Dominican Republic

The Dominican Republic's data-protection regime rests on Law No. 172-13 (2013), a comprehensive statute covering personal data held in archives, public registries, databases and other technical processing means used for reporting purposes, whether public or private. Unlike GDPR-style regimes, the DR has no single dedicated data protection authority; enforcement responsibility is fragmented across INDOTEL (telecommunications regulator), Pro Consumidor (consumer protection body) and sectoral bodies such as the Superintendencia de Bancos, with ultimate recourse via judicial habeas data/amparo actions.

Law 172-13, as a habeas-data-style Latin American statute, embeds consent as the central lawful basis for processing, with heightened protection for sensitive/special categories of data. Detailed enumerated lawful bases equivalent to GDPR Art. 6, and formal pseudonymisation/anonymisation safe-harbours, were not confirmed in the sources reviewed and require primary-text verification.

Law 172-13 is rooted in the constitutional habeas data tradition and is expected to afford data subjects access, rectification and objection-style rights; however, granular statutory deadlines, an explicit portability right, and a restriction-of-processing right were not independently confirmed in the sources retrieved this run.

Law 172-13 establishes a general security-of-processing principle for controllers but does not impose a breach-notification obligation to data subjects or authorities; breach notice is voluntary/best-practice only. DPIA, DPO, ROPA and joint-controller obligations analogous to GDPR were not confirmed in the sources reviewed and likely do not exist in the current 2013-era statute.

Law 172-13 predates the modern SCC/BCR/TIA transfer-mechanism architecture, and no confirmed cross-border transfer regime, adequacy decision (received or granted), or data-localisation mandate specific to general personal data was identified in the sources reviewed. The Dominican Republic does not appear on published EU adequacy decision lists.

The financial sector is overlaid by Monetary and Financial Law No. 183-02, which establishes the regulatory and institutional framework for the Dominican monetary and financial system including bank confidentiality obligations. Law 172-13's own title indicates a strong original focus on databases used for credit reporting. Telecommunications-related data practices intersect with INDOTEL's mandate. Health, employment, education and insurance sector-specific data overlays were not confirmed in this run.

No ePrivacy-style cookie/tracker consent statute, dark-pattern prohibition, recognized opt-out signal framework, clean-room regime, or cross-context-advertising rule was identified for the Dominican Republic. The closest identified artifact is the 2019 joint INDOTEL/Pro Consumidor e-commerce guidance, which recommends consumer-facing privacy-policy awareness practices but is non-binding guidance rather than binding law.

No profiling-restriction, automated-decision-making transparency right, AI-specific risk-assessment regime, dedicated biometric-data regime, genetic-data regime, or codified state-surveillance carve-out was identified for the Dominican Republic in the sources reviewed. This is treated as a genuine regulatory gap for this module rather than a silent omission.

No age-of-consent threshold, parental-consent mechanism (COPPA/GDPR Art. 8 analogue), minor-profiling ban, education-setting-specific rule, or dependent-adult protection provision was identified for the Dominican Republic's data protection framework in the sources reviewed.

Law 172-13 does not establish an administrative-fine regime comparable to GDPR; redress is primarily judicial. Data subjects whose rights are violated (including via a data breach) may sue the liable party directly through civil/habeas-data litigation, rather than through an empowered administrative regulator issuing penalties. No significant recent DR-specific data protection enforcement actions or legislative developments were identified within the last 180 days of the run date.