Ley 81 compliance for a website requires four implemented components: explicit opt-in consent captured before any tracking, a published privacy notice stating lawful basis and retention periods, a working mechanism for ARCO requests (access, rectification, cancellation, opposition), and documented security controls. Consent must be affirmative — pre-ticked boxes and implied consent do not satisfy the law.
Last updated 25 July 2026
Ley 81 de 2019 organises obligations around six principles: confidencialidad, transferencia, custodia, integridad, seguridad and portabilidad. For a website this translates into four buildable things: consent before tracking, disclosure of who receives data, defined retention with a deletion path, and a route for users to exercise their rights.
The distinction that matters for a build is between the principles and their implementation. The principles are legal; the implementation is four concrete things on a page — a consent gate, a privacy notice, a request channel, and headers. Most sites fail on implementation while having read the principles.
Consent must be affirmative and given before processing begins. A pre-ticked checkbox, a banner that assumes agreement by continued browsing, or analytics that load before a choice is made do not qualify. The practical test is whether a user could have declined and had nothing fire.
In practice this means the analytics tag cannot fire on page load. Consent state has to be stored, checked before any tracking initialises, and be revocable later. If your tag manager loads unconditionally and the banner only styles itself afterwards, the banner is decorative.
It also means a decline has to work. A banner whose only real button is “accept” is not capturing consent; it is capturing a click.
ARCO covers access, rectification, cancellation and opposition. Implementation needs three things a page can actually carry: a named channel that receives requests, a stated response timeframe, and an internal process that can locate and delete a specific person’s data. A policy that mentions ARCO without a mechanism is the most common gap.
The mechanism does not have to be a portal. A named address that a real person monitors, with a documented internal procedure behind it, satisfies the requirement in a way an unattended form does not.
What matters is that a request can be received, identified, actioned and answered within the stated period — and that someone in the organisation owns that.
Retention periods should be defined per data type and written down, with a deletion process someone owns. Backups fall under the same rules as live data. The frequent failure is form submissions accumulating indefinitely in a shared inbox with no retention policy and no deletion path.
Retention is where compliance and security posture meet. Data you no longer hold cannot be breached, cannot be requested, and cannot be mishandled. Defining a period per data type is usually a one-afternoon exercise that permanently reduces exposure.
The relevant question is usually not where the company sits but whose data is processed and where processing occurs. Organisations outside Panama that handle the personal data of people in Panama should assume the obligations are engaged and verify their specific position with counsel.
Two practical consequences for a site serving both audiences: consent handling should be applied uniformly rather than by geography, and the privacy notice should disclose international transfers, since most analytics and hosting arrangements constitute one.
The architecture is similar enough that a GDPR-compliant site is usually most of the way there: lawful basis, consent before tracking, subject rights, retention limits and disclosure of processors all have counterparts. What does not transfer automatically is terminology, the specific rights vocabulary (ARCO rather than GDPR’s articles), and local response timeframes.
If you already run a GDPR-aligned setup, the efficient path is to map what exists onto the six principles and fix the gaps, rather than rebuild. The usual gaps are the ARCO mechanism and named local contact.
The Ley 81 checklist on this site scores your implementation across all six principles, out of six. Free, no email required.
Open the Ley 81 checklist →