10737, 15 de diciembre de 2013, arts. 1-6, 27-28, 42-43, 60 y 63 · Read the law's page

• Obtain the data subject's free, express, and conscious consent before processing or transferring their personal data, unless the law lists an exception.
• Adopt the technical, organizational, and security measures necessary to prevent the alteration, loss, or unauthorized access of personal data, and maintain adequate information policies with security and control measures for every archive, registry, or databank you keep.
• Keep personal data confidential under a duty of professional secrecy that continues after your relationship with the data subject or the data controller ends, unless a court relieves you of it for reasons of public security, national defense, or public health.
• Register as a Sociedad de Información Crediticia with the Superintendencia de Bancos, after securing the Junta Monetaria's authorization, before operating as a credit reporting bureau.for a financial business
• As a Sociedad de Información Crediticia, use biometric identification techniques, such as comparing a consumer's photograph, to verify identity and make identity theft difficult when supplying a credit report, and protect the algorithms and technologies you use for that service under the strictest security and confidentiality.when it serves a financial business

Ley No. 172-13, art. 80 (cross border transfer of data) · Read the law's page

• Before transferring personal data outside the Dominican Republic, obtain the data subject's free authorization or rely on one of the law's nine specific statutory grounds for the transfer.
• Confirm a cross border transfer made without the data subject's consent fits one of the law's enumerated grounds, such as medical treatment or epidemiological research, a banking or securities transaction, an international treaty or free trade agreement commitment, intelligence cooperation against organized crime or terrorism, contractual necessity, a legal requirement to safeguard the public interest or a judicial proceeding, international judicial assistance, or a request from an international organization acting on a public register.

Ley No. 172-13, arts. 29, 81-88 (supervision, administrative sanctions, and offences) · Read the law's page

• Expect the Superintendencia de Bancos to inspect and supervise, and to have power to impose administrative sanctions on, a Sociedad de Información Crediticia for a violation of the law, including a fine of ten to one hundred times the minimum wage or revocation of its operating permit.for a financial business
• Expect correctional imprisonment of six months to two years and a fine of one hundred to one hundred fifty times the minimum wage for violating the law's provisions, without prejudice to the affected person's separate right to recover civil damages for the violation of their privacy right.
• Expect a fine of ten to fifty times the minimum wage for knowingly inserting false data into a file, knowingly supplying false information to a third party, unlawfully accessing a personal databank, or disclosing information you are legally bound to keep secret.
• Expect a fine of ten to fifty times the minimum wage for fraudulently consulting a consumer's personal information without authorization, rising to twenty to one hundred times the minimum wage and correctional imprisonment of six months to two years where the access served to commit an offence.

Ley No. 172-13, arts. 66, 75-79 (special categories of data) · Read the law's page

• Obtain the data subject's free, conscious, and voluntary consent before forming a file, bank, or register that reveals their sensitive data (political opinions, religious or philosophical convictions, union affiliation, or health or sex-life information).
• Do not create a data file, bank, or register that stores sensitive data except as this law provides, even though a church, religious association, clinic, hospital, or political or union organization may still keep a register of its own members.
• Include a person's criminal record data in a file, or communicate it to a public register, only once a court has ordered that person to stand trial, not merely upon accusation.
• As a Sociedad de Información Crediticia, never collect, store, or use in a credit report a consumer's political ideology, religious beliefs, emotional or affective characteristics, or information about their physical or psychological health or sexual conduct, preference, or orientation.when it serves a financial business
• Where you are a health establishment or health professional, process a patient's health data only under the Dominican Republic's health legislation and the duty of professional secrecy, and process data about racial origin, health, or sex life beyond that only where necessary for medical prevention, diagnosis, treatment, or managing health services, and only by someone bound by professional secrecy or an equivalent duty.

Ley No. 172-13, arts. 7-26, 44, 71 (rights of data subjects and habeas data) · Read the law's page

• Answer a data subject's request for access to their personal data within five business days, whether the databank is public or private.
• Correct, update, or suppress inaccurate, incomplete, or outdated personal data on a data subject's request, free of charge, within ten business days of the request or of discovering the error, and notify any recipient the data was disclosed to within five business days of the correction.
• Recognize a data subject's independent rights of access, rectification, cancellation, and opposition, and their right to bring a judicial habeas data action to learn of, access, correct, or suppress personal data, without requiring one right to be exercised before another.
• Give a consumer free access to their credit report from a Sociedad de Información Crediticia up to four times a year, at intervals of at least three months, and deliver a requested credit report within five business days.when it serves a financial business
• Process a consumer's dispute about their credit report information by forwarding it to the data furnisher within ten business days, marking the disputed record Registro Impugnado por Habeas Data until it is resolved, and correcting it within five business days once the dispute is resolved in the consumer's favor.when it serves a financial business
• On request, let a data subject who appears in a public professional directory exclude their data from use for advertising or commercial prospecting purposes.
• Let a data subject request, at any time, that their name be withdrawn or blocked from a databank used for marketing, mailing, advertising, or direct sale.

Reglamento de Seguridad Cibernética y de la Información, Junta Monetaria, Segunda Resolución del 1 de noviembre de 2018 (JM 181101-02), arts. 1, 3, 31, 41, 52, 59 y 60 · Read the law's page

• This binds multiple banks, savings and credit banks, credit corporations, savings and loan associations, public financial intermediation entities, the administrators and participants of the Payment and Securities Settlement System (SIPARD), and the support and related services entities electronically connected to a financial intermediation entity or to SIPARD, a category that includes a software provider (reached by declaring that you provide financial services). Covered entities had one year from the Regulation's entry into force to adjust to it (article 62).
• Implement and maintain a general policy, or several policies, for the management of cybersecurity and information security, and make them known to your staff (article 16).
• Establish policies and procedures for the management of cybersecurity and information-security incidents, so as to identify, respond to, remediate and document them (article 31).
• Set up internal audit processes that ensure effective supervision of your cybersecurity and information security program (article 41).