Ley 81 de 2019, rights of data subjects

Ley 81 de 2019, arts. 15-19 and 21-23 (rights of data subjects)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 29 March 2021.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Let a data subject access their personal data held in your databases, free of charge, and tell them its origin and purpose.
Correct, cancel, or stop processing a data subject's personal data on request when it is incorrect, irrelevant, incomplete, outdated, inaccurate or false, and let them revoke consent.
Give a data subject a structured, commonly used, machine readable copy of their personal data on request, transferable to another responsible party, at least where they supplied the data directly, a relevant volume of automated processing is involved, or they consented or a contract requires it.
Answer an access request within ten business days free of charge, and complete a correction, blocking, or deletion within five business days of the request.
Do not subject a data subject to a decision based solely on automated processing of their personal data that produces a negative legal effect or a detriment to a right, unless they consented, the decision is necessary to perform a contract, or a special law authorizes it.
Do not limit a data subject's access, rectification, cancellation, opposition or blocking rights by contract or agreement of any kind; a clause that tries is void.
Let a data subject reach any one of several responsible parties that feed a shared database, and extend these rights to personal data you held before the Law took effect.

What it reaches

Obligation class

Data subject rights, Access restriction, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 15 gives every data subject the irrenounceable rights of access, rectification, cancellation, opposition and portability, including a structured, commonly used, machine readable copy of their personal data that can be moved to another responsible party, at least where the data subject supplied the data directly, a relevant volume of automated processing is involved, or the data subject consented or a contract requires it.

Article 16 requires a response to an access request within ten business days, free of charge, and article 17 requires an inaccurate, erroneous or incomplete datum to be corrected within five business days of the request, letting the Autoridad Nacional de Transparencia y Acceso a la Información decide when a datum is inaccurate or unfounded.

Article 18 lets a data subject take an unanswered request to that Authority, which may then demand information and carry out verifications limited to the complaint presented.

Article 19 gives a data subject the right not to be subject to a decision based solely on the automated processing of their personal data that produces a negative legal effect or a detriment to a right, evaluating aspects such as personality, health, job performance, creditworthiness, reliability or conduct, unless the subject consented, the decision is necessary to perform a contract, or a special law authorizes it.

Article 21 bars limiting a data subject's access, revocation, cancellation, opposition or blocking rights by any act or agreement between parties, voiding any clause that tries. Article 22 lets a data subject reach any one of several responsible parties feeding a shared database.

Article 23 withholds an information, rectification, cancellation or blocking request where it would impede a pending administrative or judicial process or state security, and withholds rectification, cancellation or blocking of data a legal mandate requires to be kept, outside the cases special laws allow. Article 44 extends these rights to personal data already held in a database that existed before the Law took effect.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

Official Legispan text of Ley 81 de 2019, Asamblea Nacional de Panamá

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app