Panama Law on Personal Data Protection (Law No. 81 of 2019)

Per Panama Law 81: restrict international data transfer. Requirements include (a) restrict transfer of personal data to countries that do not provide adequate level of protection except where conditions are met including data subject consent + necessity for contract/legal obligation/vital interests + appropriate safeguards (standard contractual clauses + binding corporate rules + codes of conduct + certification) + (b) document transfer impact assessments where appropriate + (c) maintain inventory of cross-border data flows + recipients + safeguards + (d) implement contractual protections with processors + sub-processors involving international transfer + (e) maintain records for regulator inspection.

• Panama Law 81 evidence for PANAMA-6

• records of processing + ANTAI notification process partial

Per Panama Law 81: implement ARCO rights (Access + Rectification + Cancellation/Erasure + Opposition) plus Portability. Requirements include (a) implement Right of Access enabling data subjects to confirm processing + obtain copy + (b) implement Right of Rectification of inaccurate or incomplete personal data + (c) implement Right of Cancellation/Erasure where lawful basis no longer applies + (d) implement Right of Opposition to processing for legitimate reasons + (e) implement Right of Portability where applicable + (f) maintain mechanism for receiving + verifying + processing + responding to requests within statutory timelines + (g) handle objections including for direct marketing + automated decision-making.

• Panama Law 81 evidence for PANAMA-3

• records of processing + ANTAI notification process partial

Per Panama Law 81 + Executive Decree 285: ANTAI supervision + sanctions + lifecycle. Requirements include (a) cooperate with ANTAI including providing information + facilitating audits + responding to inquiries + (b) understand administrative sanctions and penalties under Law 81 and Executive Decree + (c) implement Retention and Deletion including retention schedules + secure deletion + anonymisation when retention no longer justified + (d) maintain Direct Marketing safeguards including opt-out + opposition + suppression lists + (e) deliver Training and Awareness programme covering Law 81 + privacy + security + breach response across personnel + (f) maintain governance + lifecycle management + continuous improvement.

• Panama Law 81 evidence for PANAMA-8

• records of processing + ANTAI notification process partial

Per Panama Law 81 + Executive Decree 285: accountability + processor management. Requirements include (a) maintain processor obligations + contracts ensuring processors process only on documented instructions + maintain security + assist with rights + breach notification + (b) appoint Data Protection Officer (DPO) or equivalent where required with defined responsibilities + (c) maintain Records of Processing Activities including purposes + categories + recipients + retention + safeguards + cross-border transfers + (d) implement supplier + processor + sub-processor due diligence + ongoing oversight + (e) maintain confidentiality duty across personnel handling personal data + (f) maintain processor audit and review programme.

• Panama Law 81 evidence for PANAMA-7

• records of processing + ANTAI notification process partial

Per Panama Law 81: heightened safeguards for high-risk processing. Requirements include (a) apply higher protection for Sensitive Personal Data including health + biometric + genetic + financial + religious + political + sexual orientation + criminal records + (b) require explicit consent and additional safeguards for sensitive data processing + (c) implement Children's Data protections requiring parental consent for minors per Panamanian age of consent + (d) implement safeguards for Automated Decision-Making and Profiling including human review + explanation + objection rights + (e) maintain DPIA-equivalent risk assessment for high-risk processing + (f) document safeguards + risk assessments + and ongoing review.

• Panama Law 81 evidence for PANAMA-4

• records of processing + ANTAI notification process partial

Per Panama Law 81: establish lawful basis + obtain valid consent + provide notice. Requirements include (a) obtain valid consent that is free + specific + informed + unambiguous + with mechanism for withdrawal + (b) recognise alternative legal bases per the Law including legal obligation + contract performance + vital interests + public interest + legitimate interests where applicable + (c) provide notice/privacy policy to data subjects covering identity of controller + purposes + categories + recipients + retention + rights + transfer + (d) implement special consent for sensitive personal data + (e) maintain records of consent + privacy notices + and processing purposes + (f) maintain change management for consent and notice updates.

• Panama Law 81 evidence for PANAMA-2

• records of processing + ANTAI notification process partial

Per Panama Law 81 of 2019 + Executive Decree 285 of 2021: determine scope + applicability + apply data processing principles. Requirements include (a) apply Law 81 to processing of personal data in Panama or related to data subjects in Panama with extraterritorial reach where data controller or processor is established in Panama + (b) apply key definitions including personal data + sensitive data + data controller + data processor + data subject + (c) apply data processing principles including lawfulness + loyalty + finality (purpose limitation) + proportionality + truthfulness + security + portability + confidentiality + (d) document applicability + classification + (e) maintain records demonstrating principle compliance + (f) align internal definitions and policies with Law 81.

• Panama Law 81 evidence for PANAMA-1

• records of processing + ANTAI notification process partial

Per Panama Law 81: implement appropriate security measures + report breaches. Requirements include (a) implement appropriate technical + organisational security measures appropriate to risk including pseudonymisation + encryption + ongoing confidentiality + integrity + availability + resilience + restoration capability + regular testing + (b) report personal data breaches to ANTAI (Autoridad Nacional de Transparencia y Acceso a la Informacion) within statutory timeline per Executive Decree + (c) notify affected data subjects where high risk + (d) maintain breach log + incident response capability + (e) implement security testing + monitoring + improvement + (f) integrate with broader information security programme.

• Panama Law 81 evidence for PANAMA-5

• records of processing + ANTAI notification process partial