Law: Please note this State does not have a general privacy law in effect, you can visit our US State Law Tracker to monitor the progress of US State bills.

Regulator: Department of Consumer Affairs ('DACO')

Summary: There is currently no comprehensive data privacy legislation in Puerto Rico. However, Puerto Rico has enacted data breach and data disposal laws in recent years. The Citizen Information of Data Banks Security Act under §4051 of Chapter 310 of Title 10 P.R. Laws Ann. of Puerto Rico Annotated (the Security Act), establishes a data breach notification requirement if the breach relates to unencrypted personal information files protected only by a password. In June 2007, the Department of Consumer Affairs (DACO) expanded the obligations under the Security Act permitting DACO to publicize a breach within 24 hours where an entity was not able to identify the individuals whose sensitive information may have been affected.