Puerto Rico security rules: start with coverage.

Start with your data, services, and contracts.

These are questions for a legal review, not a finding that every listed law applies to your organization. Identify your operator, users, data, sector, and jurisdictions before deciding which duties follow. This guide is educational, not legal advice.

Do you operate a covered commercial website?

Ley 39-2012 reaches covered operators resident in or doing business in or from Puerto Rico whose commercial website or online service collects and maintains residents' personal information. It requires a clear privacy policy describing the relevant collection and sharing practices and policy changes; an existing review or correction process must be explained. The up-to-$50,000 penalty concerns a published policy or trust seal that does not match actual practices, not every violation.

Prepare a list of forms, analytics, embeds, payment services, and data recipients. Compare the policy with what the site actually does.

What happens if covered information is breached?

Ley 111-2005 covers specified government, private, and educational entities. For a qualifying breach, DACO notification has a non-extendable ten-day deadline. Notice to affected individuals is required as expeditiously as possible, with no fixed statutory day count; data coverage and protection matter. Do not read this as ten days to notify customers or as permission to delay incident response.

Prepare an incident owner, counsel contact, vendor contacts, and a process for documenting what happened. Other duties or contracts may create additional requirements.

Which specialized questions need attention?

• Children: a service for young people needs a coverage review. Ley 185-2024 concerns defined social-network sites or apps allowing PR residents aged 18 or younger to register; it is not a rule for every website. Its consent provisions need careful legal interpretation.
• Government contracts: Ley 40-2024's incident provision concerns contracted IT and communications service providers, rather than every government vendor.
• AI and likeness: establish permission and review applicable exceptions before commercial use of an identifiable person's image or voice. Use the AI legal-review checklist.
• Regulated or cross-border work: health, finance, education, client contracts, and service to people elsewhere can change the analysis.

Leave the review with an owner and a next step.

Use the website check to prepare a conversation, not as compliance certification. Ask counsel to identify the duties that apply, the evidence needed, the responsible person, and the next review date.

Primary texts: Ley 39-2012 · Ley 111-2005 · Ley 185-2024 · Ley 40-2024. Verify amendments and applicability before relying on a summary.