Skip to content
World Watch

Cybersecurity law & regulation in Panama (2026)

Cybersecurity in Panama: sectoral rules.

Panama's cybersecurity regime is sectoral rather than comprehensive: criminal liability for cyber-offences is governed by the Penal Code as most recently amended by Law 478 of August 2025, while breach-notification duties derive from the 2019 Personal Data Protection Law (Law 81). The National Authority for Government Innovation (AIG) operates CSIRT-Panama for incident response and coordinated the 2021-2024 National Cybersecurity Strategy; no single omnibus statute equivalent to NIS2 is in force.

Last verified Official sources first · MethodologyCompare Panama with other countries

Legal framework

Law 478 of 2025 (cybercrime amendments to Penal Code), Law 81 of 2019 (data protection / breach notification), National Cybersecurity Strategy 2021-2024, AIG / CSIRT-Panama

Key points: cybersecurity in Panama

  1. Law 478 (2025), Cybercrime

    Enacted 4 August 2025, Law 478 amends the Penal Code, Code of Criminal Procedure, and Law 11 of 2015 to criminalise digital extortion, sextortion, identity theft, and attacks on critical infrastructure (hospital, banking, energy systems); penalties run 5-10 years imprisonment with a 50 % uplift where ICT tools are used.

    sucre.net somosimpactopositivo.com

  2. Breach notification, Law 81 (2019)

    Law 81 of 26 March 2019 (Personal Data Protection Law), supplemented by Executive Decree 285 of 2021, requires organisations to notify the National Authority for Transparency and Access to Information (ANTAI) of personal data breaches within 72 hours of becoming aware of the incident.

    dlapiperdataprotection.com

  3. National Cybersecurity Strategy 2021-2024

    Approved by AIG Resolution No. 17 and published in Official Digital Gazette No. 29434-A, the strategy establishes four pillars: protecting privacy and rights, deterring cybercrime, securing critical national infrastructure, and building a national cybersecurity culture.

    dig.watch aig.gob.pa

  4. AIG / CSIRT-Panama

    The National Authority for Government Innovation (AIG) hosts CSIRT-Panama, the national computer-security incident-response team. In April 2026 the government activated its first Cyber Monitoring Center following a series of public-sector hacking incidents, expanding real-time threat-detection capacity.

    aig.gob.pa newsroompanama.com

  5. Sectoral obligations, Banking

    The Superintendency of Banks (SBP) and AIG signed an inter-institutional cybersecurity agreement to share threat intelligence, improve incident reporting, and strengthen digital-security obligations specifically for the financial sector, operating alongside the general data-protection requirements.

    superbancos.gob.pa

  6. Budapest Convention participation

    Panama participates in the Council of Europe Budapest Convention's 24/7 Network for international cooperation on electronic evidence and cybercrime, a mechanism explicitly reinforced and cited in Law 478 of 2025.

    coe.int sucre.net

Sources

  1. panamacibersegura.gob.pa/index.php/legislacion/
  2. aig.gob.pa/csirt/
  3. sucre.net/en/ley-478-delitos-digitales-panama/
  4. somosimpactopositivo.com/en/new-law-against-cybercrime/
  5. dig.watch/resource/panamas-national-cybersecurity-strategy-2021-2024
  6. dlapiperdataprotection.com/index.html?t=breach-notification&c=PA
  7. superbancos.gob.pa/en/sbp-aig-inter-int-agr
  8. newsroompanama.com/2026/04/18/the-government-creates-its-first-cyber-monitoring-center-i
  9. trade.gov/country-commercial-guides/panama-cybersecurity
  10. coe.int/en/web/octopus/-/panama

Next for Panama: Starting a BusinessEasy

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026