--- title: "Dominican Republic Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/dominican-republic/ source_html: /jurisdictions/dominican-republic/index.html description: "Dominican Republic data protection and privacy regulation: 10 categories, 29 claims, updated 2026-10-11." generated_at: 2026-11-07T14:58:19Z content_sha256: c782887ce0ae7c355b7eea50fabf60dff967472bcccb207d97b8f680990d12f0 generator: "fe-fleet/md-twin@1.0" --- # Dominican Republic Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/dominican-republic/), [World Payments](https://payments.gi/jurisdictions/dominican-republic/) Last updated 2026-10-11 · 10 categories · 29 claims · 20 sources in the cumulative register Download report (PDF) Expand all The Dominican Republic's data-protection landscape saw a notable, if aspirational, development this cycle: Agenda Digital 2030, a national digital-transformation policy framework, contemplates a comprehensive reform of the Data Protection Law, Ley 172-13. Data collected 2026-10-11 · Data published 2026-10-11 AI-assembled from cited sources Not covered: Lawful Processing & Special Data, Data Subject Rights, Cross-Border & Adequacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework (2 open gaps). Evidence re-verified: 2026-10-11 · Position last changed: 2026-10-11 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=DOMINICAN-REPUBLIC)[Build Report](/reports/?j=DOMINICAN-REPUBLIC)[Compare](/compare/?j=DOMINICAN-REPUBLIC) Framework posture Regulated (omnibus) 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Instituto Dominicano de las Telecomunicaciones (INDOTEL) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 8 Probable · 1 Uncertain · 1 Not yet assessed 10 Categories 2 Red categories 57 Sub-modules 29 Claims 0 Tier-1 sources Traffic-light mix 7 amber 2 red 1 n/a (sums to 10 rendered categories; click to filter) 2 categories flagged red ## Jurisdiction lead brief ###### Latest update · 11 October 2026 #### Lead Signal The Dominican Republic's data-protection enforcement posture has strengthened through the criminal law rather than through dedicated data-protection legislation. A new Dominican Penal Code establishes offences against the private information of individuals registered in catalogues, files or automated data systems, and extends potential liability to legal entities and corporations that collect or use personal data without express prior consent. This is understood to have taken effect around August 2026, though the exact article numbers and penalty figures have not been located. The development is structurally significant because it addresses a gap that the jurisdiction's principal data-protection instrument, Ley No. 172-13 of 2013, left open: that statute's data-protection provisions are oriented primarily toward credit-reporting and credit-history information sourced from regulated financial-intermediation entities, rather than toward general-purpose personal-data processing. Criminal exposure, including for corporate entities, now sits alongside that narrower civil and administrative regime. #### Other Developments INDOTEL's role remains adjacent rather than dedicated. Ley No. 172-13 designates the telecommunications regulator INDOTEL as responsible for supervising compliance and sanctioning violations under that statute, but this authority is rooted in INDOTEL's telecoms mandate rather than constituting a dedicated general-purpose data-protection regulator, a structural feature of the Dominican framework that has not changed. INDOTEL has opened consultation on a new telecoms law. On 3 September 2026, INDOTEL made available for public consultation a draft General Telecommunications, Digital Infrastructure and Connectivity Law. If enacted, this instrument could affect the sectoral telecoms and e-privacy overlay that intersects with data-protection practice, though the consultation stage means no substantive change has yet occurred. The habeas data constitutional action remains the practical remedy of choice. Given INDOTEL's limited general-processing supervisory and enforcement footprint under Ley 172-13, the constitutional habeas data action is understood to function, in practice, as the more frequently effective route for individuals seeking redress for data-protection violations, alongside the administrative sanctions that Ley 172-13, Article 30(2), empowers for rule violations generally. #### Cross-Monitor Connections The Penal Code's new corporate-liability exposure for unauthorised data collection or use is relevant to the financial-integrity monitor insofar as any gambling, financial, or payments-sector entity operating in the Dominican Republic now faces a criminal, not merely civil, data-handling exposure; readers tracking that sector's parallel regulatory overhaul should treat the two developments as operating on separate legal tracks. The INDOTEL draft telecoms law consultation is also relevant to the world-payments monitor's interest in Dominican digital-infrastructure development, though this brief does not analyse payments-sector implications directly; readers should consult that monitor's coverage for the payments-infrastructure dimension. #### Outlook The principal items to watch are the precise Penal Code article numbers and penalty figures for the new data-handling offences, which have not yet been located in primary form, and the disposition of INDOTEL's draft telecoms law, expected in the fourth quarter of 2026, which would be the next instrument to potentially reshape the sectoral telecoms and e-privacy overlay. No EU adequacy decision exists for the Dominican