Data protection & privacy law in Nicaragua (2026)
Data protection in Nicaragua: comprehensive law.
Nicaragua enacted a comprehensive personal data protection statute, Law No. 787, on 29 March 2012, covering both automated and manual processing of personal data by public and private entities. The law grants data subjects rights of access, rectification, erasure, and objection, and mandates principles of legality, purpose limitation, proportionality, security, and confidentiality. Despite the law being in force for over a decade, the designated supervisory authority (DIPRODAP) has never been formally constituted, leaving the regime effectively unenforced in practice.
Legal framework
Law No. 787, Personal Data Protection Law (2012) and its implementing Decree No. 36-2012; supervisory authority: Directorate for the Protection of Personal Data (DIPRODAP) under the Ministry of Finance and Public Credit (not yet operationally constituted)
Key points: data & privacy in Nicaragua
Primary legislation
Law No. 787 (Ley de Protección de Datos Personales), in force since 29 March 2012, is the main data-protection statute. It is complemented by Decree No. 36-2012 (its implementing regulation). The constitutional basis is Article 26 of Nicaragua's 1987 Political Constitution, which enshrines the right to privacy.
Supervisory authority (DIPRODAP) non-operational
Law 787 created DIPRODAP under the Ministry of Finance and Public Credit to supervise compliance and maintain a Data File Registry. As of 2025-2026, the directorate has never been formally constituted; no enforcement actions, interpretive decisions, or registry exist in practice.
Data subject rights
The law grants data subjects rights of access, rectification, modification, erasure, supplementation, updating, and cancellation of personal data. These rights mirror, in broad structure, the ARCO rights found in Ibero-American data-protection frameworks, though enforcement mechanisms remain inoperative.
Key controller obligations
Controllers must obtain prior consent before processing personal data, apply purpose-limitation and proportionality principles, implement technical and organizational security measures, and register data files with DIPRODAP, a requirement that cannot be met in practice given DIPRODAP's non-existence.
Sensitive data categories
Law 787 identifies special categories of sensitive data (health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual life) which require heightened protection and, in most cases, explicit consent for processing.
Law 1223, Telecommunications & internet surveillance (2025)
The General Law on Convergent Telecommunications (Law 1223), published November 2024 and in force from November 2025, grants broad government authority over telecommunications and internet services. Civil-society and press-freedom organisations have flagged it as undermining communications privacy and freedom of expression.
Sources
- legislacion.asamblea.gob.ni/normaweb.nsf/9e314815a08d4a6206257265005d21f9/e5d37e9b4827fc06062579e
- dlapiperdataprotection.com/index.html?t=law&c=NI
- dlapiperdataprotection.com/index.html?t=authority&c=NI
- dataguidance.com/notes/nicaragua-data-protection-overview
- dataguidance.com/jurisdiction/nicaragua
- lexmundi.com/guides/data-privacy-guide/jurisdictions/latin-america/nicaragua/
- consortiumlegal.com/en/2022/11/02/questions-and-answers-on-data-protection-in-central-ame
- confidencial.digital/en/english/internet-under-surveillance-in-nicaragua-new-gag-law-takes
Next for Nicaragua: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026