EdLaw
Puerto Rico — Ley 111-2005 (notificación de brechas)
Puerto Rico's data-breach notification statute (10 L.P.R.A. § 4051 et seq.), as amended by Ley 97-2008. Any entity that owns or holds a database containing personal information of Puerto Rico residents must notify affected residents and report to DACO on a breach.
Statute text is Spanish (the authentic language); this README is curation.
Applicability to EdTech
- "Entidad" expressly includes every public and private educational institution, at any level, alongside any private company authorised to do business in Puerto Rico (Art. 2(d)) — so both our school customers and Avantis itself (as vendor holding PR resident data) are covered.
- Protected data (Art. 2(a)): name/first initial + surname combined with SSN, official IDs, financial account numbers, usernames and passwords to public or private computer systems (squarely covering platform credentials), HIPAA-protected health data, tax data, or work evaluations — where readable without a cryptographic key. Encryption beyond a mere password takes data out of the notification duty (Art. 3).
- Deadlines are tight: notification to customers "de la manera más expedita posible", and a report to the Departamento de Asuntos del Consumidor (DACO) within a non-extendable 10 days of detection; DACO makes a public announcement within 24 hours (Art. 3).
- Form of notice (Art. 4): direct written/authenticated electronic notice; substitute notice (prominent posting + press) allowed when cost exceeds $100,000 or 100,000 persons.
- Breaches at government agencies (including the Departamento de Educación) route to the Procurador del Ciudadano instead (Art. 7).
Contents
| Document | Covers |
|---|---|
| NOTIFICACION-BRECHAS.md | Artículos 1–11 in full (definitions, notification duties, form of notice, penalties) |
Enforcement
DACO; fines of $500 to $5,000 per violation, without prejudice to consumers' private damages actions (Art. 10).
Related
- PR Ley 185-2024 — children's online privacy
- PR Ley 40-2024 — government cybersecurity (48-hour incident notification for government contractors)
Sources
Meta
Statute text in NOTIFICACION-BRECHAS.md is reproduced verbatim in Spanish from the OGP Biblioteca Virtual consolidated PDF (Rev. 26 de febrero de 2021, incorporating Ley 97-2008) by tools/pr-ogp/build_pr.py; verify re-fetches and fails on a newer Rev. stamp. In-force date derives from Art. 11 (120 days after the 7 September 2005 approval → 5 January 2006).