Law No. 172-13 on the Protection of Personal Data
Supervisory + Sanctions + Governance + Modernisation 2024

Law No. 172-13 on the Protection of Personal Data Supervisory-Authority-Cooperation-Sanctions-Penalties-Articles-77-79-Awareness-Training-Retention-DPO-Designation: Dominican Republic Law 172-13 Supervisory Authority + Sanctions + Articles 77-79 + DPO + Awareness

Dominican Republic Law 172-13 enforcement and governance framework. Mixed-regulator approach with Superintendencia de Bancos (credit-information sector + general consumer banking) + INDOTEL telecommunications + Protecom consumer protection + sectoral regulators + Public Defender (Defensor del Pueblo) constitutional rights protection + Office of the Attorney General criminal investigation + pending establishment of National Data Protection Agency via 2024 Modernisation Bill. Article 77 Sanctions and Penalties (Sanciones y Penalidades) - administrative + criminal. Administrative: warnings + reprimands + revocation of authorisation + temporary or permanent ban + fines DOP 50K-50M per violation + cumulative. Criminal Article 364 Penal Code unauthorised disclosure 3 months-2 years imprisonment + DOP 100K-1M fines + aggravated for sensitive data + corporate criminal liability. Article 78 Investigation + inspection powers + production of records + access to systems + interviews. Article 79 Judicial review by Tribunal Superior Administrativo + appeal to Supreme Court of Justice (Suprema Corte de Justicia) + Constitutional Tribunal for constitutional challenges. Modernisation 2024 Bill anticipated additions: independent National Data Protection Agency + GDPR + Convention 108+ alignment + DPO mandatory + 72-hour breach notification + Privacy by Design + Privacy by Default + administrative fines up to DOP 1B or 4% turnover + Accountability principle + DPIA mandatory + Records of Processing Activities + Data Protection by Default. Supervisory cooperation with Iberoamerican Data Protection Network (RIPD) + Convention 108+ Committee + LatAm + Caribbean cooperation.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 207 controls across 82 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Iowa Consumer Data Protection Act · 6 controls

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 6 controls

Bahrain PDPL · 5 controls

FTC GLBA Safeguards Rule (16 CFR Part 314) · 5 controls

Indiana Consumer Data Protection Act · 5 controls

FDA 21 CFR Part 11 · 4 controls

  • Part11.30 Controls for open systems (21 CFR §11.30)
  • Part11.AuditTrail Audit trail requirements - secure computer-generated time-stamped (21 CFR §11.10(e))
  • Part11.CSV Computer system validation + risk-based approach (21 CFR §11.10(a) + 2003 FDA Scope and Application Guidance + 2023 CSA draft)
  • Part11.RecordRetention Record protection + retention + readiness for inspection (21 CFR §11.10(b) + (c))

Family Educational Rights and Privacy Act (FERPA) · 4 controls

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 4 controls

IEEE 7000 · 4 controls

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 4 controls

Kentucky Consumer Data Protection Act · 4 controls

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 3 controls

  • AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction
  • AT-DSG-12 Section 62 - Administrative penalties
  • AT-DSG-7 Section 18 - Establishment of the Data Protection Authority

BSI IT-Grundschutz · 3 controls

  • BSI-13 Risk assessment procedures
  • BSI-15 Security categorization
  • BSI-17 Continuous monitoring strategy

Barbados Data Protection Act 2019 · 3 controls

  • BB-DPA-1 Section 1 - Short Title
  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities
  • BB-DPA-4 Section 4 - Principles Relating to Processing

FISMA · 3 controls

ISO/IEC 27011:2024 · 3 controls

ISO/IEC 29134:2023 · 3 controls

Jamaica Data Protection Act 2020 · 3 controls

Japan AI Guidelines · 3 controls

Privacy Act 1988 (Australia) · 3 controls

  • AUPRV-1 APP 1 Open and Transparent Management + Privacy Management Framework
  • AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children
  • AUPRV-8 OAIC Cooperation, Vendor Management, Training, Complaints, Enforcement

