--- title: "Panama Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/panama/ source_html: /jurisdictions/panama/index.html description: "Panama data protection and privacy regulation: 10 categories, 59 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: b1628a4bf4437770f2b63c7f5874cb1b8e35d2d1ceabc8d8892f81be5a1b8098 generator: "fe-fleet/md-twin@1.0" --- # Panama Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Panama Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/panama/), [World Payments](https://payments.gi/jurisdictions/panama/), [Crypto](https://cryptoassets.gi/jurisdictions/panama/) Last updated 2026-11-04 · 10 categories · 59 claims · 33 sources in the cumulative register Download report (PDF) Expand all Panama's Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) approved Resolution ANTAI-DG-003-2026 on 26 March 2026, implementing Standard Contractual Clauses under the Reglamento de Implementación de la Protección de Datos (RIPD) for international transfers of personal data. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Controller/Processor Duties, Sectoral Watch, Enforcement & Redress (10 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=PANAMA)[Build Report](/reports/?j=PANAMA)[Compare](/compare/?j=PANAMA) Framework posture Regulated (omnibus) 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) — Dirección de Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed 10 Categories 2 Red categories 57 Sub-modules 59 Claims 10 Tier-1 sources Traffic-light mix 1 green 6 amber 2 red 1 n/a (sums to 10 rendered categories; click to filter) 2 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 892 Full executive summary 75 ###### Latest update · 4 November 2026 #### Lead Signal Panama's data-protection authority, ANTAI, has imposed cumulative fines of approximately USD 11,000 during 2026 under Law No. 81 of 2019, the jurisdiction's omnibus personal-data-protection statute. The reporting on these fines is notable less for the sum involved, which is modest, than for who was fined: the enforcement activity reaches beyond corporate entities to include a condominium owners' board, indicating that ANTAI's enforcement reach under Law 81/2019 extends to non-commercial controllers of personal data and not solely to businesses. This finding carries an uncertain confidence rating, since it rests on secondary press reporting rather than ANTAI's own enforcement register, and the statutory fine ceilings and the procedural steps leading to these penalties have not been pinpointed this period. Taken together with the structural features of Panama's regime that remain stable in the background, this enforcement activity points toward a regime that has moved from statutory enactment to operational application. ANTAI continues to act as Panama's single data-protection authority, and the jurisdiction's cross-border transfer mechanism, built around the Ibero-American Data Protection Network's Model Contractual Clauses, remains the mechanism of record for international transfers. Neither of those positions changed this period; what changed, or rather what newly came into view, is evidence that the enforcement function is active and reaches non-corporate controllers. #### Other Developments Enforcement reach beyond corporate entities. The reported fines against a condominium owners' board, alongside unspecified corporate penalties, suggest that ANTAI is treating any entity that processes personal data as a potential subject of its enforcement powers under Law 81/2019, regardless of whether that entity is a commercial business. This is a meaningful signal for how the obligated-entity population under Panama's regime should be understood in practice, though the statutory basis, exact penalty amounts per case, and ANTAI's procedural approach to these actions have not been confirmed from primary sourcing this period. #### Cross-Monitor Connections Nothing in the enforcement signal connects directly to findings tracked by the other monitors in this fleet. #### Outlook The next research priority for this domain is retrieval of ANTAI's own enforcement register or formal sanction decisions, which would allow the statutory fine ceilings, the precise entities and dates involved, and the procedural pathway from complaint or inspection to penalty to be confirmed rather than inferred from press reporting. Confirmation of whether non-corporate bodies such as condominium boards are being treated as ordinary controllers under the statute, or whether some distinct procedural track applies to them, would sharpen the picture of how broadly ANTAI's enforcement authority is being exercised in practice as 2026 enforcement activity continues to be reported. 