Ley 81 de 2019, sensitive personal data

Ley 81 de 2019, arts. 4(11), 8, 13 and 20 (sensitive personal data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 29 March 2021.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not transfer sensitive personal data (data touching a person's intimate sphere, or whose misuse could enable discrimination or serious risk, including racial or ethnic origin, religious or philosophical belief, union affiliation, political opinion, health, sexual orientation, or genetic or biometric data) unless the data subject gave explicit authorization or a narrow statutory exception applies.
Take a data subject's consent to processing sensitive health data only when it is prior, irrefutable and express, a higher bar than ordinary consent.
Process a patient's health data, as a health establishment or medical professional, only within your own care of that patient, and keep it confidential under professional secrecy.

What it reaches

Obligation class

Prohibition, Consent, Biometric

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 4(11) defines a sensitive datum as one touching a person's intimate sphere, or whose misuse could cause discrimination or a serious risk, naming racial or ethnic origin, religious, philosophical or moral belief, union affiliation, political opinion, health, sexual orientation, and genetic or biometric data among the enumerated examples.

Article 13 bars transferring sensitive data at all, except with the data subject's explicit authorization, to safeguard the life of a data subject who cannot consent, for the recognition or defense of a right in a judicial proceeding, or for a historical, statistical or scientific purpose that first dissociates the data subject's identity.

Article 8 requires consent to processing sensitive health data to be prior, irrefutable and express, a heightened standard above the ordinary consent article 6 sets. Article 20 lets a public or private health establishment or medical professional collect and process the health data of its own patients, subject to professional secrecy and this Law.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
handles_health_records

Read the law

Official Legispan text of Ley 81 de 2019, Asamblea Nacional de Panamá

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app