Companies that hold personal information about Puerto Rico residents are subject to one of the shortest regulator-notification periods in the United States: notice to the Departamento de Asuntos del Consumidor (“DACO”) within 10 days of detecting a security breach, with no extension available, under Ley Núm. 111-2005 (the “Act”). Companies that provide information-technology or communications services to the Government of Puerto Rico face a shorter period still, 48 hours, under Ley Núm. 40-2024 (the “Cybersecurity Act”). In this Legal Update, we summarize both requirements, place them within the federal sector-specific framework that applies in Puerto Rico as in any state, and identify practical implications for companies updating their incident response plans.
Three features of the Puerto Rico framework warrant attention from companies based elsewhere. DACO publishes each notice within 24 hours of receipt, so an incident involving Puerto Rico residents becomes public by the tenth day after detection. The Act’s definition of personal information reaches tax information, HIPAA-protected health information, and work evaluations, which many state statutes do not. And every period discussed below runs from detection, discovery, or a determination rather than from the conclusion of a forensic investigation, which places a premium on a pre-built notification matrix and a contemporaneous decision log.
Background: Ley Núm. 111-2005
Ley Núm. 111-2005, the Ley de Información al Ciudadano sobre la Seguridad de Bancos de Información (Citizen Information Act on Data Bank Security), 10 L.P.R.A. § 4051 et seq., is Puerto Rico’s breach-notification statute. It is administered by DACO, which has implemented it through Reglamento Núm. 7207.[1] The Act applies to any entity that owns or maintains a database containing personal information about Puerto Rico residents, regardless of where the entity is located.
The Act’s definition of “información personal” is notably broad. It covers an individual’s name in combination with a Social Security number, a driver’s license or other government identification number, a financial account or payment card number, or access credentials. It also reaches tax information, medical information protected under HIPAA, and work evaluations.[2] As a result, payroll and personnel records that would not trigger notification under many state statutes may trigger it under the Act.
The Notification Requirements
Notice to DACO. An entity that detects a security breach must notify DACO within 10 days. The period is not subject to extension. DACO, in turn, publishes the notice within 24 hours of receipt. The practical consequence is that an incident involving Puerto Rico residents becomes a matter of public record no later than the tenth day after detection, independent of the company’s own disclosure strategy.
Notice to affected residents. Affected residents must be notified “as expeditiously as possible,” subject to a delay where law enforcement determines that notice would impede an investigation. The notice must be clear and conspicuous, must describe the breach in general terms and identify the categories of information involved, and must include a toll-free telephone number and a website address.[3] Substitute notice, by email, website posting, and major media, is permitted where the cost of direct notice would exceed $100,000 or more than 100,000 individuals are affected. Information that was encrypted falls outside the statute, provided the encryption key was not compromised.
Penalties and civil liability. DACO may impose administrative fines of $500 to $5,000 per violation, and the Act expressly preserves civil remedies.[4] In practice, notices to Puerto Rico residents are issued in Spanish or in a bilingual format.
Ley Núm. 40-2024: The 48-Hour Notice for Government Vendors
The Cybersecurity Act, the Ley de Ciberseguridad del Gobierno de Puerto Rico (Government of Puerto Rico Cybersecurity Act), as amended by Ley Núm. 140-2026, establishes minimum cybersecurity standards for Government of Puerto Rico agencies and for the private vendors that do business with them.[5] It is administered by the Puerto Rico Innovation and Technology Service (“PRITS”) through a government Chief Information Security Officer.
Under Article 7, contracted information-technology and communications providers must notify PRITS and the contracting agency within 48 hours of discovering an incident. Article 10 provides that a provider found responsible for obstruction, negligence, or bad faith in handling an attack is subject to penalties of up to the contract amount plus damages, and to a five-year bar from government contracting and subcontracting.[6] For vendors to the Government of Puerto Rico, the 48-hour requirement will ordinarily be the earliest notification obligation in any incident.
The Federal Overlay
Federal cybersecurity and privacy requirements apply in Puerto Rico as they apply in any state. The result is a layered set of obligations that run concurrently with the Puerto Rico periods described above.
Common Features and Their Consequences
Each of these periods runs from detection, discovery, or a determination, not from the completion of a forensic investigation. A company that defers notification decisions until the forensic report is final will, in most cases, have exhausted the DACO and PRITS periods. The statutes contemplate notices that state what is known and what remains under investigation; they do not contemplate delay in the interest of certainty. Nor does engagement with law enforcement suspend them: as discussed in our Legal Update of October 17, 2026, the law-enforcement delay under Ley Núm. 111-2005 reaches the notice to affected individuals, not the notice to DACO.
Two further features deserve attention. First, the governing jurisdiction is determined by the residence of the affected individuals, not by the location of the company’s headquarters or servers; a company with no physical presence in Puerto Rico may nonetheless owe notice to DACO. Second, DACO’s 24-hour publication practice means that the content and timing of the regulator notice will shape the public account of the incident, which argues for coordinating the DACO notice, the resident notice, and any public statement before the first of them is sent.
Practical Implications for Companies
Companies should consider the following:
We will continue to monitor developments, including publication of the CIRCIA final rule, and will provide further updates as warranted. If you have questions about the matters discussed in this Legal Update, please contact the MZLS lawyers with whom you regularly work.
Endnotes
This publication provides general information on legal developments of interest to clients and friends of Maceira Zayas (MZLS). It is not a comprehensive treatment of the subject matter and does not constitute legal advice. Readers should consult counsel before acting on any matter discussed here. Developments after the date of this Legal Update are not reflected. Collaboration with Marc A. Maceira, President of Honra.
