Proteccion de la Persona frente al Tratamiento de sus Datos Personales
Ley No. 8968, Proteccion de la Persona frente al Tratamiento de sus Datos Personales
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Before collecting a person's personal data, inform them of the purpose of collection and obtain their express, written consent, unless the data are publicly accessible or a law or judicial order compels disclosure.
- Do not process data revealing racial or ethnic origin, political opinions, religious convictions, health, or sexual orientation without the data subject's consent or another narrow statutory ground.
- Adopt technical and organizational security measures to prevent the alteration, loss, or unauthorized access of personal data.
- Do not transfer personal data to a third party or abroad without the data subject's express, valid authorization.
- Do not use collected data for a purpose incompatible with the one disclosed at collection.
- Register any database administered for distribution, dissemination, or commercialization purposes with the Prodhab.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Who enforces it
Enforcement body
Agencia de Proteccion de Datos de los Habitantes (Prodhab)
What it reaches
Obligation class
Consent, Data subject rights, Transfer, Security, Licensing
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 1 makes the law's object guaranteeing any person, regardless of nationality, residence or domicile, their right to informational self-determination over their private life; article 2 applies it to personal data in any automated or manual database of a public or private body, excluding a database kept for exclusively internal, personal or domestic purposes that is never sold or commercialized.
Article 5 requires a data controller to inform a person before collecting their data and to obtain their express, written consent, revocable without retroactive effect, unless the data are publicly accessible or the disclosure is compelled by judicial order or law.
Article 9 prohibits processing data revealing racial or ethnic origin, political opinions, religious or philosophical convictions, health, life, or sexual orientation, subject to narrow exceptions such as the data subject's own public disclosure or vital-interest necessity. Article 10 requires the controller to adopt technical and organizational security measures. Article 14 conditions any transfer of the data on the data subject's express, valid authorization.
The Prodhab, created by article 15 as an agency attached to the Ministry of Justice and Peace, enforces the law through a complaint procedure (arts. 24-27) and a tiered sanction scale of administrative fines set in multiples of the base salary of a first-level judicial aide, running from up to five base salaries for a minor infraction to fifteen to thirty base salaries plus a suspension of the database's operation of one to six months for the most serious infraction.
A public-sector controller instead receives a corrective resolution rather than a fine. The law itself imposes no criminal penalty and refers conduct that may constitute a crime to the Public Prosecutor's Office. A separate Codigo Penal provision, article 196 bis, carries the criminal exposure for the same underlying conduct. The Legislative Assembly signed the law on 7 July 2011, and it enters into force on its publication; the consolidated SCIJ text does not itself state that publication date.
When LexLint raises it
automated_outreachcrawls_webtrains_modelsprocesses_biometrics