Ley de Transparencia y Acceso a la Información Pública, protección de datos personales y hábeas data
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 27 March 2013.
A sensitive categories rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Do not force a person to provide personal data that could cause them discrimination, or patrimonial or moral harm or risk.
- Keep personal data protected at all times, and let access to it proceed only by judicial order or at the request of the person whose data it is.
- Do not collect, transmit, disclose false personal data, or refuse to rectify or update it, outside the cases this law allows.
If you get it wrong
Private right of actionYes
What it reaches
Obligation class
Disclosure, Data subject rights
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 3(7) defines confidential personal data as information relating to ethnic or racial origin, physical, moral or emotional characteristics, home address, private telephone number, private email address, political participation or affiliation, political ideology, religious or philosophical beliefs, physical or mental health status, personal or family assets, and anything else touching honor, personal or family privacy, or one's own image.
Article 25 bars any person from forcing another to provide personal data that could cause discrimination or patrimonial or moral harm or risk, a general prohibition not limited to an obligated institution.
Article 24 states personal data shall always be protected, and lets the data subject, the National Human Rights Commissioner acting for the affected party, or the Public Prosecutor's Office bring the legal actions needed for its protection, with access to the data proceeding only by judicial order or at the request of the person whose data it is.
Articles 27 to 29 sanction an obligated institution's staff who improperly collect, transmit, disclose or refuse to correct false personal data with a written warning, suspension, fine, dismissal or removal for administrative infractions, a fine of half to fifty monthly minimum wages imposed by the IAIP, and referral to the Código Penal's public-administration offences where the conduct is a crime.
Article 39 provides that the Habeas Data articles of this law did not take effect on the law's own 2006 commencement date but only once the corresponding constitutional reform was ratified.