Ley para la Protección de Datos Personales
Decreto Legislativo No. 144, 12 de noviembre de 2024
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 23 November 2024.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Before processing a person's personal data, obtain their express and informed consent, unless this law excuses consent for the specific processing.
- Let people exercise access, rectification, cancellation, opposition, portability and limitation (ARCO-POL) rights over their personal data, through a delegate you designate, free of charge beyond reproduction and delivery costs.
- Before processing biometric, genetic, health, religious, political, union or sexual-preference data, obtain the person's express and unequivocal consent, and tell them they have the right not to provide it.
- Before transferring personal data to another country or an international organization, confirm the recipient meets at least the level of personal-data protection this law requires.
- Do not create a database of sensitive personal data in violation of this law, and do not commercialize personal data.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Who enforces it
Enforcement body
Agencia de Ciberseguridad del Estado (ACE)
What it reaches
Obligation class
Consent, Disclosure, Data subject rights, Transfer, Security, Breach notice
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 1 sets the law's object as regulating the lawful and informed treatment of personal data, and article 2 binds any natural or legal person, public or private, that processes personal data manually, partially or fully automated, or through a third party.
Article 4(g) defines sensitive personal data to expressly include biometric and genetic information alongside religious belief, ethnic origin, political and union affiliation, sexual preference, and physical and mental health, and article 37 conditions any processing of it on the data subject's express and unequivocal consent.
Articles 18 to 23 give data subjects ARCO-POL rights (access, rectification, cancellation, opposition, portability and limitation), exercised through a delegate the responsible party must designate, at no cost beyond reproduction and delivery. Article 28(a) excuses the consent requirement where personal data comes from a publicly accessible source, but only where the data is not sensitive; the data remains personal data under the law either way.
Article 44 permits an international transfer only where the receiving country or organization meets at minimum the protection principles this law defines or the applicable international standards.
Article 56 classifies infractions as minor, serious or very serious, and article 57 fines them at one to ten, eleven to twenty-five, and twenty-six to forty monthly minimum wages of the commercial sector respectively, imposed by the Agencia de Ciberseguridad del Estado (ACE), the body Decreto Legislativo No. 143 of 2024 creates and which article 53 also makes the enforcer of this law's sanctioning procedure. The law does not contain a standalone article on purely automated consequential decisions.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachprocesses_biometricsprocesses_voice