Privacy Map

Puerto Rico. Breach notification. Act

PR breach lawPuerto Rico data breach notification law (10 L.P.R.A. § 4051 et seq. (Act 111-2005, Citizen Information on Data Banks Security Act))

In force
Partly verifiedMedium confidence. 2008 amendment not verified against official text; official Spanish text hosted by Oficina de Gerencia y Presupuesto.

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about Puerto Rico residents to notify affected individuals after a security breach. Core timing rule: DACO within 10 non-extendable days of detection. Covered data: name plus SSN, driver's/voter ID, bank account numbers, system usernames and passwords, HIPAA medical data, tax information, work-related evaluations.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

Regulator notice within 10 days and DACO public announcement within 24 hours; covers work evaluations and tax information; no risk-of-harm exception.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Puerto Rico requires entities that provide or resell access to databases to notify the owner or custodian of violations. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
DACO within 10 non-extendable days of detection; individuals as expeditiously as possible
DPO
No
Cross-border transfers
None
Maximum penalty
$500-$5,000 per violation; consumer damages actions

§3Dates

Key dates
  • Adopted
  • In force
  • Amended by Act 197-2008 per secondary sources; no later amendment identified

§4Text and authority

Text
Authority
Puerto Rico Department of Consumer Affairs (DACO)

§5Where it applies

Domestic law of
Puerto Rico

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. 2008 amendment not verified against official text; official Spanish text hosted by Oficina de Gerencia y Presupuesto.