PanamaLey 81 de 2019, cross border transfer of personal data
Ley 81 de 2019, arts. 5 and 33 (cross border transfer of personal data)
In force since .
A cross border transfer rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Before storing or transferring personal data domiciled in Panama across a border, confirm you meet this Law's data protection standards, or standards equal to or higher than them, unless the data subject consented, a contract requires it, it is a banking or securities transfer, or a ratified international treaty compels it.NIST Privacy FrameworkCT.PO-P2
- Before an international transfer of personal data, confirm at least one lawful ground applies, among them the data subject's consent, an equivalent or superior protection level in the receiving country, a ratified treaty, medical necessity, transfer within the same corporate group, a contract, a public interest or legal defense need, judicial cooperation, a banking or securities transaction, international intelligence cooperation, a binding self-regulation mechanism, or contractual clauses meeting this Law's protections.NIST Privacy FrameworkCT.PO-P2
- Remain responsible, as the party transferring or receiving personal data internationally, for the lawfulness of the processing you send or take in.NIST Privacy FrameworkGV.PO-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P4Privacy roles and responsibilities are coordinated and aligned with third-party stakeholders (e.g., service providers, customers, partners).
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 5 lets confidential, sensitive or restricted data receive cross-border treatment where the responsible party meets the Law's standards or can demonstrate equal or higher ones, and a party relying on the second route can show it only from documentation it keeps. The article names no log, register or period, and article 33 lists the lawful transfer conditions without a record duty. The first paragraph reaches databases located in Panama; a prong that turns on where the database sits has no hook value, so only the domicile of the responsible party is recorded. The register of transfers in Article 31 sits in an article the row does not cite.
- Kind
- Implicit
- As of
- Provision
- Article 5, second paragraph
- Trigger
- personal_data_processing
What this law does
Article 5 subjects a database located in Panama, or whose responsible party is domiciled there, to this Law, and permits storing or transferring confidential, sensitive or restricted data with cross border treatment only where the responsible party meets this Law's data protection standards or standards equal to or higher than it, unless the data subject consented, a contract requires the transfer, it is a banking, monetary or securities transfer, or an international treaty Panama has ratified compels it.
Article 33 makes an international transfer of personal data lawful if at least one of thirteen listed conditions is met, among them the data subject's consent, the receiving country or organization providing an equivalent or superior level of protection, a treaty or law to which Panama is party, medical necessity, transfer within the same corporate group, a contract in the data subject's unequivocal interest, a public interest or legal defense need, judicial cooperation, a banking or securities transaction, international intelligence cooperation against organized crime, a binding self-regulation mechanism, or contractual clauses that meet this Law's protections, and holds both the transferring party and the recipient responsible for the lawfulness of the processing transferred.
When LexLint raises it
When your app profile says your app ships a mobile app, distributes a software product or processes personal data.
Back to the example · Lint your app
Page updated .