Republic, and no proactive breach-notification duty has been identified in any current instrument, both of which remain stable baseline features of the framework rather than items currently in motion. ###### Standing brief · as of 14 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The Dominican Republic's data-protection landscape saw a notable, if aspirational, development this cycle: Agenda Digital 2030, a national digital-transformation policy framework, contemplates a comprehensive reform of the Data Protection Law, Ley 172-13. Reports suggest this reform aspiration may be under discussion within policy circles, though no primary legislative text, committee assignment, or enacted change has been identified, and the finding rests on academic commentary rather than a government or legislative source. The Dominican Republic's standing legal architecture remains what it has been: Ley 172-13 is oriented primarily toward regulating Sociedades de Información Crediticia, credit-information societies that require prior authorisation from the Junta Monetaria under Article 30, rather than functioning as a comprehensive omnibus data-protection statute in the style of the GDPR or similar regimes. #### Other Developments Enforcement in the Dominican Republic remains minimal, with no dedicated regulator. There is no standalone data-protection authority in the Dominican Republic; enforcement and redress currently rest on a fragmented foundation combining the credit-bureau-focused provisions of Ley 172-13 with the constitutional habeas data right under Article 44, which grants every person the right to decide on the use of data existing about them, to access it freely, and to demand its update, rectification, or destruction. This constitutional mechanism functions as the practically effective remedy route for data-subject grievances in the absence of a dedicated statutory enforcement body, but it is a judicial remedy pursued case by case rather than an administrative enforcement programme capable of proactive supervision or systematic sanctioning. #### Cross-Monitor Connections The credit-bureau-centric architecture of Ley 172-13, supervised by the Superintendencia de Bancos, connects this monitor's coverage to the financial-integrity monitor's tracking of Dominican beneficial-ownership and AML-adjacent obligations administered through the same financial-sector supervisory apparatus, though the data-protection and AML functions remain analytically distinct even where they touch the same supervised entities. No development this cycle bears on the crypto, world-payments, or advennt monitors' respective domains. #### Outlook Whether Agenda Digital 2030's contemplated reform of Ley 172-13 progresses beyond a policy aspiration into an actual legislative proposal is the single most consequential development to track for Dominican data protection going forward; the absence of a dedicated regulator and the reliance on constitutional habeas data as the primary enforcement mechanism represent the two most significant structural gaps a comprehensive reform would need to address. Until any such reform advances to a drafted bill with identifiable committee status, this should continue to be treated as an uncertain, aspirational signal rather than a probable near-term change. Read full brief · 948 words Key regulatory facts for Dominican Republic Regulatory Dimension Dominican Republic Standing Position Jurisdiction Dominican Republic (DO) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 29 sourced findings) Regulator & Framework A comprehensive statute exists and is in force, but institutional enforcement is fragmented and there is no dedicated supervisory authority, which weakens practical oversight. Lawful Processing & Special Data Core consent and special-category concepts are present by general regional pattern but granular basis-by-basis detail is unverified from available sources. Data Subject Rights Core ARCO-style rights are plausible under the habeas data framework but explicit textual confirmation of scope and deadlines is incomplete. Controller/Processor Duties A security principle exists (confirmed), but modern accountability tooling (DPIA/DPO/ROPA) and mandatory breach notification are absent, indicating a materially lighter-touch regime than GDPR-aligned jurisdictions. Primary Instruments Cited DataGuidance, DataGuidance, DLA Piper Data Protection Laws of the World, Multilaw, Dominican Republic Official Instrument (ofar.com.do derecho-y-tecnologia-la-protecci) Last Confirmed / Updated 2026-10-11 (20 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Dominican Republic: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ A comprehensive statute exists and is in force, but institutional enforcement is fragmented and there is no dedicated supervisory authority, which weakens practical oversight. Primary framework Law No. 172-13 on the Comprehensive Protection of Personal Data (2013) Supervisory authority [Instituto Dominicano de las Telecomunicaciones (INDOTEL)](https://www.indotel.gob.do) Traffic-light rationale — Amber A comprehensive statute exists and is in force, but institutional enforcement is fragmented and there is no dedicated supervisory authority, which weakens practical oversight. #### Sub-modules (5) #### Regulator And AuthorityAmber No single dedicated DPA exists, but INDOTEL's supervisory role over regulated entities rests on a formal instrument (Resolution No. 055-06, Complementary Regulation to Law 126-02) granting inspection and sanctioning authority, not a purely informal arrangement; Pro Consumidor and the