ISO/IEC 27001 and Panama's personal data protection law (Law 81)

2026-09-30 8 min readBy the ICS technical team

Panama's Law 81 of 2019 on personal data protection has been in force since 29 March 2021, and it was regulated by Executive Decree 285 of May 2021. Many companies responded by publishing a privacy policy and adding a consent checkbox to their forms. That is a good start, but the law asks for something much harder to improvise: that the data is actually protected. That is where ISO/IEC 27001 comes in.

What the law requires on security

Law 81 applies to anyone who processes personal data in Panama, whether it belongs to customers, patients, employees or suppliers. Its principles include the security and confidentiality of data, and the regulation turns them into obligations that, in practice, require processes rather than just documents:

• Real security measures. Storing or archiving data without security conditions is classified as a serious offence. The law does not prescribe a specific technology, but protection has to exist and be verifiable.
• Breach notification. Executive Decree 285 (articles 37 and 38) requires security breaches to be reported to ANTAI, Panama's authority for transparency and access to information, and to the affected data subjects, documenting what happened. Without an incident procedure, it is hard to do this on time and properly.
• Data subjects' rights. Individuals can exercise their rights of access, rectification, cancellation, objection and portability. To respond, you need to know where their data is and who handles it.
• Suppliers that process data. If a third party stores or processes information on your company's behalf, such as a cloud service, a payroll system or a call centre, your company must make sure that data is protected as well.
• Penalties. ANTAI can impose fines from B/.1,000 to B/.10,000 (balboas, at par with the US dollar) depending on severity and repeat offences, as well as other measures such as closing the database registration or suspending the processing activity. The reputational damage of a leak usually costs far more than the fine.

The regulation also defines the role of the personal data protection officer: it is mandatory in the public sector and voluntary in the private sector, although having appointed one is taken into account when a penalty is graded.

What ISO/IEC 27001 brings

ISO/IEC 27001 is the international standard for managing information security. It is not a shopping list of cybersecurity products: it is a management system, built on the same logic as ISO 9001, that requires you to identify which information is critical, which risks threaten it and which controls to apply. In its current 2022 edition, Annex A lists 93 controls grouped into four themes (organizational, people, physical and technological), and the organization justifies which ones it applies in a Statement of Applicability.

Mapped against Law 81, the correspondence is fairly direct:

• Security measures → risk assessment and controls. Instead of isolated measures, each control responds to an identified risk, and the reason it was chosen is recorded.
• Breach notification → incident management. The standard requires you to plan how incidents are detected, recorded, assessed and handled, which is exactly what you need to notify the authority and those affected.
• Data subjects' rights → information inventory. The asset inventory tells you what data you hold, where it is and who accesses it.
• Suppliers → supply chain security. Security requirements in contracts, and evaluation and monitoring of third parties, including cloud services.
• Demonstrating due diligence → auditable evidence. Internal audits, management review and, if you decide to certify, an assessment by an independent third party. In front of a customer, an international partner or an investigation, a working system carries more weight than a policy sitting in a drawer.

What ISO/IEC 27001 does not solve

Let us be clear: certifying to ISO/IEC 27001 is not the same as complying with Law 81. The standard deals with information security; the law also regulates the lawfulness of processing, consent, the information that must be given to data subjects, data transfers and retention periods, all of which require legal review. For privacy management there is a specific standard, ISO/IEC 27701, which since its 2025 edition can be implemented and certified on its own. What ISO/IEC 27001 does is solve the most technical part, the one that is hardest to improvise: actually protecting the information.

Where to start

You do not need to start with certification. A practical order:

1. Take an inventory of personal data.What data you collect, what for, where it is stored and who has access, including your suppliers.
2. Measure the distance to the standard.A gap analysis against ISO/IEC 27001 shows which controls already exist and which are missing, prioritized by risk.
3. Define the incident procedure.Who detects, who decides, how it is documented and who notifies. It is the first thing you will need when something goes wrong.
4. Review supplier contracts.Confidentiality and security clauses with everyone who handles data on your behalf.
5. Train your people.A good share of incidents starts with human error: a phishing email, a shared password or a file sent to the wrong person.

With that foundation, full implementation and certification are the natural next step, and the path is the same as for any management system standard: implementation, pre-audit and certification audit.

This article is for information only and is not a substitute for legal advice on how Law 81 applies to your specific case.