2 earlier updates not shown here. ###### Standing brief · as of 23 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Panama's Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) approved Resolution ANTAI-DG-003-2026 on 26 March 2026, implementing Standard Contractual Clauses under the Reglamento de Implementación de la Protección de Datos (RIPD) for international transfers of personal data. This is Panama's first formal, standardised cross-border transfer mechanism under its Data Protection Law, and it reduces the legal uncertainty that previously attended cross-border data flows out of Panama, since controllers and processors now have a recognised contractual instrument to rely on rather than case-by-case assessment. Because this is Panama's first standardised instrument of this kind, it is best read as an infrastructure development for the cross-border-transfer regime generally, rather than as a change to underlying substantive data-protection standards; the safeguards these clauses are designed to carry across borders are those already established under the Data Protection Law, not new ones introduced by this resolution. #### Other Developments Standardised clauses fill a gap in the omnibus framework. Panama's Data Protection Law did not previously specify a standardised transfer mechanism comparable to well-known Standard Contractual Clauses models used elsewhere; ANTAI's 2026 resolution addresses that gap directly by adopting an RIPD-specific SCC instrument. Standard Contractual Clauses of this kind typically operate by imposing contractual data-protection obligations on the data importer that mirror the exporting jurisdiction's substantive protections, giving the exporting controller a documented basis for arguing that adequate safeguards travel with the data. ANTAI's adoption of this model formalises that pathway for Panama-origin transfers for the first time; previously, controllers relying on contractual safeguards for cross-border transfers did so without a regulator-approved standard template to point to. #### Cross-Monitor Connections Cross-border data-transfer developments of this kind intersect with the financial-integrity monitor's coverage of Panama's beneficial-ownership and AML/CFT information-sharing architecture, insofar as both regimes govern what information may move across Panama's borders and under what safeguards, though the two frameworks are legally distinct: ANTAI's transfer clauses govern personal data specifically, not beneficial-ownership or transaction data held under AML/CFT law. Organisations operating in both spaces should not assume the new SCC mechanism extends to financial-integrity data-sharing obligations, which remain governed separately. #### Outlook The item to watch next cycle is whether ANTAI publishes implementing guidance clarifying the scope of the new RIPD Standard Contractual Clauses — for instance, whether they are available for use with any destination jurisdiction or are restricted to specific transfer scenarios — and whether any adequacy-style jurisdiction list develops alongside the new contractual mechanism. No Tier-1 (ANTAI primary text or gazette) source was directly retrieved this cycle for the resolution itself; a primary-source confirmation would raise confidence in the mechanism's exact scope and effective date. Read full brief · 892 words Standing brief, as of 23 August 2026. #### Regulatory Status Panama's data-protection cross-border regime advanced this cycle with ANTAI's approval of Resolution ANTAI-DG-003-2026, implementing RIPD Standard Contractual Clauses for international personal-data transfers — the jurisdiction's first standardised transfer mechanism under Law No. 81 of 2019 and Executive Decree No. 285 of 2021. #### Outlook Watch for ANTAI implementing guidance clarifying the new clauses' scope and for any Tier-1 primary-source confirmation of the resolution's text and effective date. Key regulatory facts for Panama Regulatory Dimension Panama Standing Position Jurisdiction Panama (PA) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 59 sourced findings) Regulator & Framework A comprehensive statute is in force with a designated regulator and implementing regulation; territorial scope and registration/filing mechanics remain under-documented in public sources. Lawful Processing & Special Data Core consent and special-category concepts are confirmed, but pseudonymisation/anonymisation treatment is undocumented in the sources reviewed. Data Subject Rights Substantive rights are confirmed and enumerated by ANTAI itself; deadline/response-window specifics are an evidence gap. Controller/Processor Duties Security/accountability and DPO elements are confirmed at a structural level; DPIA, ROPA, joint-controller and retention specifics are evidence gaps pending fuller decree-text review. Primary Instruments Cited ANTAI, ANTAI, ANTAI, DataGuidance, ANTAI Last Confirmed / Updated 2026-11-04 (33 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Panama: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ A comprehensive statute is in force with a designated regulator and implementing regulation; territorial scope and registration/filing mechanics remain under-documented in public sources. Primary framework Law No. 81 of 26 March 2019 on the Protection of Personal Data (as regulated by Executive Decree No. 285 of 28 May 2021) Supervisory authority [Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) — Dirección de Protección de Datos Personales](https://www.antai.gob.pa/) Traffic-light rationale — Green A comprehensive statute is in force with a designated regulator and implementing regulation; territorial scope and registration/filing mechanics remain under-documented in public sources. #### Sub-modules (5) #### Regulator And AuthorityGreen Article 17 of Law 81 designates ANTAI as the competent authority, exercised via its Dirección de Protección de Datos Personales. Claims (6): - Article 17 of Law 81 of 26 March 2019 designates ANTAI as the competent authority for personal data protection matters in Panama, exercised through its Dirección de Protección de Datos Personales. - ANTAI, through its Directorate for the Protection of Personal Data, is the primary regulatory authority responsible for oversight and enforcement of Law 81, empowered to investigate complaints, conduct inspections and impose sanctions. - ANTAI is the supervisory authority for Panama's Data Protection Law and is empowered to investigate and sanction infringements - ANTAI supervises Law 81 of 2019 through a dedicated Dirección de Protección de Datos Personales established under Executive Decree 285 of 2021 - Autoridad Nacional de Transparencia y Acceso a la Informacion (ANTAI) — Law No. 81 of 26 March 2019, combining data-protection and transparency/access-to-information functions in one body - ANTAI — is Panama's data-protection authority under Law No. 81 of 26 March 2019, combining data-protection and transparency/access-to-information functions: true #### Act And InstrumentsGreen Core instrument is Law 81/2019, implemented by Executive Decree 285/2021 which adds operational detail including a DPO figure, sanction criteria, breach and transfer procedures. Claims (5): - Law No. 81 of 2019 establishes the principles, rights, obligations and procedures regulating the protection of personal data in Panama, considering its interrelation with privacy and other rights. - Executive Decree No. 285 of 28 May 2021 regulates Law 81, introducing the figure of the Data Protection Officer ('Oficial de Protección de Datos Personales') and setting criteria for the application of sanctions. - Executive Decree No. 285 includes provisions on information-gathering requirements, data breach procedures, and international data transfer procedures implementing Law 81. - Panama Data Protection Law — Law No. 81 of 26 March 2019 together with Executive Decree No. 285 of 28 May 2021 - Law 81 of 2019 took effect in 2021, with Executive Decree 285 of 2021 adding operational specifics including incident-management requirements, encryption duties, activity logging and mandatory DPO appointment for certain organizations. #### Material ScopeGreen Law 81 defines personal data broadly as any information concerning an identified or identifiable natural person. Claims (1): - Law 81's glossary defines personal data as any information concerning natural persons that identifies them or renders them identifiable. #### Territorial ScopeAmber No specific provision on extraterritorial/non-established-controller application was located in the sources reviewed. #### Regulator Registration And FilingAmber No dedicated public database-registration/filing regime (akin to a national RUB) was identified; sanctions provisions reference closure of 'registros de la base de datos' but this appears administrative/punitive rather than an ex ante filing obligation. #### Key findings (3) - — source on file - — source on file - — source on file Panama's omnibus regime is Law No. 81 of 26 March 2019 on the Protection of Personal Data, supervised by the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) through its Dirección de Protección de Datos Personales. ANTAI combines data-protection and transparency/access-to-information mandates in one body, structurally similar to Hungary's NAIH and Montenegro's AZLP. The law entered into force on 29 March 2021 (two years after promulgation) and is implemented by Executive Decree No. 285 of 28 May 2021. Sources and claims (12) - [ANTAI](https://antai.gob.pa/wp-content/uploads/2024/06/DPDP-066_Censurado.pdf) — Article 17 of Law 81 of 26 March 2019 designates ANTAI as the competent authority for personal data protection matters in Panama, exercised through its Dirección de Protección de Datos Personales. - [ANTAI](https://antai.gob.pa/legislacion/) — Law No. 81 of 2019 establishes the principles, rights, obligations and procedures