Any company may store personal information and manage a database containing it if the following rules are respected:

• When collecting personal information, private companies and/or the government must respect the “sphere of privacy” to which all individuals are entitled

• Such companies must obtain prior, unequivocal, express and valid consent from the owner of the personal information or his or her representative. Such consent must be written (either handwritten or electronic)

• Companies that maintain personal information about others in their databases must ensure that such information is:

• Materially truthful

• Complete and

• Accurate

• Data subjects must be given access to their personal information and are entitled to dispute any erroneous or misleading information about them at any time

• Companies that manage databases containing personal information and that distribute, commercialize or widespread such personal information in any manner, must comply with Law 8968. Particularly, they must comply with the following: 

• Report and register the company and the database with PRODHAB

• Report the technical measures to secure the database

• Protect and respect confidentiality of personal information

• Secure the information contained in the databases

• Establish a proceeding to review requests filed by data subjects for the amendment of any error or mistakes in the database