The purpose of this Law is to establish the principles, rights, obligations and procedures that regulate the protection of personal data, considering its interrelation with the private life and other fundamental rights and freedoms of citizens, by natural or legal persons, of public or private law, lucrative or not, that process personal data.

Any natural or legal person, under public or private law, lucrative or not, that processes personal data must do so in accordance with this Law and the pertinent legal system.

This Law seeks to comply with the principles of loyalty, purpose, proportionality, data security, transparency, confidentiality, legality, portability, veracity and accuracy in terms of data protection; which aim is for personal data to be collected; without deception or falsehood, for specific and limited purposes, in an exact and truthful manner, under the premise of the protection and confidentiality necessary due to sensitive issues and with prior consent of the data owner or for legal basis whenever some personal data is regulated by laws or special regulations.

In order for a person to manage or manipulate personal data, they must meet the following conditions:

1. Consent of the data owner;
2. That the processing of the data is necessary for the execution of a contractual obligation, provided that the owner of the data is a party;
3. That the processing is necessary for compliance with a legal obligation to which the data controller is subject;
4. That the processing of personal data is authorized by a special law or regulation.

Once the aforementioned conditions have been met, the person responsible for the processing of personal data contained in a database must establish management protocols, processes and procedures as well as secure transfers that protect the rights of the owners over their data. This will be duly monitored and supervised by the National Authority for Transparency and Access to Information with the Support of the pertinent Government Authority if the information is subject to a Special Law.

It is important to make it clear that any person or their collaborators who have access to or are involved in the processing of personal data are obliged to maintain confidentiality about it when it comes from or has been collected from sources that are not in the domain or accessible to the public, as well as as well as on other related data and background.

Personal data should only be used for the specific, explicit and lawful purposes for which they had been authorized at the time of collection. If it is necessary to use them in other areas, the consent of the owner must be requested again. In the case of subsequent processing for the purposes of research, studies or surveys, the consent of the owner of the data will not be necessary, as long as the data are anonymized by the person responsible for their custody or processing, that is, any sign that could allow the identification of the person consulted.

Among the rights of the owners of personal data, the following are recognized in an inalienable manner:

1. Right of access;
2. Right to rectification;
3. Right of cancellation;
4. Right to object;
5. Right of portability.

These rights may be exercised by the owner of the personal data at any time and cannot be waived, except for the exceptions established in some special laws.

With this, the aim is that the data can be requested, modified or deleted from the database at the request of the owner or whoever represents him and that, in turn, the person responsible for the processing of personal data and/or custodian of the database that can transfer or communicate the data does so in accordance with the agreement.

For the regularization of this Law, the Personal Data Protection Council was created as a consultative entity and has the power to evaluate the cases presented to it, give recommendations, advise the National Authority for Transparency and Access to Information, among others and The National Authority for Transparency and Access to Information, through the competent Directorate, will issue the corresponding decisions on this matter.