regulating the protection of personal data in Panama, considering its interrelation with privacy and other rights. - [ANTAI](https://antai.gob.pa/reglamentan-ley-81-de-proteccion-de-datos-personales/) — Executive Decree No. 285 of 28 May 2021 regulates Law 81, introducing the figure of the Data Protection Officer ('Oficial de Protección de Datos Personales') and setting criteria for the application of sanctions. - [DataGuidance](https://www.dataguidance.com/news/panama-president-approves-executive-decree-regulates) — Executive Decree No. 285 includes provisions on information-gathering requirements, data breach procedures, and international data transfer procedures implementing Law 81. - [ANTAI](https://antai.gob.pa/preguntas-frecuentes-proteccion-de-datos-personales/) — Law 81's glossary defines personal data as any information concerning natural persons that identifies them or renders them identifiable. - [ANTAI](https://antai.gob.pa/legislacion/) — ANTAI, through its Directorate for the Protection of Personal Data, is the primary regulatory authority responsible for oversight and enforcement of Law 81, empowered to investigate complaints, conduct inspections and impose sanctions. - [Securiti](https://securiti.ai/panama-personal-data-protection-law-overview/) — ANTAI is the supervisory authority for Panama's Data Protection Law and is empowered to investigate and sanction infringements - [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/index.html?t=law&c=PA) — Panama Data Protection Law — Law No. 81 of 26 March 2019 together with Executive Decree No. 285 of 28 May 2021 - [Soluciones eTech](https://solucionesetech.com/en/blog/data-protection-compliance-latin-america-2026/) — Law 81 of 2019 took effect in 2021, with Executive Decree 285 of 2021 adding operational specifics including incident-management requirements, encryption duties, activity logging and mandatory DPO appointment for certain organizations. - [RecordingLaw](https://www.recordinglaw.com/es/world-laws/world-data-privacy-laws/panama-data-privacy-laws/) — ANTAI supervises Law 81 of 2019 through a dedicated Dirección de Protección de Datos Personales established under Executive Decree 285 of 2021 - [ANTAI](https://antai.gob.pa/legislacion/) — Autoridad Nacional de Transparencia y Acceso a la Informacion (ANTAI) — Law No. 81 of 26 March 2019, combining data-protection and transparency/access-to-information functions in one body - [ANTAI](https://antai.gob.pa/legislacion/) — ANTAI — is Panama's data-protection authority under Law No. 81 of 26 March 2019, combining data-protection and transparency/access-to-information functions: true ### Panama: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core consent and special-category concepts are confirmed, but pseudonymisation/anonymisation treatment is undocumented in the sources reviewed. Primary framework Law No. 81 of 2019, Articles 8 (consent exceptions) and sensitive-data provisions Supervisory authority [ANTAI — Dirección de Protección de Datos Personales](https://www.antai.gob.pa/) Traffic-light rationale — Amber Core consent and special-category concepts are confirmed, but pseudonymisation/anonymisation treatment is undocumented in the sources reviewed. D2 · Lawful Processing — Full Module Record 4 sub-modules · 49 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Panama: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Substantive rights are confirmed and enumerated by ANTAI itself; deadline/response-window specifics are an evidence gap. Primary framework Law No. 81 of 2019, data-subject-rights provisions Supervisory authority [ANTAI — Dirección de Protección de Datos Personales](https://www.antai.gob.pa/) Traffic-light rationale — Amber Substantive rights are confirmed and enumerated by ANTAI itself; deadline/response-window specifics are an evidence gap. #### Sub-modules (5) #### Access RightGreen Right of access allows data subjects to obtain and know the origin and purpose of their personal data held by public or private institutions. Claims (1): - Law 81 grants data subjects a right of access to obtain and know the origin and purpose of their personal data held for storage or processing by public or private institutions. #### Rectification And ErasureGreen Rights of rectification and cancellation allow correction or deletion of incorrect, irrelevant, incomplete, outdated, inaccurate, false or impertinent personal data. Claims (3): - Data subjects have rights of rectification and cancellation permitting them to request correction or deletion of personal data that is incorrect, irrelevant, incomplete, outdated, inaccurate, false or impertinent. - Law 81 of 2019 — Law 81 recognises ARCO rights — access, rectification, cancellation and objection — including portability, applicable to both domestic and cross-border data treatment. - Ley N 81 de 2019 — A cancellation right allowing data subjects to request deletion of personal data that is incorrect, irrelevant, incomplete, outdated, inaccurate, false or impertinent #### Restriction And ObjectionGreen Right of opposition allows data subjects, on legitimate grounds, to refuse provision of data or object to specific processing, and to revoke consent. Claims (1): - Data subjects have a right of opposition permitting them, for well-founded and legitimate reasons, to refuse to provide personal data or object to specific processing, and to revoke previously given consent. #### Data PortabilityAmber Law 81 recognizes a right to data portability among the fundamental rights of data subjects. Claims (1): - Law 81 enumerates portability among the fundamental rights recognized to the personal data subject. #### Deadlines And Response WindowsRed No specific statutory response-time deadlines for controller action on rights requests were located. #### Key findings (3) - — source on file - — source on file - — source on file Law 81 grants data subjects rights of access, rectification, cancellation (erasure), opposition (including consent revocation), and portability. Specific statutory response-time deadlines for controllers were not located in the sources reviewed. Sources and claims (6) - [ANTAI](https://antai.gob.pa/preguntas-frecuentes-proteccion-de-datos-personales/) — Law 81 grants data subjects a right of access to obtain and know the origin and purpose of their personal data held for storage or processing by public or private institutions. - [ANTAI](https://antai.gob.pa/preguntas-frecuentes-proteccion-de-datos-personales/) — Data subjects have rights of rectification and cancellation permitting them to request correction or deletion of personal data that is incorrect, irrelevant, incomplete, outdated, inaccurate, false or impertinent. - [ANTAI](https://antai.gob.pa/preguntas-frecuentes-proteccion-de-datos-personales/) — Data subjects have a right of opposition permitting them, for well-founded and legitimate reasons, to refuse to provide personal data or object to specific processing, and to revoke previously given consent. - [ANTAI](https://antai.gob.pa/preguntas-frecuentes-proteccion-de-datos-personales/) — Law 81 enumerates portability among the fundamental rights recognized to the personal data subject. - [ANTAI - Guia para el sector privado](https://antai.gob.pa/wp-content/uploads/2024/01/GUIA-SECTOR-PRIVADO-1.pdf) — Law 81 of 2019 — Law 81 recognises ARCO rights — access, rectification, cancellation and objection — including portability, applicable to both domestic and cross-border data treatment. - [ANTAI - Preguntas frecuentes](https://antai.gob.pa/preguntas-frecuentes-proteccion-de-datos-personales/) — Ley N 81 de 2019 — A cancellation right allowing data subjects to request deletion of personal data that is incorrect, irrelevant, incomplete, outdated, inaccurate, false or impertinent ### Panama: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Security/accountability and DPO elements are confirmed at a structural level; DPIA, ROPA, joint-controller and retention specifics are evidence gaps pending fuller decree-text review. Primary framework Executive Decree No. 285 of 28 May 2021 (regulating Law No. 81 of 2019) Supervisory authority [ANTAI — Dirección de Protección de Datos Personales](https://www.antai.gob.pa/) Traffic-light rationale — Amber Security/accountability and DPO elements are confirmed at a structural level; DPIA, ROPA, joint-controller and retention specifics are evidence gaps pending fuller decree-text review. D4 · Controller & Processor — Full Module Record 7 sub-modules · 50 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Panama: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A transfer mechanism exists in statute and decree, but adequacy, SCC/BCR, TIA and localisation specifics are undocumented in the sources reviewed. Primary framework Law No. 81 of 2019; Executive Decree No. 285 of 2021 Supervisory authority [ANTAI — Dirección de Protección de Datos Personales](https://www.antai.gob.pa/) Traffic-light rationale — Amber A transfer mechanism exists in statute and decree, but adequacy, SCC/BCR, TIA and localisation specifics are undocumented in the sources reviewed. Periodic update · new data 2026-10-25 #### Cross-Border & Adequacy Panama's international personal-data-transfer regime reached a concrete procedural milestone. ANTAI, the national data-protection authority, issued Resolution ANTAI-DG-003-2026 on 26 March 2026, approving and implementing the RIPD Standard Contractual Clauses as an adequate-guarantee mechanism under Law 81 of 2019. This resolution predates the current reporting window but was first identified in available tracking, and its substantive significance lies in giving controllers and processors a concrete, named contractual instrument for structuring cross-border data flows rather than relying solely on ad hoc or case-by-case adequacy determinations. The practical effect of the resolution is to formalise what had previously been a less certain compliance pathway for companies transferring personal data out of Panama. Standard Contractual Clauses are a widely recognised transfer mechanism internationally, and their adoption in the RIPD form by ANTAI situates Panama's cross-border transfer regime closer to internationally recognised models, giving multinational groups operating in Panama, including those with data flows to jurisdictions without a formal adequacy finding from ANTAI, a documented mechanism to rely upon. This is a procedural maturation of the regime rather than a change triggered by any single enforcement case or cross-border incident. Several aspects of how the resolution will operate in practice remain unresolved based on currently available information. Whether the RIPD Standard Contractual Clauses carry any sectoral carve-outs, for example for particularly sensitive categories of data or for specific industries, has not been established. Nor is it clear whether ANTAI intends to issue further guidance clarifying how the clauses interact with other obligations under Law 81, such as breach-notification duties or data-subject-rights requirements, when data moves across borders under this mechanism. This development should be read alongside the broader structural position of Panama's data-protection framework: ANTAI operates through a dedicated Direccion de Proteccion de Datos Personales established under Executive Decree 285 of 2021, and the cross-border transfer mechanism approved sits within that same institutional architecture rather than representing a separate or competing regulatory track. #### Outlook The near-term question for Panama's cross-border transfer regime is whether ANTAI will issue clarifying guidance on sectoral carve-outs or specific conditions attached to use of the RIPD Standard Contractual Clauses, a point not yet resolved in available reporting. As scheduled, the resolution remains in force as the operative transfer mechanism, and companies relying on it for international data flows out of Panama can expect it to remain the primary adequate-guarantee pathway absent further regulatory action from ANTAI. Periodic update · new data 2026-10-18 #### Cross-Border & Adequacy Panama's international data-transfer regime strengthened materially this cycle through ANTAI Resolution No. ANTAI-DG-003-2026, of 26 March 2026, which approves and implements the use of the Red Iberoamericana de Proteccion de Datos (RIPD) Model Contractual Clauses as a recognised adequacy-guarantee mechanism for international transfers of personal data originating in Panama. This is understood to be probable, resting on law-firm commentary published within the current window; the full text of the Resolution was not independently retrieved this cycle. Prior to this Resolution, Law 81 of 2019 required that international transfers of personal data be supported by documentation and, generally, consent, but no standardised contractual-clause instrument existed for controllers and processors to rely upon as a recognised safeguard. The adoption of the RIPD Model Contractual Clauses closes that practical gap, giving Panamanian data exporters a region-recognised clause set rather than requiring case-by-case negotiated or documented safeguards for each transfer. This is a meaningful structural development for any entity transferring personal data out of Panama to a jurisdiction not otherwise recognised as providing an adequate level of protection. An open question not resolved this cycle is whether Resolution ANTAI-DG-003-2026 displaces the prior case-by-case documented-consent approach entirely, or whether it supplements that approach as one among several available transfer mechanisms. Clarification on this point would require further ANTAI guidance or an independently retrieved full text of the Resolution, neither of which was available this cycle. #### Outlook The practical uptake of the RIPD Model Contractual Clauses by Panamanian data exporters in the months following the Resolution's 26 March 2026 effective date is the relevant forward indicator for whether this mechanism meaningfully displaces prior case-by-case transfer practices. Confirmation of the Resolution's relationship to Law 81's general consent requirement, through either further ANTAI guidance or primary-text retrieval, would resolve the remaining interpretive uncertainty around this development. