The Legal Framework for Cybersecurity: Preparing Your Company for Personal Data Protection

Digital transformation has turned data into the strategic resource par excellence. For companies operating in the Dominican Republic, protecting this information is no longer just a technological issue: it is, above all, a legal obligation. The country has a regulatory framework that combines rules on data protection, cybercrime, cybersecurity, and the legal validity of digital transactions. Understanding this framework—and translating it into internal policies, controls, and contracts—is the difference between a reliable operation and exposure to sanctions, litigation, and reputational loss.

[this-toc]

Law 172-13: Protection of Personal Data

The cornerstone of this framework is Law No. 172-13 on the Protection of Personal Data , which aims to guarantee the comprehensive protection of personal data and the rights of their owners. The law establishes essential principles (legality, quality, information, consent, security, and confidentiality) and requires data controllers to adopt technical, organizational, and security measures to prevent unauthorized alteration, loss, or access to data.

Compliance and documentation

It also imposes compliance obligations, such as maintaining an internal manual of policies and procedures, allowing access only to those concerned, and processing inquiries and complaints from data subjects (ARCO/habeas data).

In practice, this means that any company that collects, stores, or processes personal data in the country must document its processing cycle, justify its purposes and legal bases, obtain consent when necessary, and maintain evidence of all of the above.

Law 172-13 also recognizes the right to rectification, updating, deletion, and habeas data , with short response times and the possibility of legal action for noncompliance. These rights require clear and traceable procedures for responding to requests from individuals.

A particularly sensitive issue is the international transfer of data . Article 172-13 defines and regulates the transfer of personal information outside Dominican territory: it requires the data subject’s consent or the fulfillment of one of the bases provided by the law itself (for example, contractual performance, public health, international cooperation, or compliance with treaties).

If your operation uses cloud computing, data centers, or platforms located in third countries, this verification is not optional : it must be included in the compliance matrix and in the contractual clauses with suppliers.

Key questions to assess compliance with Law 172-13

• Does your company have informed consent from data subjects?
• Do your terms clearly explain the use of automated technologies?
• Are your contracts with third parties that process personal data aligned with the requirements of Law 172-13 and/or the General Data Protection Regulation (GDPR) ?
• Do you regularly train your staff on data protection and compliance with Law 172-13?

Law 53-07: technological crimes and offenses

At the same time, Law No. 53-07 on High-Tech Crimes and Offenses classifies conduct that is often present in cybersecurity incidents: illicit access to systems, interception of data or signals , damage or alteration of data , and sabotage , among others, with criminal sanctions and fines.

If a third party breaches the corporate network or an employee exceeds their authorization to steal information, the company not only faces an operational incident but also a potential crime with consequences for the perpetrators and, eventually, liability for the organization if there was negligence in its controls. Incorporating this criminal dimension into the incident response plan is essential.

Law No. 126-02: Electronic Commerce, Documents and Digital Signature

The third pillar is Law No. 126-02 on Electronic Commerce, Documents and Digital Signatures , which grants legal validity to data messages and digital signatures provided they meet integrity and authenticity requirements.

Beyond e-procurement, this enables compliance proof schemes: digitally signed policies and consents, immutable logs, audit trails, and reliable notifications . In other words, compliance isn’t enough: you have to be able to prove that it was met .

---

How to incorporate legal obligations into a cybersecurity and privacy program that works in real life?

• Governance and Roles . Formally designate a data controller and a security and privacy committee with the authority to approve policies, manage risks, and coordinate incidents. Document the RACI matrix for each process involving personal data (collection, storage, access, transfer, and disposal). Law 172-13 requires manuals and controls; their absence is immediately noticeable in audits or litigation.
• Data inventory and classification. Map systems, flows, and databases (on-premise and cloud), identify special categories, and minimize unnecessary data. Label by sensitivity and define proportional measures: encryption in transit and at rest, role-based access control, environment segregation, and retention with secure deletion.
• Processing bases and consent. Link each processing process to its legal basis (express consent, contractual performance, legal obligation, or other applicable exemption). When using consent, make it freely available, specific, and informed, and keep verifiable evidence.
• Rights of the data subject. Establish a rights-based process with SLAs: receipt, identity verification, evaluation, response, and registration. The law provides for short deadlines and the possibility of habeas data; failure to comply opens the door to legal action.
• Security by design. 172-13 mandates technical and organizational measures ; translate these into concrete controls: vulnerability management, multifactor authentication (MFA), network segmentation, hardening, logging and monitoring, periodic penetration testing, and evaluation of critical vendors. Train staff and run simulated phishing campaigns to reduce human risk.
• Contracts with data processors. All providers that process data on behalf of the company must be subject to data processing agreements, with clauses covering security, subcontracting, auditing, cooperation on data subject rights, and international transfers where applicable.
• Electronic Evidence. Use digital signature capabilities and complete data message retention to support consents, notifications, and logs. This reduces evidentiary uncertainty in regulatory or judicial disputes.
• Incident response. Define an incident management plan that considers the vectors classified by Law 53-07 (illegal access, damage, interception). Include severity criteria, forensic preservation, communication with clients, and coordination with competent authorities when there is evidence of a crime. Although Law 172-13 does not establish a general mandatory breach notification regime, the duty of security and criminal risk make it advisable to communicate transparently and promptly to those affected when there is a likelihood of harm.
• Transfers and the cloud. Before storing data abroad or using global services, verify that the transfer falls under one of the permitted conditions (consent, contractual performance, public health, treaties, or cooperation). Document this assessment and reflect obligations in the contract.
• Continuous improvement. Audit the program at least once a year or after significant changes (new apps, integrations, marketplaces). Security and compliance aren’t a project ; they’re an ongoing process .

Conclusion

Well-governed cybersecurity adds value: it reduces operational losses, facilitates alliances with global partners, and strengthens market confidence. In the Dominican Republic, compliance is not just about avoiding sanctions; it’s about creating a sustainable competitive advantage supported by a legal framework that protects people and businesses that do things right. The path is clear: understand Law 172-13 and its principles and obligations; anticipate the criminal dimension of Law 53-07 in your incident plan; and consolidate legal evidence with Law 126-02 .