Dominican RepublicLey No. 172-13 sobre Protección Integral de los Datos Personales
Ley No. 172-13, Gaceta Oficial No. 10737, 15 de diciembre de 2013, arts. 1-6, 27-28, 42-43, 60 y 63
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Security, Governance, Licensing, Biometric
- Audit expectation
- none
What it requires
- Obtain the data subject's free, express, and conscious consent before processing or transferring their personal data, unless the law lists an exception.NIST Privacy FrameworkCT.PO-P1
- Adopt the technical, organizational, and security measures necessary to prevent the alteration, loss, or unauthorized access of personal data, and maintain adequate information policies with security and control measures for every archive, registry, or databank you keep.NIST Privacy FrameworkPR.DS-P5
- Keep personal data confidential under a duty of professional secrecy that continues after your relationship with the data subject or the data controller ends, unless a court relieves you of it for reasons of public security, national defense, or public health.NIST Privacy FrameworkPR.DS-P5
- Register as a Sociedad de Información Crediticia with the Superintendencia de Bancos, after securing the Junta Monetaria's authorization, before operating as a credit reporting bureau.NIST Privacy FrameworkGV.PO-P5
- As a Sociedad de Información Crediticia, use biometric identification techniques, such as comparing a consumer's photograph, to verify identity and make identity theft difficult when supplying a credit report, and protect the algorithms and technologies you use for that service under the strictest security and confidentiality.NIST Privacy FrameworkPR.AC-P6NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks).
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Log retention
The six months run from the day the data subject signed the permission to consult the credit information company, and apply to the users of a credit report, who must obtain and keep it.
- Unit
- Months
- As of
- Basis
- Fixed
- Minimum value
- 6
Logging duty
Principle 4 of Article 5 requires the data subject's free, express and conscious consent to be recorded in writing or by an equivalent means, and requires the financial intermediaries, economic agents and others who contract with a credit information company (SIC) to obtain the data subject's express written permission before asking for a credit report and to obtain and keep that permission for six months from the day the data subject signed it. The duty to keep falls on those users of a credit report; the six months are a period the permissions must be kept, and the text sets no ceiling. Nobody is named to inspect the permissions, so the audit keys are none. Article 3, which this row cites, says the law applies throughout the national territory; that states no establishment, targeting or residence test, so the row names no territorial hook.
- Kind
- Explicit
- As of
- Provision
- Article 5, principle 4 (consent, with the six-month keeping of permissions)
- Trigger
- consent_or_optout
What this law does
Article 1 sets the law's object as the comprehensive protection of personal data held in public or private files, registers, databanks or other technical processing media, and separately regulates the constitution, organization and operation of Sociedades de Información Crediticia (SIC), the credit reporting bureaus.
Article 2 applies the law to personal data recorded in any databank susceptible to processing and to every later use of that data in the public and private spheres alike, and article 4 excludes only a narrow, exhaustive list: data an individual keeps for purely personal or domestic activity, files kept by the Dominican Republic's investigative and intelligence bodies for crime prevention and prosecution, data about deceased persons, and data limited to a professional's name, position, and business contact details.
Article 5 states the law's governing principles: files must be lawful and registered, data must be accurate and kept up to date, a data subject must be told the purpose of the processing and who is responsible for the file before consenting, processing requires the data subject's free, express and conscious consent unless an exception applies, the data controller and processor must adopt technical, organizational and security measures against alteration, loss or unauthorized access, everyone who handles the data owes a duty of professional secrecy that survives the end of their relationship with the data subject or the controller, data may not be collected by fraudulent or unlawful means, and data may only be collected for a determined, explicit and legitimate purpose.
Article 42 requires every archive, registry, or databank, public or private, to maintain adequate information policies guaranteeing security and control measures to prevent the improper handling of data subjects' information. Article 43 requires a Sociedad de Información Crediticia to register with the Superintendencia de Bancos once the Junta Monetaria has authorized it to operate, before it may begin operating as a credit bureau.
Article 60 requires a Sociedad de Información Crediticia to use biometric identification techniques, such as matching a consumer's photograph, to make identity theft difficult when a person contracts goods or services from a public or private entity, and article 63 requires it to adopt the security measures necessary to prevent improper handling of the information and to protect the algorithms and technologies it uses under the strictest security and confidentiality.
When LexLint raises it
When your app profile says your app processes biometric data, provides financial services or processes personal data.
Back to the example · Lint your app
Page updated .