What Is Ley 81 de 26 de marzo de 2019, Sobre Protección de Datos Personales?
Panama's Ley 81 of 26 March 2019 establishes principles, rights, obligations, and procedures for personal-data processing by public or private persons, for-profit or not. It was regulated by Decreto Ejecutivo N° 285 of 28 May 2021, and its delayed commencement took effect 29 March 2021; ANTAI's 2025 materials continue to describe the law as in force from that date. ANTAI's official guidance identifies five ARCO rights: access, rectification, cancellation, opposition, and portability. Published response periods are access and cancellation within 10 business days, rectification and portability within 5 business days, and opposition with immediate effect (subject to compelling legitimate grounds or the need to establish/defend a legal claim). Direct-marketing use of a personal-data base generally requires prior, express, informed, and traceable consent. This is a source-backed evidence profile. The official law, regulation, and ANTAI guidance are in Spanish; no official English translation was located. No Panama-specific data-broker opt-out portal or public-record removal registry was located.
At a glance
- Full name
- Ley 81 de 26 de marzo de 2019, Sobre Protección de Datos Personales
- Short code
- Panama Ley 81/2019
- Jurisdiction
- Panama
- Enacted
- 2019
- Last major update
- Regulated by Decreto Ejecutivo N° 285 of 28 May 2021; delayed commencement took effect 29 March 2021
- Regulator
- Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI), Directorate of Personal Data Protection
- Private right of action
- Limited
- Statutory citation
- Ley 81 de 26 de marzo de 2019, Sobre Protección de Datos Personales
Scope, who Panama Ley 81/2019 covers
Protected data
Data subject rights
Access: obtain personal data, its origin, and purpose, within 10 business days
Rectification: correction of inaccurate, incomplete, outdated, false, irrelevant, or inappropriate data, within 5 business days
Cancellation: elimination of such data, within 10 business days
Opposition: refuse particular processing for founded and legitimate reasons or revoke consent, with immediate effect subject to statutory exceptions
Portability: receive a structured, commonly usable copy of the data, within 10 business days
Notable features
Decree 285 Article 20 identifies categories of legitimately public-access sources (official Gaceta publications, media, telephone directories subject to their own rules, and official professional lists) relevant to how personal data may lawfully be sourced.
Enforcement & penalties
Penalties: The reviewed ANTAI FAQ and Decree 285 materials for this research pass did not surface a consolidated administrative-fine schedule; check ANTAI’s current enforcement guidance before publishing a penalty figure.
Private right of action: ANTAI’s Directorate of Personal Data Protection investigates and sanctions through three complaint channels (its Smart CID portal, email to protecciondedatos@antai.gob.pa, or in-person delivery); the reviewed sources describe this regulatory route without a stated regulator decision deadline.
Relevance to data brokers
No Panama-specific data-broker opt-out portal, public-record removal registry, or separate broker complaint route was located. A broker or other controller processing data in Panama is reachable through the ARCO-rights request process above, escalated to ANTAI if unresolved.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
What are the ARCO rights under Panama’s data-protection law?+
Access, Rectification, Cancellation, and Opposition (plus portability). ANTAI publishes response periods of 5 business days for rectification and 10 business days for access, cancellation, and portability.
Who enforces Panama’s Ley 81?+
ANTAI’s Directorate of Personal Data Protection, reachable via its Smart CID portal, email (protecciondedatos@antai.gob.pa), or in-person delivery in Balboa, Ancón.
Official sources & citations
Other international privacy regimes
Panama Ley 81/2019 sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: