PanamaLey 81 de 2019, personal data breach notification
Ley 81 de 2019, arts. 2(5) and 26 (duty to notify security breaches)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- Notify the affected data subject as soon as possible after learning that their personal data was stolen without authorization or that its security was otherwise compromised. This Law sets no fixed number of hours or days for that notice and no duty to notify ANTAI of the breach.
- As an operator of a public communications network, tell affected data subjects about a particular breach of your network's security and the measures you are taking, again with no fixed period stated.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 2(5) requires the responsible party to inform the data subject as soon as possible of a breach, and article 26 requires a public communications network operator to tell affected data subjects of a network security breach and the measures taken. Both are notices to the data subject; neither requires the breach to be documented or a register of breaches to be kept, and neither names a check on one.
- Kind
- None
- As of
What this law does
Article 2(5), among the Law's general principles, requires a responsible party to inform the data subject as soon as possible when their personal data has been stolen without authorization or there is sufficient indication that its security has been compromised, alongside the technical and organizational measures the same principle requires to protect data under the responsible party's custody.
The Law fixes no number of hours or days for that notice, and states no parallel duty to notify the Autoridad Nacional de Transparencia y Acceso a la Información of a breach. Article 26 carries a sector specific duty for an operator of a public communications network, requiring it to tell affected data subjects about a particular breach of its network's security and the measures it is taking, again with no fixed period and no notice to a supervisory authority stated.
When LexLint raises it
When your app profile says your app provides telecom services or processes personal data.
Back to the example · Lint your app
Page updated .