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 49 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Panama: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The 'minimum standard' relationship to sector-specific laws is confirmed at a general level, but no sector-specific overlay instruments were individually verified. Primary framework Law No. 81 of 2019 (as minimum standard vis-à-vis sector-specific laws) Supervisory authority [ANTAI — Dirección de Protección de Datos Personales](https://www.antai.gob.pa/) Traffic-light rationale — Amber The 'minimum standard' relationship to sector-specific laws is confirmed at a general level, but no sector-specific overlay instruments were individually verified. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 66 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Panama: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No adtech/commercial-privacy-specific instrument was identified; general consent-based processing under Law 81 is the only applicable baseline and is already captured under lawful_processing_and_special_data. Supervisory authority [ANTAI — Dirección de Protección de Datos Personales](https://www.antai.gob.pa/) Traffic-light rationale — Red No adtech/commercial-privacy-specific instrument was identified; general consent-based processing under Law 81 is the only applicable baseline and is already captured under lawful_processing_and_special_data. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 28 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Panama: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No algorithmic/biometric/surveillance-governance-specific instrument was identified for this JID in the sources reviewed. Supervisory authority [ANTAI — Dirección de Protección de Datos Personales](https://www.antai.gob.pa/) Traffic-light rationale — Red No algorithmic/biometric/surveillance-governance-specific instrument was identified for this JID in the sources reviewed. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 30 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Panama: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No children/vulnerable-groups-specific instrument was identified for this JID in the sources reviewed. Supervisory authority [ANTAI — Dirección de Protección de Datos Personales](https://www.antai.gob.pa/) Traffic-light rationale — Not assessed No children/vulnerable-groups-specific instrument was identified for this JID in the sources reviewed. #### Sub-modules (5) #### Age VerificationRed No age-verification/age-of-consent provision was located. #### Parental ConsentRed No parental-consent mechanism was located. #### Minor Profiling BansRed No minor-profiling-ban provision was located. #### Education SettingsRed No education-settings-specific rule was located. #### Dependent AdultsRed No dependent-adults protection provision was located. #### Key findings (3) - — source on file - — source on file - — source on file No age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adults provision specific to Law 81 was located in the sources reviewed. ### Panama: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Powers, penalties and case-level enforcement activity are documented from primary ANTAI resolutions, but funding/capacity metrics and collective-redress mechanisms remain evidence gaps. Primary framework Law No. 81 of 2019; Executive Decree No. 285 of 2021 Supervisory authority [ANTAI — Dirección de Protección de Datos Personales](https://www.antai.gob.pa/) Traffic-light rationale — Amber Powers, penalties and case-level enforcement activity are documented from primary ANTAI resolutions, but funding/capacity metrics and collective-redress mechanisms remain evidence gaps. Periodic update · new data 2026-11-04 #### Enforcement & Redress ANTAI's enforcement activity under Law No. 81 of 2019 during 2026 has produced cumulative fines reported at approximately USD 11,000, a figure drawn from secondary press reporting rather than from ANTAI's own enforcement register or published sanction decisions, and accordingly carries an uncertain confidence rating. What distinguishes this reporting from a routine enforcement note is the range of entities fined: alongside corporate controllers, ANTAI's penalties reportedly reached a condominium owners' board, a non-commercial body managing a residential property. If accurate, this indicates that ANTAI applies Law 81/2019's enforcement powers to any entity holding and processing personal data, not solely to businesses operating for commercial gain, which has implications for how broadly the obligated population under the statute should be understood. What remains unconfirmed this period is the statutory basis for the specific penalty amounts, meaning the fine ceilings set by Law 81/2019 or its implementing decree have not been pinpointed against the reported figures, and the procedural pathway ANTAI follows from complaint or inspection through to a final sanction decision has not been retrieved from primary sourcing. The reporting also does not specify how many separate enforcement actions make up the roughly USD 11,000 total, nor whether the condominium