What is the data breach notification deadline in Puerto Rico?

Puerto Rico requires notice to affected individuals as expeditiously as possible (P.R. Laws tit. 10 §4051 et seq.).

Do you have to notify the Puerto Rico Attorney General of a data breach?

Yes. PR Dept. of Consumer Affairs (DACO) must be notified.

← All jurisdictions

PR · data breach notification

Puerto Rico

med

P.R. Laws tit. 10 §4051 et seq.

Individual deadline

No fixed limit

Trigger standard

Any breach

AG / regulator

Required

Notice to individuals	as expeditiously as possible
Risk-of-harm standard	None, notice required on any qualifying breach of covered personal information.
Encryption safe harbor	Yes, encrypted data (key not compromised) generally exempt.
Regulator notice	PR Dept. of Consumer Affairs (DACO), required for any affected resident; within 10 days Written notice to DACO Non-extendable 10 days from detection (statute-confirmed); DACO makes a public announcement within 24 hours
Credit reporting agencies	No CRA-notice requirement.
Substitute notice	Available if cost exceeds $100,000 or more than 100,000 affected.
Private right of action	No, enforcement by the state.
Penalties	$500–$5,000 per violation (DACO)

Notes

※ Mandatory DACO public announcement — unusual publicity consequence

Rule last verified July 10, 2026 · confidence med. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a Puerto Rico breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →