Data protection & privacy law in Dominican Republic (2026)
Data protection in Dominican Republic: comprehensive law.
The Dominican Republic has an in-force, general data-protection statute, Law No. 172-13 (2013), built on a constitutional habeas data right (Art. 70), establishing data-subject rights, processing principles, and consent rules applicable to any public or private person processing personal data. However, the law has notable gaps: it does not create an independent, cross-sectoral supervisory authority, and a large share of its provisions is devoted specifically to credit-information companies (SIC), whose oversight falls to the Superintendency of Banks. Legal commentators and authorities widely acknowledge the need to modernize and align the regime with the GDPR and Ibero-American standards, and reform discussions remain ongoing as of 2026, but no replacement law has been enacted.
Legal framework
Law No. 172-13 on the Comprehensive Protection of Personal Data (Ley No. 172-13 sobre Protección Integral de los Datos Personales), enacted 13 December 2013. No dedicated, independent data-protection authority exists; the Superintendency of Banks (Superintendencia de Bancos) supervises credit bureaus.
Key points: data & privacy in Dominican Republic
Comprehensive law in force
Law No. 172-13, promulgated 13 December 2013, is a general statute on the 'comprehensive protection of personal data' contained in public or private files, registries and databases. It applies to any natural or legal person, public or private, engaged in processing personal data.
Constitutional foundation (habeas data)
The regime rests on Article 70 of the 2010 Constitution, which guarantees the right to habeas data, allowing individuals to access, correct, update or delete their personal data held in registries or databases.
No independent supervisory authority
Unlike GDPR-style regimes, there is no dedicated, independent national data-protection authority overseeing private-sector processing generally. This is a recognized structural gap in the framework.
Sectoral enforcement: credit bureaus & consumers
A large portion of Law 172-13 regulates credit-information companies (SIC), whose constitution and operation are supervised by the Superintendency of Banks, which sanctions data infringements by credit bureaus. Pro Consumidor (consumer-protection agency) handles data-protection compliance in consumer matters.
Core data-subject rights and consent
The law grants rights of access, rectification, deletion/cancellation and objection, and conditions processing on prior, informed consent (written/express consent for credit reports), with heightened protection for sensitive data.
Reform and modernization pending
Authorities and practitioners acknowledge the need to modernize Law 172-13 to align with the EU GDPR and Ibero-American standards and to create an independent authority; reform discussions/draft proposals were ongoing as of 2026 but no new law has been enacted. Separately, the new Penal Code (entering into force August 2026) adds offenses for misuse of personal data, including corporate criminal liability.
Timeline of decisions
- Law · officialNew Penal Code (Law 74-25, amended by Law 44-26) Enters Into Force with Criminal Personal-Data Offenses
Organic Law 74-25 took effect, replacing the 1884 Penal Code; Article 198 makes it a criminal offence to collect, store, or disclose personal data without prior consent. Corporate criminal liability under the code is deferred to November 5, 2026.
Presidencia de la República Dominicana
- LawLaw No. 44-26 Amends 27 Articles of the New Penal Code Days Before Its Entry Into Force
Congress amended 27 articles of the newly enacted Penal Code — including provisions on privacy offences, freedom of expression, and corporate data liability — to ensure constitutional alignment before the code took effect on August 5.
PHLaw (analysis of official text)
- DecisionConstitutional Court Ruling TC/0484/16: Core of Law 172-13 Upheld, Intelligence-Data Restriction Struck Down
The Tribunal Constitucional validated Articles 5.6c), 8, and 29 of Law 172-13 but struck down the article barring citizens from accessing intelligence-agency databases as unconstitutional, affirming that no personal data may be withheld from a data subject without explicit constitutional justification.
Fundación Microfinanzas BBVA (analysis of TC/0484/16)
- Law · officialLaw 172-13 on Protection of Personal Data Enacted
The Dominican Congress enacted Law 172-13, the country's comprehensive personal-data protection statute, granting data subjects rights of access, rectification and deletion and imposing obligations of legality, purpose limitation and security on public and private data controllers. It is the primary domestic framework governing online data processing and underpins all subsequent data-protection guidance.
Cámara de Diputados de la República Dominicana
- Law · officialLaw 172-13: Personal Data Protection Act
Law 172-13 established comprehensive data-privacy rules governing collection, storage, processing, and transfer of personal data in public and private databases — providing the baseline legal protection framework that fintech firms and digital payment platforms must comply with when handling customer financial data.
Oficina Nacional de Estadística — official text of Law 172-13
- LawLaw 172-13 on Personal Data Protection Enacted
Congress enacted Law No. 172-13, the Dominican Republic's primary data-protection statute implementing Article 44 of the Constitution. It governs collection, storage, use, and disclosure of personal data and establishes rights of access, rectification, and deletion — the principal privacy framework directly applicable to AI-driven data processing, though widely considered outdated for modern AI use cases.
DLA Piper — Data Protection Laws of the World
- Law · officialLaw No. 172-13 on Comprehensive Protection of Personal Data Enacted
The primary data-protection statute — published in Official Gazette No. 10737 on 15 December 2013 — repealed Law 288-05, enshrined ARCO rights (access, rectification, cancellation, objection), codified the habeas data judicial action, mandated security safeguards, and set fines of 10–100× the minimum wage with INDOTEL as the principal supervisory authority.
Presidencia de la República Dominicana
- Law · officialLaw No. 172-13: Personal Data Protection Law Enacted
Law 172-13 established the Dominican Republic's first comprehensive data-protection framework, requiring controllers to adopt technical security measures and granting data subjects rights to access, rectify, and delete personal data; the Ombudsman and Superintendent of Banks serve as enforcement bodies.
Portal Oficial del Estado Dominicano
- Law · official2010 Dominican Constitution: Articles 44 and 70 Constitutionalize Privacy and Habeas Data
The promulgated Constitution formally recognized the right to privacy (Article 44) and the habeas data judicial action (Article 70) as fundamental rights, requiring personal data processing to respect the principles of legality, quality, loyalty, security, and purpose — forming the constitutional foundation for Law 172-13.
Organization of American States (OAS)
- Decision · officialINDOTEL Resolution No. 055-06: Telecom-Sector Personal Data Processing Framework
The National Telecommunications Institute established sector-specific data protection rules for telecoms and electronic-signature providers, requiring transparency, prior consent, and security safeguards — with INDOTEL empowered to inspect and sanction non-compliant entities, a supervisory role later codified under Law 172-13.
INDOTEL
Sources
- sb.gob.do/regulacion/leyes/ley-no-172-13-proteccion-de-los-datos/
- tribunalconstitucional.gob.do/transparencia/marco-legal/leyes/ley-172-13/
- dlapiperdataprotection.com/?t=law&c=DO
- dlapiperdataprotection.com/index.html?t=authority&c=DO
- redipd.org/documentos/la-legislacion-dominicana-sobre-proteccion-de-datos-person
Next for Dominican Republic: Digital Payments & FintechPartial
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 25 May 2026. Methodology & how to cite · State of Technology Regulation 2026