Ley 81 Compliance Checklist — free self-assessment

Run time ~30 min · Requires access to your site and your data practices · Free, no forms

Why this matters beyond compliance

Ley 81 de 2019 is Panama's personal data protection law. Most businesses treat it as a legal box to check. That framing costs them contracts.

Here's the distribution reality: corporate and institutional buyers run vendor reviews before they run negotiations. A procurement officer at a bank, a hospital, a government contractor, or a multinational's Panama office has a checklist. Data handling is on it. If you cannot demonstrate compliance, you are not rejected — you are filtered out before anyone reads your proposal.

The businesses that document compliance don't just avoid fines. They stay on shortlists their competitors never learn they were removed from.

The six principles — self-assessment

Score one point per principle you can fully evidence. Partial credit is zero credit — a procurement officer doesn't award partial credit either.

1. Confidencialidad

Personal data is protected from unauthorized access.

Site is served exclusively over HTTPS, with HTTP requests redirected A Content-Security-Policy header is present and restricts script sources Form submissions transmit over encrypted connections only Third-party scripts (analytics, chat widgets, pixels) are inventoried and justified No personal data appears in URL parameters or query strings

Common failure: A contact form posting to an unencrypted endpoint, or a chat widget loading third-party scripts with unrestricted access to form fields.

2. Transferencia

Data movement to third parties is disclosed and controlled.

Privacy policy names every third party that receives user data International transfers are disclosed (most analytics and hosting qualify) Data processors are documented — hosting, email, CRM, analytics Users are informed before data leaves the original collection context

Common failure: Running Google Analytics, Meta Pixel, and a CRM integration without disclosing any of them. Three undisclosed transfers on a site that believes it collects nothing.

3. Custodia

Data is held responsibly for a defined period.

Retention periods are defined per data type and documented A deletion process exists and someone owns it Backups are covered by the same retention rules as live data Form submissions are not accumulating indefinitely in an unmanaged inbox

Common failure: Six years of contact-form submissions sitting in a shared inbox four employees can access, with no retention policy and no deletion path.

4. Integridad

Data is accurate and protected from unauthorized modification.

X-Content-Type-Options header is set to nosniff X-Frame-Options or an equivalent frame-ancestors directive prevents clickjacking Form inputs are validated server-side, not only in the browser A correction mechanism exists for users to fix their own data

Common failure: Client-side validation only. The form looks protected in a browser and accepts anything sent directly to the endpoint.

5. Seguridad

Technical measures protect data proportionally to its sensitivity.

Strict-Transport-Security header is present with a meaningful max-age Referrer-Policy is set to limit data leakage to external sites Permissions-Policy restricts unnecessary browser APIs Administrative access uses multi-factor authentication Security-headers score is verifiable by an external scan

Common failure: Every header missing. This is the single most common finding, and the fastest to correct.

6. Portabilidad

Users can access and retrieve their own data — ARCO rights.

A documented process exists for Acceso, Rectificación, Cancelación, Oposición requests A named contact or channel handles ARCO requests Response timeframes are defined The privacy policy explains how to exercise these rights

Common failure: A privacy policy that mentions ARCO rights without providing any mechanism to exercise them.

One segment per principle · all-or-nothing

0 / 6 Your score

Score	Reading
6 / 6	Defensible. You can answer a vendor security questionnaire without preparation.
4–5 / 6	Correctable in days. The gaps are usually headers and documentation, not architecture.
2–3 / 6	You are being filtered out of procurement processes and receiving no signal that it happened.
0–1 / 6	Structural exposure. Any buyer who checks will find it, and institutional buyers check.

What visibility this unlocks

The asymmetry: this is a one-time infrastructure investment that permanently expands your addressable market. Most competitors in most Panamanian verticals have not done it, and the buyer cannot tell who has until they ask.