Data protection & privacy law in Panama (2026)
Data protection in Panama: comprehensive law.
Panama enacted a comprehensive, GDPR-inspired personal data protection law, Law No. 81 of 2019, which entered into force on 29 March 2021 alongside its implementing regulation, Executive Decree 285 of 2021. The law establishes broad data-subject rights, controller obligations, cross-border transfer rules, and assigns enforcement authority to ANTAI. As of 2025-2026, ANTAI has formally transitioned from an educational outreach phase toward active compliance auditing and sanctions enforcement.
Legal framework
Law No. 81 of 26 March 2019 on Personal Data Protection (Ley 81 de Protección de Datos Personales), implemented by Executive Decree No. 285 of 28 May 2021; supervised by the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) through its Directorate of Personal Data Protection
Key points: data & privacy in Panama
Comprehensive Legal Basis
Law No. 81 of 26 March 2019, supplemented by Executive Decree No. 285 of 28 May 2021, is Panama's primary data protection statute. It covers personal data processed by both public and private entities and is modelled on GDPR-style principles including purpose limitation, proportionality, and loyalty.
Supervisory Authority, ANTAI
ANTAI (Autoridad Nacional de Transparencia y Acceso a la Información), through its Directorate of Personal Data Protection, is the sole competent supervisory authority. It investigates complaints, conducts ex-officio audits including on-site inspections, issues guidance, approves contractual clauses, and imposes administrative sanctions.
Data Subject Rights (ARCO+P)
Data subjects hold rights of Access, Rectification, Cancellation, Opposition, and Portability. Data controllers must satisfy requests within 10 business days. Constitutional protections also underpin the right of access to personal data held in public and private registries.
Data Breach Notification
Upon becoming aware of a security breach, data controllers must notify ANTAI and all affected data subjects within 72 hours. Decree 285 also authorises ANTAI to require a Data Protection Impact Assessment (DPIA) when processing activities carry elevated risk or use novel technology.
Cross-Border Data Transfers
International transfers are permitted where the destination country offers equivalent or higher protection, or where adequate guarantees exist, such as ANTAI-validated standard contractual clauses, binding corporate rules approved by ANTAI, or other mechanisms recognised by the authority.
Sanctions & Enforcement Trajectory
Sanctions range from USD 1,000-10,000 for grave infractions to permanent suspension of operations for very grave violations. In October 2025, the inaugural meeting of the Data Protection Council signalled a formal shift toward rigorous enforcement and active sanctioning after an initial education-focused implementation phase.
Sources
- antai.gob.pa/ley-81-de-proteccion-de-datos-personales-entra-en-vigencia-en-panama/
- antai.gob.pa/reglamentan-ley-81-de-proteccion-de-datos-personales/
- antai.gob.pa/direccion-de-proteccion-de-datos-personales/
- antai.gob.pa/preguntas-frecuentes-proteccion-de-datos-personales/
- dlapiperdataprotection.com/index.html?t=law&c=PA
- kennedyslaw.com/en/thought-leadership/article/ley-no-81-panama-becomes-latest-jurisdi
- dentons.com/en/insights/articles/2021/june/25/panama-regulation-on-data-protectio
- dataguidance.com/notes/panama-data-protection-overview
Next for Panama: Digital Payments & FintechPartial
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026