#Panama 🇵🇦 #BDS_LaborAlert: Proper Handling of the Christmas Bonus or Gratification
With the arrival of the Christmas and end-of-year season, it is usual for companies to grant an...
Last week, the Legislative Assembly approved a series of amendments to the Personal Data Protection Act (LPDP). Under these changes, private companies are no longer required to appoint a Personal Data Protection Officer.
However, companies remain subject to the Law and continue to have the responsibilities established under the LPDP. Accordingly, they will be required to directly manage requests relating to ARCO-POL rights.
Key Considerations for Companies
Following these amendments, organizations must:
- Internally designate the person or department responsible for handling such data subject requests.
- Establish formal mechanisms for receiving, processing, and responding to ARCO-POL requests within statutory deadlines.
- Update their privacy notices to reflect the available channels for submitting these requests.
- Maintain clear procedures and records that properly document how requests are handled and resolved.
ARCO-POL requests must be resolved within a 20 business days period, which may be extended for up to an additional 20 business days under justified circumstances.
Please note that removing the requirement to appoint a Personal Data Protection Officer does not exempt private companies from complying with all other provisions of the LPDP.
The decree will enter into force eight days after its publication in the Official Gazette.
Please do not hesitate to contact us should you have any questions regarding this matter.
