Skip to content
World Watch

Cybersecurity law & regulation in Dominican Republic (2026)

Cybersecurity in Dominican Republic: sectoral rules.

The Dominican Republic has no comprehensive, in-force cybersecurity statute; obligations arise from a combination of executive decrees, a national strategy, the high-tech crime law, and a sector-specific financial regulation. A dedicated Cybersecurity Management Law was approved in first reading in the Senate (April 2024) but, as of 2025, remains under study and is not yet enacted. Mandatory incident-reporting duties currently apply to public-administration entities (via decree) and to regulated financial institutions (via the Monetary Authority's regulation).

Last verified Official sources first · MethodologyCompare Dominican Republic with other countries

Legal framework

Patchwork led by Decree 230-18/313-22 (National Cybersecurity Strategy & National Cybersecurity Center-CNCS, CSIRT-RD), Decree 685-22 (mandatory incident notification for public entities), Law 53-07 (high-tech crimes), and the Monetary Authority's Cybersecurity and Information Security Regulation for the financial sector. A comprehensive 'Ley de Gestión de la Ciberseguridad' bill remains pending in Congress.

Key points: cybersecurity in Dominican Republic

  1. No comprehensive law yet, bill pending

    A 'Proyecto de Ley sobre Gestión de la Ciberseguridad' was approved in first reading by the Senate in April 2024 and would create a statutory National Cybersecurity Center covering public administration and critical infrastructure, but it remained under committee study in September 2025 and is not in force.

    senadord.gob.do senadord.gob.do

  2. National strategy & CNCS created by decree

    Decree 230-18 adopted the first National Cybersecurity Strategy and created the National Cybersecurity Center (CNCS) under the Ministry of the Presidency; Decree 313-22 updated and extended the strategy to 2030. The framework is executive/policy-based rather than a comprehensive statute.

    cncs.gob.do cncs.gob.do

  3. Public-sector incident reporting, 24-hour duty

    Decree 685-22 (Dec 2022) requires public-administration entities to report cybersecurity incidents in their technological infrastructure to the CSIRT-RD/CNCS within 24 hours of detection, and to notify affected individuals when data is compromised.

    presidencia.gob.do cncs.gob.do

  4. Financial-sector cyber regulation

    Since 2018 the Monetary Authority (Central Bank + Superintendency of Banks) imposes a binding 'Reglamento de Seguridad Cibernética y de la Información' on financial-intermediation entities, including risk management and incident notification to the payment-system response center (SPRICS).

    sb.gob.do cncs.gob.do

  5. Cybercrime criminalization

    Law 53-07 on High-Technology Crimes and Offenses (2007) criminalizes unauthorized system access, electronic fraud, and related conduct, providing the country's core penal framework for cyber offenses, distinct from operational cybersecurity obligations.

    oas.org

  6. National CSIRT operational

    The CSIRT-RD, housed within the CNCS, handles incident response for the State's critical and IT infrastructure, runs a security operations/monitoring function, and operates platforms for incident reporting and vulnerability disclosure.

    cncs.gob.do ipandetec.org

Timeline of decisions

  1. Decision · official
    Dominican Republic Launches First Public-Private Cybercrime Partnership Alliance

    The Dominican Republic inaugurated its first formal public-private partnership alliance on cybercrime, bringing together government agencies, the private sector and international bodies including UNODC to share threat intelligence and strengthen victim-support mechanisms for online offences.

    UNODC

  2. Decision · official
    2025-2027 National Cybersecurity Action Plan Launched

    The CTEC and CNCS approved a new biennial action plan under the National Cybersecurity Strategy 2030, setting specific targets for capacity building, sectoral awareness campaigns, and incident-response protocols. It is the second implementation cycle following the 2022-2024 plan.

    Centro Nacional de Ciberseguridad (CNCS)

  3. Decision · official
    Decree 612-24 Reorganizes Cybersecurity Governance; Creates CTEC and National Cryptographic Institute

    President Abinader signed Decree 612-24, creating the Specialized Technical Commission on Cybersecurity (CTEC) under the National Security and Defense Council, transferring CSIRT-RD and the Strategy Coordination Team to the National Intelligence Directorate (DNI), and establishing a new National Cryptographic Institute (ICN).

    Presidencia de la República Dominicana

  4. Law · official
    Electricity Regulator SIE Issues Cybersecurity Regulation for National Grid (SIE-077-2024)

    After a public consultation, the Superintendencia de Electricidad published Resolution SIE-077-2024-ADM requiring all national electrical-system agents (generators, transmitters, distributors) to adopt cybersecurity management programs, with implementation entering force in early 2025.

    Superintendencia de Electricidad (SIE)

  5. Law · official
    Dominican Republic Signs Second Additional Protocol to the Budapest Convention

    The Dominican Republic signed the Second Additional Protocol to the Convention on Cybercrime, enabling direct cross-border cooperation with foreign service providers and real-time subscriber-data sharing for cybercrime investigations. This built on the country's landmark 2013 ratification of the Budapest Convention itself.

    Council of Europe – Octopus Cybercrime Community

  6. Decision · official
    Decree 313-22 Adopts National Cybersecurity Strategy 2030

    President Abinader issued Decree 313-22 adopting the National Cybersecurity Strategy 2030 and its accompanying Action Plan 2022–2024, coordinated by the National Cybersecurity Center. The strategy establishes a whole-of-society framework to protect critical information infrastructure and mandates public-private coordination through 2030.

