Nicaragua

Article 1 states the Act's object as protecting natural or legal persons against automated or non-automated processing of their personal data held in public or private data files. Article 6 makes the data subject's consent the general basis for processing, with narrow exceptions including a judicial order and data drawn from unrestricted public-access sources limited to name, national-identity-document number, and date of birth.

Article 8 gives sensitive personal data (racial or ethnic origin, political affiliation, religious, philosophical or moral belief, union membership, health or sex life, criminal record or administrative infractions, and financial or credit information) a narrower processing basis limited to general-interest grounds recognized by law, the data subject's consent, or a judicial order.

Article 9 requires that all processing be adequate, proportional, and necessary to its stated purpose, and requires the data controller to adopt technical and organizational security measures against unauthorized access, use, alteration, loss, disclosure, transfer, or dissemination.

Articles 14 and 15 prohibit transferring personal data to a country or international body that does not provide adequate levels of security and protection, subject to listed exceptions, and require the data controller to notify the Direccion de Proteccion de Datos Personales of any transfer it does make.

Article 28 creates the Direccion de Proteccion de Datos Personales, attached to the Ministry of Finance and Public Credit, with control, supervision, and protection functions over the treatment of personal data.

Articles 44 through 46 classify infractions as minor or serious and give the Direccion de Proteccion de Datos Personales power to impose administrative sanctions only (warning, suspension of processing operations, or temporary or permanent closure of a data file), without prejudice to any criminal sanction that may separately apply.

Articles 47 through 52 give the data subject an administrative protection action before the Direccion de Proteccion de Datos Personales and, once that route is exhausted, a constitutional amparo action before the courts.

As reformed by Ley No. 1219, article 8 punishes intentionally interfering with or altering the operation of a computer system or its data, temporarily or permanently, with imprisonment of four to seven years and 300 to 600 day-fines, rising to seven to fifteen years and 600 to 1,000 day-fines where the target is a State system or one serving health, communications, financial, energy, water, transport, port, airport, public-safety, social-security, or education services.

Article 9 punishes violating a computer system's security to destroy, alter, duplicate, disable, or damage its data, processes, or their integrity, availability, or confidentiality, with imprisonment of seven to fifteen years and 600 to 1,000 day-fines.

Article 10 punishes destroying, damaging, modifying, or disabling a computer system or its components, with imprisonment of four to seven years and 300 to 600 day-fines (six months to one year and 200 to 500 day-fines where committed recklessly), rising to seven to fifteen years and 600 to 1,000 day-fines where the target serves public or financial services or holds personal data, sensitive personal data, or reserved information.

Article 4 punishes a person who intentionally and without authorization, or in excess of the authorization granted, accesses, intercepts, or partially or wholly uses a computer system, with imprisonment of one to three years and 200 to 500 day-fines.

Article 5 punishes accessing a program or stored data with intent to appropriate it or to commit another offense with it, with imprisonment of two to four years and 300 to 500 day-fines; both penalties increase by a third at their upper and lower limits when committed for commercial purposes or against a public office or a bank, microfinance institution, or other regulated financial entity. Neither article was among those Ley No. 1219 of 2024 reformed.

Article 47 of Ley No. 1042 repealed articles 192, 193, 194, 198, 245, and 246 of the prior Ley No. 641, Codigo Penal (2007), which had held Nicaragua's computer-offense provisions before this Act.

Article 14 protects a collection such as an anthology, a compilation of texts, or a database as an independent work, without prejudice to the copyright in the works it contains, only where the selection or arrangement of its materials constitutes an intellectual creation; Nicaragua confers no sui generis database right beyond that compilation-copyright model.

Article 31 permits reproducing a single copy of a published work without the author's authorization for personal use, but expressly excludes from that privilege the reproduction of the whole or an important part of a database in digital form, so bulk reproduction of a protected database is not covered even for personal use.

Nicaragua has not enacted a text-and-data-mining exception; the general quotation right at article 32, permitting reproduction of a fragment for citation, analysis, comment, or criticism to the extent justified by that purpose, in accordance with fair practice and with the source and author named, is the closest applicable ground for excerpting a protected compilation or database.

The criminal-sanctions chapter the 1999 Act originally carried for copyright violations has since been repealed; civil enforcement runs through article 97, which entitles a rights holder to seek cessation of the infringing activity and compensation for the moral and patrimonial harm caused.

Article 32 permits reproducing a fragment of an already-divulged work without the author's authorization when done for citation, analysis, comment, or criticism, to the extent justified by that purpose, in accordance with fair practice, naming the source and the author.

Article 40 goes further for news: portions of articles on current economic, political, or religious affairs disseminated by the mass media may be reproduced, distributed, and publicly communicated by any other outlet of the same kind without the author's authorization, unless that right has been expressly reserved, again with the source and the author's name always clearly indicated.

Article 41 permits the mass media to reproduce speeches, addresses, and similar works delivered in public without the speaker's authorization, when done solely to report on current events and citing the author, while reserving to the author the right to publish a collection of such works. Article 42 permits reproducing a work seen or heard in connection with reporting on a current event, to the extent the informational purpose justifies, with total reproduction reserved to exceptional cases.