South Korea PIPA · 3 controls

API 1164 · 2 controls

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014) · 2 controls

Azerbaijan Law on Personal Data (2010) · 2 controls

  • AZ-DPA-15 Article 17 - Dispute resolution
  • AZ-DPA-6 Article 6 - State regulation in personal data protection

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 2 controls

  • DIQ-2 Data Quality Management
  • DIQ-3 Metadata Management

French Sapin II Law (Law No. 2016-1691) · 2 controls

GS1 Global Standards - Supply Chain Traceability and Data Security · 2 controls

German Supply Chain Due Diligence Act (LkSG) · 2 controls

Ghana Cybersecurity Act · 2 controls

IATF 16949:2016 - Quality Management System for Automotive Production · 2 controls

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

ICH E6(R3) - Good Clinical Practice · 2 controls

IEEE 1686 · 2 controls

IRM Enterprise Risk Management Framework (Institute of Risk Management) · 2 controls

ISMAP (Japan) · 2 controls

ISO/IEC 27014:2020 · 2 controls

ISO/IEC 27400:2022 · 2 controls

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 2 controls

India DPDP Act · 2 controls

Indonesia PDP Law · 2 controls

Jordan Draft Personal Data Protection Law (2022) · 2 controls

PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR) · 2 controls

  • ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration
  • ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process

Pakistan Personal Data Protection Bill 2023 · 2 controls

  • PAKPDPB-6 Cross-Border Transfer and Data Localization
  • PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO

SQF Code Edition 9 - Safe Quality Food · 2 controls

  • 2.4.4 Hazard Analysis and Risk Assessment
  • 2.7.2 Food Fraud Plan

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 2 controls

  • CRM-1 AML/CFT Compliance
  • CRM-4 Business Risk Assessment

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 2 controls

  • D.1 Incident Response Planning
  • UKDEFSTD-1 Cyber Defence Cyber Risk Profile (CRP)

US Consumer Product Safety Commission (CPSC) - Connected Product Safety · 2 controls

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule · 2 controls

Vermont Artificial Intelligence and Consumer Data Act (AICDA) · 2 controls

AML/CTF Act 2006 (Australia) · 1 control

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-11 Identification, Assessment and Management of Operational Risk

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-27 Outbound data loss prevention (Very Good)

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.3.1 Risk Assessment and Impact Analysis

Annex 11 to EU GMP - Computerised Systems · 1 control

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-3.C Strong and Agile Encryption

FATF Recommendation 16 - Virtual Asset Travel Rule · 1 control

  • R.16-VATR.Unhosted Unhosted (self-hosted / non-custodial) wallet transfers - 2024 Targeted Update

FBI CJIS Security Policy · 1 control

FSSC 22000 - Food Safety System Certification · 1 control

FedRAMP High · 1 control

  • AC-2 Account Management

FedRAMP Moderate · 1 control

  • AC-2 Account Management

FedRAMP Rev 5 · 1 control

Florida Digital Bill of Rights (FDBR) · 1 control

GLI-33 - Gaming Laboratories International Event Wagering Systems · 1 control

GLOBALG.A.P. Integrated Farm Assurance (IFA) Standard v6 · 1 control

GRI Standards · 1 control

Hungary Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Info Act) · 1 control

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems · 1 control

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2) · 1 control

ISO/IEC 27031:2011 · 1 control

ISO/IEC 29147:2018 · 1 control

  • 29147-5.11 Researcher Safe Harbour and Legal Posture

ISSB Standards · 1 control

India CERT-In Cyber Security Directions 2022 · 1 control

Law on Personal Data Protection (Official Gazette No. 42/2020) · 1 control

NIST SP 800-53 Rev 5 LOW · 1 control

  • AC-2 Account Management

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • AC-2 Account Management

NIST SP 800-53 Revision 5.1 HIGH · 1 control

  • AC-2 Account Management

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 1 control

  • NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination

Russia Federal Law on Personal Data (152-FZ) · 1 control

  • RUSPD-4 Special Categories, Biometric Data

Singapore AI Governance Framework · 1 control

Vietnam Law on Cybersecurity (No. 24/2018/QH14) · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 207 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Law No. 172-13 on the Protection of Personal Data controls