Law / United States / Puerto Rico
Código Penal de Puerto Rico, delitos contra el derecho a la intimidad (unauthorized use and disclosure of personal data records)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 September 2012.
An enforcement supervision rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Do not access, use, modify, or disclose another person's or another company's reserved personal or family data without authorization; doing so is a felony under Puerto Rico's Penal Code, independent of any separate civil privacy duty.
- Expect an enhanced penalty (eight years' imprisonment, and a fine of up to $30,000 for a convicted legal person) where the conduct is committed for profit by someone responsible for the records, or by a public official or employee acting in the course of their duties.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 172 (33 L.P.R.A. § 5238) punishes unauthorized appropriation, use, or alteration of another's reserved personal or family data held in a file or registry with three years' imprisonment for a natural person.
Penalty structure
Fine for a convicted legal person under Article 172; a natural person instead faces three years' imprisonment. Article 175 raises this to a $30,000 fine (and eight years' imprisonment for a natural person) where the offense is committed for profit by the person responsible for the records, or by a public official or employee in the course of duty.
- Rule
- Fixed only
- As of
- 5 September 2026
- Currency
- USD
- Fixed cap
- 10,000
Who enforces it
Enforcement body
Departamento de Justicia de Puerto Rico (public prosecution under the Penal Code)
What it reaches
Obligation class
Security, Disclosure
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Under the Penal Code's section on crimes against the right to privacy, Article 172 makes it a felony, punishable by three years' imprisonment, to appropriate, use, modify, or alter without authorization another person's or family's reserved personal data held in a computerized or other file or registry; a convicted legal person is instead fined up to $10,000.
Article 173 applies the same penalty to disseminating, publishing, revealing, or transferring such data to a third party, or to distributing or accessing data known to have been obtained through such a violation. Article 174 extends Articles 171 through 173 to protect a legal person's (a company's) reserved data on the same terms.
Article 175 raises the penalty to eight years' imprisonment, and a convicted legal person's fine to $30,000, where the violation is committed for profit by the person responsible for the records, or by a public official or employee acting in the course of their duties.
When LexLint raises it
crawls_webtrains_modelsautomated_outreach