    UNIDIR Cyber Policy Portal

  7. Law
    Decree 313-22: National Cybersecurity Strategy 2030 Enacted

    President Abinader issued Decree 313-22 establishing a new National Cybersecurity Strategy effective through 31 December 2030, replacing the 2018 Decree 230-18. The strategy sets the security baseline for digital infrastructure on which AI systems rely and is a prerequisite for safe AI deployment in the public sector.

    National Cyber Security Index (NCSI / e-Governance Academy)

  8. Decision · official
    Decree 313-22: National Cybersecurity Strategy 2030 Adopted

    Decree 313-22 superseded the 2018-2021 strategy, extending the CNCS mandate to 31 December 2030 and establishing a rolling Action Plan (first cycle 2022-2024) with six objectives covering critical infrastructure protection, cybercrime capacity, and sectoral regulation.

    Presidencia de la República Dominicana

  9. Decision · official
    INDOTEL Resolution 126-21: Binding Cybersecurity Rules for Internet Service Providers

    The INDOTEL Board issued Resolution 126-21 imposing cybersecurity obligations on all licensed internet service providers, including establishment of an independent Cybersecurity Committee, defined organisational structures with dedicated capability, and incident-reporting requirements.

    Instituto Dominicano de las Telecomunicaciones (INDOTEL)

  10. Decision · official
    Decree 230-18: First National Cybersecurity Strategy (2018-2021) and CNCS Established

    President Medina signed Decree 230-18, launching the first National Cybersecurity Strategy with four pillars, legal/institutional strengthening, critical-infrastructure protection, cybersecurity culture, and international alliances, and creating the National Cybersecurity Center (CNCS) as the coordinating authority.

    Presidencia de la República Dominicana

  11. Decision · official
    Dominican Republic Becomes First Latin American Country to Ratify the Budapest Convention on Cybercrime

    The Dominican Republic deposited its instrument of accession to the Council of Europe's Budapest Convention, becoming the first nation in Latin America and the Caribbean to ratify the treaty, strengthening mutual legal assistance and cross-border cybercrime prosecution capacity.

    Council of Europe – Cybercrime Division

  12. Decision · official
    PEDATEC Specialized Cyber-Prosecution Unit Established Within the Attorney General's Office

    The Procuraduría Especializada en Crímenes y Delitos de Alta Tecnología (PEDATEC) was created to investigate and prosecute high-technology crimes — including unauthorized data access and data theft — under Law 53-07, providing practical enforcement capacity for digital personal-data violations.

    Council of Europe Octopus Cybercrime Community

  13. Law · official
    Law No. 53-07 on High Technology Crimes Enacted

    Law 53-07 criminalised unauthorised system access, data interception, computer fraud, cyberviolence, and child online exploitation, one of the first standalone cybercrime statutes in Latin America, drafted in alignment with the Budapest Convention even before formal ratification, and creating specialist enforcement units DICAT and DIDI.

    Ministerio de Interior y Policía

  14. Law · official
    Law 53-07 on High Technology Crimes Enters Into Force

    Law 53-07 became the Dominican Republic's principal cybercrime statute, criminalising illegal system access, data interception and alteration, identity theft, electronic fraud, online child sexual abuse material and telecommunications sabotage, with custodial sentences up to seven years. It also created the Inter-Institutional Commission against High Technology Crimes (CICDAT) and provided the legal basis for the specialist DICAT police unit and the PEDATEC cyber-prosecution service.

    WIPO Lex

  15. Law · official
    Law No. 53-07 on High Technology Crimes Enters Into Force

    The cybercrime law criminalised unauthorised system access, data interception, identity theft, and electronic fraud, providing the first criminal-law protection layer for digital personal data and aligning the Dominican Republic with the Budapest Convention's substantive standards.

    WIPO Lex

  16. Law
    Law 53-07 on High Technology Crimes Enacted

    The Dominican Republic enacted Law No. 53-07, establishing the first criminal liability regime for cybercrime and high-technology offences. It provided the foundational legislative tools for prosecuting digital abuses and laid the groundwork for cybersecurity regulation relevant to malicious or harmful AI applications.

    Lexology / H&A Attorneys

Sources

  1. cncs.gob.do/sobre-nosotros/leyes/
  2. cncs.gob.do/wp-content/uploads/2020/02/Decreto-230-18.pdf
  3. cncs.gob.do/wp-content/uploads/2022/12/Decreto-685-22.pdf
  4. presidencia.gob.do/noticias/gobierno-dispone-instituciones-publicas-notificar-al-centro-
  5. senadord.gob.do/senado-aprueba-en-primera-lectura-proyecto-de-ley-sobre-gestion-de-la
  6. senadord.gob.do/comision-de-transporte-y-telecomunicaciones-avanza-en-estudio-proyect
  7. sb.gob.do/regulacion/reglamentos/reglamento-de-seguridad-cibernetica-y-de-la-in
  8. oas.org/juridico/PDFs/repdom_ley5307.pdf
  9. cncs.gob.do/csirt-rd/
  10. cncs.gob.do/wp-content/uploads/2022/12/Reglamento-de-Seguridad-Cibernetica-y-de-l
  11. ipandetec.org/ciberseguridad/gestion-de-riesgos-notificacion-de-incidentes-de-ciber

Next for Dominican Republic: Starting a BusinessModerate

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 25 May 2026. Methodology & how to cite · State of Technology Regulation 2026