Superintendencia de Bancos exercise adjacent, non-exclusive oversight, and courts hear habeas data claims. Primary-instrument scope verification remains outstanding. Claims (2): - The Dominican Republic has no single dedicated data protection authority; enforcement-adjacent functions are shared informally among INDOTEL, Pro Consumidor and sector regulators such as the Superintendencia de Bancos. - Ley No. 172-13 designates INDOTEL as responsible for supervising compliance and sanctioning violations, but this is an adjacent authority rooted in INDOTEL's telecoms mandate, not a dedicated general-purpose data-protection regulator. #### Act And InstrumentsGreen Law No. 172-13 (2013) is the principal comprehensive instrument governing personal data processing in archives, registries, databases and reporting systems, public or private. Claims (3): - Law No. 172-13 (2013) is the Dominican Republic's principal comprehensive data protection statute. - Ley No. 172-13 sobre Protección de Datos Personales — Ley 172-13 regulates Sociedades de Información Crediticia (SIC), which per Article 30 require prior authorisation from the Junta Monetaria to provide credit-reference services. - New Dominican Penal Code — Offences against the private information of individuals registered in catalogues, files or automated data systems, with penalties extending to legal entities/corporations that collect or use personal data without express prior consent. #### Material ScopeGreen The Law applies to personal data contained in archives, public registries, databases or other technical means of data processing used for reporting, whether held by public or private entities. Claims (2): - Law 172-13 applies to personal data contained in archives, public registries, databases or other technical means of data processing used for reporting, whether public or private. - Ley 172-13 provides integral protection of personal data in files/registries intended to furnish reports, with machinery oriented to SICs. #### Territorial ScopeRed No explicit extraterritorial-application clause analogous to GDPR Art. 3 has been identified in Law 172-13 from the sources reviewed. #### Regulator Registration And FilingRed No confirmed general controller-registration/filing obligation with a central authority was identified for Law 172-13 in the sources reviewed; this module element requires primary-text verification. The Dominican Republic's data-protection regime rests on Law No. 172-13 (2013), a comprehensive statute covering personal data held in archives, public registries, databases and other technical processing means used for reporting purposes, whether public or private. Unlike GDPR-style regimes, the DR has no single dedicated data protection authority; enforcement responsibility is fragmented across INDOTEL (telecommunications regulator), Pro Consumidor (consumer protection body) and sectoral bodies such as the Superintendencia de Bancos, with ultimate recourse via judicial habeas data/amparo actions. No periodic updates recorded in this cycle Sources and claims (7) - [DataGuidance](https://www.dataguidance.com/news/dominican-republic-indotel-and-pro-consumidor-release-e) — The Dominican Republic has no single dedicated data protection authority; enforcement-adjacent functions are shared informally among INDOTEL, Pro Consumidor and sector regulators such as the Superintendencia de Bancos. - [DataGuidance](https://www.dataguidance.com/notes/dominican-republic-data-breach) — Law No. 172-13 (2013) is the Dominican Republic's principal comprehensive data protection statute. - [DataGuidance](https://www.dataguidance.com/notes/dominican-republic-data-breach) — Law 172-13 applies to personal data contained in archives, public registries, databases or other technical means of data processing used for reporting, whether public or private. - [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/?t=law&c=DO) — Ley No. 172-13 sobre Protección de Datos Personales — Ley 172-13 regulates Sociedades de Información Crediticia (SIC), which per Article 30 require prior authorisation from the Junta Monetaria to provide credit-reference services. - [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/?t=law&c=DO) — Ley 172-13 provides integral protection of personal data in files/registries intended to furnish reports, with machinery oriented to SICs. - [Multilaw](https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_Dominican_Republic.aspx) — New Dominican Penal Code — Offences against the private information of individuals registered in catalogues, files or automated data systems, with penalties extending to legal entities/corporations that collect or use personal data without express prior consent. - [https://ofar.com.do/al-derecho/persona-familia-al-derecho/derecho-y-tecnologia-la-proteccion-de-datos-personales-en-la-republica-dominicana-2/](https://ofar.com.do/al-derecho/persona-familia-al-derecho/derecho-y-tecnologia-la-proteccion-de-datos-personales-en-la-republica-dominicana-2/) — Ley No. 172-13 designates INDOTEL as responsible for supervising compliance and sanctioning violations, but this is an adjacent authority rooted in INDOTEL's telecoms mandate, not a dedicated general-purpose data-protection regulator. ### Dominican Republic: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core consent and special-category concepts are present by general regional pattern but granular basis-by-basis detail is unverified from available sources. Primary framework Law No. 172-13 on the Comprehensive Protection of Personal Data (2013) Traffic-light rationale — Amber Core consent and