ShareAndGoShareAndGo

Data breach notification

Puerto Rico data breach notification law

Puerto Rico's rule is Ley Núm. 111 of September 7, 2005, the Ley de Información al Ciudadano sobre la Seguridad de Bancos de Información, cited as 10 L.P.R.A. §§ 4051-4055.

The law is written in Spanish, so the passages quoted on this page are in the original Spanish with a plain English reading beside them.

Which records the law reaches

The law speaks of a personal information file: a record holding at least a person's name or first initial and paternal surname, combined with one or more listed data points.

The listed data points include:

  • a Social Security number
  • a driver's license number, voter card number or other official identification number
  • bank or financial account numbers, with or without access codes
  • usernames and passwords for public or private computer systems
  • medical information protected by HIPAA
  • tax information and employment evaluations

The definition covers a file whose contents can be read without a special cryptographic key: "legible sin necesidad de usar para acceder a ella una clave criptográfica especial."

Employment evaluations stand out on that list, so an HR file that pairs a name with a performance review is inside the definition.

Customers first, then DACO within ten days

Customers must be told "de la manera más expedita posible", which we read as "as expeditiously as possible". No fixed number of days applies to customers.

The regulator deadline is fixed. Responsible parties report to the Departamento de Asuntos del Consumidor (DACO) "dentro de un plazo improrrogable de diez (10) días de detectarse la violación", a ten-day period that cannot be extended.

When the breach happens at a government agency or public corporation, it goes to the Oficina del Procurador del Ciudadano.

No harm test, one encryption carve-out

Read in full, Ley 111 has no risk-of-harm exception, so the duty does not turn on an assessment of likely misuse.

Encryption does change the result: the duty attaches where the information "no estuviera protegida con claves criptográficas más allá de una contraseña", that is, where it was not protected by cryptographic keys beyond a password.

Where ShareAndGo fits

A business in San Juan or Mayagüez sharing payroll files, tax workpapers or medical records with an outside party can keep that exchange inside one room.

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

That watermark is a per-room setting, on by default. Readers verify their email with a six-digit code and need no account, and each group sees only its own folders.

If questions come up later about a file opened there, the chained activity log can be exported as CSV and shows who opened what, and when.

Questions about Ley 111

Is there a deadline in days for telling customers?
No. The text says "de la manera más expedita posible", as expeditiously as possible, and sets no day count for customers.
How long does a business have to inform DACO?
Ten days from detecting the breach, and the period is described as "improrrogable", meaning it cannot be extended.
Who hears about a breach at a public corporation?
The Oficina del Procurador del Ciudadano.
Do usernames and passwords count?
Yes. "Nombres de usuario y claves de acceso a sistemas informáticos públicos o privados" is on the list of data points.

What this page was checked against

This summary was read from the Office of Management and Budget (OGP) library copy of Ley 111, revised February 26, 2021. That copy states "este no es una compilación oficial", so it is not the official L.P.R.A. text, which was not read.

Checked against the OGP library copy of Puerto Rico's Ley 111, revised February 26, 2021 on November 2, 2026. This is general information, not legal advice.

More on breach rules

Breach notification laws by state

Every state and territory on one page.

ShareAndGo vs DataRooms.com

How two data rooms handle access and records.

ShareAndGo home

What ShareAndGo does.