Data protection & privacy law in Puerto Rico (2026)
Data protection in Puerto Rico: sectoral rules.
Puerto Rico has no single comprehensive data-protection statute in force; instead it relies on a constitutionally entrenched right to privacy and a set of sector-specific laws, chief among them the 2005 data-breach notification act enforced by DACO. Privacy is a fundamental, self-executing constitutional right enforceable even between private parties. A comprehensive 'Consumer Data and Personal Information Protection' bill (House Bill 1548) modeled on California/GDPR has advanced through the legislature but has not been enacted into law.
Legal framework
Sectoral regime anchored by Act No. 111 of 2005 (Citizen Information on Data Banks Security Act, 10 LPRA §§ 4051-4055), enforced by the Puerto Rico Department of Consumer Affairs (DACO), layered on the constitutional right to privacy (Art. II, §8) and sector-specific statutes; a comprehensive GDPR/CCPA-style bill has been proposed but is not in force.
Key points: data & privacy in Puerto Rico
Breach-notification law (core statute)
Act No. 111-2005 (10 LPRA §§ 4051-4055) requires any entity holding databases of Puerto Rico residents' personal information to notify affected individuals and report breaches to DACO when unencrypted/unprotected data is subject to unauthorized access.
Supervisory authority
The Department of Consumer Affairs (DACO) is the enforcing authority for the breach-notification regime. Reports must reach DACO within a non-extendable 10 days; DACO issues a public announcement within 24 hours and may impose fines of $500-$5,000 per violation.
Constitutional right to privacy
Article II, Section 8 of Puerto Rico's Constitution establishes privacy as a fundamental right; the Supreme Court treats it as of the 'highest hierarchy,' and it is self-executing and enforceable between private parties without enabling legislation.
Covered personal information
Protected data under Act 111 includes name plus identifiers such as Social Security number, driver's license, official ID, financial account credentials, passwords/access codes, HIPAA-protected medical information, tax information, and work evaluations.
Cybersecurity obligations
Act No. 40 of 2024 (Cybersecurity Act) imposes security obligations on government bodies and private entities handling public funds, and the Office of the Commissioner of Insurance enforces insurance-sector cybersecurity rules (Rule 108).
Proposed comprehensive law (not in force)
A comprehensive 'Consumer Data and Personal Information Protection Act' (House Bill 1548), modeled on California/GDPR, mandating privacy policies, controller obligations and consumer rights, advanced through the legislature but has not been signed into law, so the in-force regime remains sectoral.
Sources
- law.justia.com/codes/puerto-rico/title-ten/subtitle-3/chapter-310/4052/
- law.justia.com/constitution/puerto-rico/article-ii/section-8/
- perkinscoie.com/insights/publication/security-breach-notification-chart-puerto-rico
- dwt.com/gcp/states/puerto-rico
- ciberseguridad.ocs.pr.gov/documents/Rule%20108.pdf
- ferraiuoli.com/news/notice-to-clients-and-friends-puerto-rico-legislature-considers-
- dataguidance.com/news/puerto-rico-senate-bill-digital-privacy-protection-law
Next for Puerto Rico: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026