Cybersecurity · Dominican Republic
Cybersecurity - Dominican Republic
The Dominican Republic has no comprehensive, in-force cybersecurity statute; obligations arise from a combination of executive decrees, a national strategy, the high-tech crime law, and a sector-specific financial regulation. A dedicated Cybersecurity Management Law was approved in first reading in the Senate (April 2024) but, as of 2025, remains under study and is not yet enacted. Mandatory incident-reporting duties currently apply to public-administration entities (via decree) and to regulated financial institutions (via the Monetary Authority's regulation).
A 'Proyecto de Ley sobre Gestión de la Ciberseguridad' was approved in first reading by the Senate in April 2024 and would create a statutory National Cybersecurity Center covering public administration and critical infrastructure, but it remained under committee study in September 2025 and is not in force.
Decree 230-18 adopted the first National Cybersecurity Strategy and created the National Cybersecurity Center (CNCS) under the Ministry of the Presidency; Decree 313-22 updated and extended the strategy to 2030. The framework is executive/policy-based rather than a comprehensive statute.
Decree 685-22 (Dec 2022) requires public-administration entities to report cybersecurity incidents in their technological infrastructure to the CSIRT-RD/CNCS within 24 hours of detection, and to notify affected individuals when data is compromised.
Since 2018 the Monetary Authority (Central Bank + Superintendency of Banks) imposes a binding 'Reglamento de Seguridad Cibernética y de la Información' on financial-intermediation entities, including risk management and incident notification to the payment-system response center (SPRICS).
Law 53-07 on High-Technology Crimes and Offenses (2007) criminalizes unauthorized system access, electronic fraud, and related conduct, providing the country's core penal framework for cyber offenses — distinct from operational cybersecurity obligations.
The CSIRT-RD, housed within the CNCS, handles incident response for the State's critical and IT infrastructure, runs a security operations/monitoring function, and operates platforms for incident reporting and vulnerability disclosure.
Machine-assisted translation · verified 5/25/2026 · orientation, not legal advice. English version →