On 21 February 2023, the Personal Data Protection Law (Ley 149) comes into force 180 days after its publication in the Official Gazette. The Act states that entities collecting and storing personal data have to implement preventive and responsive security measures to ensure the protection of the data collected. Furthermore, the Act specifies that entities must implement technical measures to allow for processing personal data in electronic form and notify the authorities of data breaches.
Original source