🇵🇦Law 81/2019 on Personal Data Protection
Law 81/2019 and Executive Decree 285/2021
The framework requires fair, purpose-bound, proportionate, accurate, secure and confidential processing. Controllers must be able to demonstrate the legal basis and provide the detailed privacy information prescribed by the Decree.
Rights, incidents and third parties
Access requests are generally answered within ten business days and correction requests within five. A controller that becomes aware of a security incident must notify ANTAI and affected data holders within 72 hours and retain the incident record.
Processor contracts must cover instructions, confidentiality, safeguards, incident escalation, assistance, deletion and subprocessing. International transfers require a recognised legal route and documented safeguards. Public entities must appoint a DPO; private appointment remains optional unless another rule makes it necessary.