special-category concepts are present by general regional pattern but granular basis-by-basis detail is unverified from available sources. D2 · Lawful Processing — Full Module Record 4 sub-modules · 49 words · 2 traced claims · Re-verified 2026-10-11 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Dominican Republic: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core ARCO-style rights are plausible under the habeas data framework but explicit textual confirmation of scope and deadlines is incomplete. Primary framework Law No. 172-13 on the Comprehensive Protection of Personal Data (2013) Traffic-light rationale — Amber Core ARCO-style rights are plausible under the habeas data framework but explicit textual confirmation of scope and deadlines is incomplete. #### Sub-modules (5) #### Access RightAmber A right of access to one's personal data is expected under the habeas-data constitutional tradition underlying Law 172-13; explicit statutory text was not directly retrieved this run. Claims (1): - Ley 172-13, Art. 30(7) — Access, rectification, cancellation and opposition rights, requiring identification of the services/units before which they may be exercised; no statutory response deadline stated. #### Rectification And ErasureAmber Rectification/erasure rights are typical of habeas-data statutes in the region; independent confirmation of DR-specific statutory text was not obtained this run. Claims (1): - Constitution of the Dominican Republic, Art. 44 — Every person has the right to decide on the use of data existing about them and their property, and may access it freely and demand its update, rectification or destruction. #### Restriction And ObjectionRed No confirmed statutory restriction-of-processing or objection/profiling opt-out mechanism was located for Law 172-13 in this run. #### Data PortabilityRed No data portability right was identified in Law 172-13, consistent with it predating the GDPR-era portability concept (law enacted 2013). #### Deadlines And Response WindowsRed No confirmed statutory response-window/deadline for controller responses to data subject requests was located for Law 172-13 in this run. Law 172-13 is rooted in the constitutional habeas data tradition and is expected to afford data subjects access, rectification and objection-style rights; however, granular statutory deadlines, an explicit portability right, and a restriction-of-processing right were not independently confirmed in the sources retrieved this run. Sources and claims (2) - [Pellerano](https://www.pellerano.com/s/Dominican-Republic-Data-Protection-Overview-2026.pdf) — Constitution of the Dominican Republic, Art. 44 — Every person has the right to decide on the use of data existing about them and their property, and may access it freely and demand its update, rectification or destruction. - [Oficina Nacional de Estadística (hosting primary text)](https://www.one.gob.do/media/u5ohmfyp/ley-172-13.pdf) — Ley 172-13, Art. 30(7) — Access, rectification, cancellation and opposition rights, requiring identification of the services/units before which they may be exercised; no statutory response deadline stated. ### Dominican Republic: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A security principle exists (confirmed), but modern accountability tooling (DPIA/DPO/ROPA) and mandatory breach notification are absent, indicating a materially lighter-touch regime than GDPR-aligned jurisdictions. Primary framework Law No. 172-13 on the Comprehensive Protection of Personal Data (2013) Supervisory authority [Instituto Dominicano de las Telecomunicaciones (INDOTEL)](https://www.indotel.gob.do) Traffic-light rationale — Amber A security principle exists (confirmed), but modern accountability tooling (DPIA/DPO/ROPA) and mandatory breach notification are absent, indicating a materially lighter-touch regime than GDPR-aligned jurisdictions. D4 · Controller & Processor — Full Module Record 7 sub-modules · 52 words · 4 traced claims · Re-verified 2026-10-11 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Dominican Republic: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No confirmed transfer-mechanism framework, adequacy status, or localisation mandate was located; this is a genuine regulatory gap rather than an omission, consistent with the statute's 2013-era scope. Primary framework Law No. 172-13 on the Comprehensive Protection of Personal Data (2013) Traffic-light rationale — Red No confirmed transfer-mechanism framework, adequacy status, or localisation mandate was located; this is a genuine regulatory gap rather than an omission, consistent with the statute's 2013-era scope. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 45 words · 1 traced claims · Re-verified 2026-10-11 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Dominican Republic: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial and credit-reporting overlays are reasonably well evidenced; other sectoral overlays (health, employment, education, insurance) remain unconfirmed gaps. Primary framework Law No. 172-13 (2013); Monetary and Financial Law No. 183-02 Supervisory authority Superintendencia de Bancos de la República Dominicana Traffic-light rationale — Amber Financial and credit-reporting overlays are reasonably well evidenced; other sectoral overlays (health, employment, education, insurance) remain unconfirmed gaps. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 66 words · 5 traced claims · Re-verified 2026-10-11 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Dominican Republic: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No binding adtech-specific commercial privacy framework exists; only non-binding consumer guidance was located. Traffic-light rationale — Red No binding adtech-specific commercial privacy framework exists; only non-binding consumer guidance was located. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 48 words · 1 traced claims · Re-verified 2026-10-11 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Dominican Republic: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ No sources located confirming any algorithmic, biometric, or AI-specific governance framework distinct from the general 2013 data protection statute. Traffic-light rationale — Amber No sources located confirming any algorithmic, biometric, or AI-specific governance framework distinct from the general 2013 data protection statute. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 43 words · 1 traced claims · Re-verified 2026-10-11 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Dominican Republic: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No sources located confirming any children- or vulnerable-group-specific data protection provisions; genuine regulatory gap. Traffic-light rationale — Not assessed No sources located confirming any children- or vulnerable-group-specific data protection provisions; genuine regulatory gap. #### Sub-modules (5) #### Age VerificationRed No statutory age-of-consent threshold for data processing was identified for the Dominican Republic. #### Parental ConsentRed No parental-consent mechanism analogous to COPPA or GDPR Art. 8 was identified for the Dominican Republic. #### Minor Profiling BansRed No minor-profiling ban was identified for the Dominican Republic. #### Education SettingsRed No education-setting-specific data protection rule was identified for the Dominican Republic. #### Dependent AdultsRed No dependent-adult (elderly/incapacitated) data protection provision was identified for the Dominican Republic. No age-of-consent threshold, parental-consent mechanism (COPPA/GDPR Art. 8 analogue), minor-profiling ban, education-setting-specific rule, or dependent-adult protection provision was identified for the Dominican Republic's data protection framework in the sources reviewed. ### Dominican Republic: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A private judicial right of action exists, but there is no confirmed administrative penalty regime, enforcement activity index, or regulator capacity data, and no material recent developments were found. Primary framework Law No. 172-13 on the Comprehensive Protection of Personal Data (2013) Traffic-light rationale — Amber A private judicial right of action exists, but there is no confirmed administrative penalty regime, enforcement activity index, or regulator capacity data, and no material recent developments were found. Periodic update · new data 2026-10-11 #### Enforcement & Redress Enforcement and redress in the Dominican Republic's data-protection framework now operates across three channels. Ley 172-13, Article 30(2), empowers administrative sanctions for violations of established rules, a confirmed power, though the specific maximum fine figure has not been located this cycle. Separately, the constitutional habeas data action is understood to function, in practice, as the more frequently effective remedy for data-protection violations, a role that has grown in practical importance precisely because INDOTEL's general-processing supervisory and enforcement footprint under Ley 172-13 is limited relative to a dedicated data-protection authority. This means that an individual seeking redress for a data-protection violation in the Dominican Republic is, as a practical matter, often better served by the constitutional habeas data route than by a complaint to INDOTEL under the statutory administrative-sanctions power. The third and newest channel is the Penal Code's criminal offence regime, understood to have taken effect around August 2026, which extends liability — including to legal entities and corporations — for unauthorised collection or use of personal data registered in catalogues, files or automated data systems. This materially expands the enforcement perimeter beyond Ley 172-13's civil and administrative remedies, introducing criminal exposure where previously only administrative sanctions and the habeas data constitutional route were available. The precise article numbers and penalty figures for this new criminal exposure have not yet been located, which limits assessment of how severe or how readily invoked this new channel will be in practice.
Taken together, these three channels — administrative sanctions under Ley 172-13, the habeas data constitutional remedy, and the new Penal Code criminal offences — now constitute a materially more layered enforcement and redress landscape than existed before the Penal Code development, even though the DNFBP-style dedicated regulatory capacity associated with a standalone data-protection authority is still absent. #### Outlook The principal item to watch is confirmation of the Penal Code's exact article numbers, penalty figures, and any early indication of how prosecutorial authorities intend to apply the new offences in practice, since this would determine whether the criminal channel becomes a materially used enforcement route or remains a largely dormant statutory addition alongside the already-established administrative and habeas data channels. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 66 words · 6 traced claims · Re-verified 2026-10-11 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties