Compliance FrameworksAmericas
Puerto Rico Act 111-2005 / US Frameworks
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | PR Act 111 |
| Region | Americas |
| Country or scope | Puerto Rico |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers PR Act 111
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
PR-111-4052 Breach Notification Readiness | Database custodians must notify affected residents and report breaches to DACO within ten days of detection, which requires identifying precisely which components were compromised (10 L.P.R.A. § 4052) | Scan |
PR-111-4051 Data Bank Scope Awareness | Owners and custodians of data banks containing personal information must know what systems and software constitute those data banks (10 L.P.R.A. § 4051 definitions and scope) | Scan |
PR-111-CRYPTO Cryptographic Protection | The notification duty is triggered when personal information is not protected by a cryptographic code, making verifiable cryptographic integrity of data-handling components the law's core safeguard (10 L.P.R.A. §§ 4051-4052, cryptographic-protection condition) | Scan |
PR-111-ASSESS Scope and Severity Assessment | Determining whose personal information a breach compromised requires version-tracked knowledge of the software in the data-bank environment (10 L.P.R.A. § 4052, breach-assessment and notification duties) | Scan |
PR-111-DOC Custodian Accountability Records | Custodians answering to DACO and affected citizens must hold identifiable, timestamped documentation of the systems holding personal information (10 L.P.R.A. §§ 4051-4055, custodian responsibilities) | Scan |
Policy templates
All 22 from the standard set, adapted to PR Act 111.