board case and any corporate cases followed the same procedural track. This leaves a genuine evidentiary gap between the headline figure, which is reasonably well attested across the press reporting available, and the underlying case-level detail, which is not. Set against the structurally stable elements of Panama's regime, this enforcement signal is best read as evidence that an established statute is being actively applied rather than left dormant. ANTAI has held designated-authority status since Law 81/2019 took effect, and the existence of a named international-transfer mechanism approved through Resolution ANTAI-DG-003-2026 earlier in 2026 already indicated a regulator building out the operational infrastructure of its mandate. Enforcement activity reaching a residential condominium board, rather than only commercial actors, extends that picture of an operating, rather than merely enacted, regime. #### Outlook The clearest path to resolving the gaps in the evidence is direct retrieval of ANTAI's own published enforcement decisions or its enforcement register, where one exists, which would allow the reported USD 11,000 figure to be broken down by case, matched against statutory fine ceilings, and checked against the procedural requirements Law 81/2019 and its implementing provisions set out. Confirming whether the condominium-board case followed the ordinary enforcement procedure applicable to any controller, or involved some distinct treatment on account of its non-commercial character, would materially sharpen the picture of how widely ANTAI construes the population of entities subject to its enforcement authority as 2026 draws to a close. Periodic update · new data 2026-10-25 #### Enforcement & Redress ANTAI's enforcement activity under Law 81 of 2019 continued at a modest but active pace. Reporting indicates the authority had imposed approximately USD 11,000 in cumulative fines during 2026 as of the source's publication date. Notably, the largest single case within this total was brought against a horizontal-property board, a form of community or building-governance entity, rather than against a corporate data controller of the kind more typically associated with data-protection enforcement actions. This detail carries real significance: it demonstrates that ANTAI's enforcement reach extends to smaller, non-commercial entities that process personal data in the course of ordinary community governance, not solely to large businesses or digital platforms, suggesting a enforcement posture that applies Law 81's obligations broadly across the range of entities that qualify as data controllers under the statute. The penalty framework underlying this enforcement activity is set out in Article 36 of Executive Decree 285 of 2021, which establishes a tiered fine structure. Administrative fines range from USD 1,000 to USD 10,000 depending on the severity classification of the infraction, categorised as minor, serious, or very serious. Infractions classified as very serious carry two additional consequences beyond the fine itself: they are not subject to any limitation period, meaning ANTAI retains the ability to pursue such cases without a statutory time bar, and they can result in closure of the offending entity's database as a sanction. This tiered structure helps contextualise the approximately USD 11,000 in cumulative 2026 fines: the figure likely reflects multiple separate cases spread across different severity levels, rather than a single very-serious-category penalty at the upper end of the range. Taken together, these enforcement details paint a picture of a data-protection enforcement regime that is operationally active but modest in absolute financial terms relative to larger jurisdictions' data-protection penalty regimes. The fact that enforcement extends to entities such as property boards indicates that compliance obligations under Law 81 are not perceived by ANTAI as applicable only to sophisticated commercial controllers, which has practical implications for the range of entities that should consider themselves within scope of the statute's requirements. #### Outlook ANTAI's enforcement activity appears likely to continue at a broadly similar steady, modest cadence, consistent with a data-protection enforcement regime that is maturing procedurally without yet reaching high-volume or high-value sanction levels seen in some other jurisdictions. Given that enforcement has already extended to non-commercial entities such as property boards, it is plausible that further cases touching smaller or non-traditional data controllers will continue to surface as ANTAI's enforcement programme matures, though no specific pending case beyond those already reported has been identified. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 79 words · 13 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties