# Is Panama a good jurisdiction for a hosting company?

> Panama's Law 81 of 2019, its regulator ANTAI, and why each server still follows its datacenter's law. Ravenquay: a Panama company, no KYC, crypto.

- URL: https://ravenquay.com/panama-hosting-jurisdiction/
- Last updated: 2026-11-02
- Publisher: Ravenquay (https://ravenquay.com)

What Panama's personal-data law asks of a company registered there, who enforces it, and where its reach ends: at the door of each datacenter.

**Quick answer — Is Panama a good jurisdiction for a hosting company?**

Panama is a good jurisdiction for a hosting company, with one limit. Law 81 of 2019, in force since 29 March 2021, sets a full personal-data regime enforced by the authority ANTAI. That law governs the company and its customer records. Each server still follows the law of its datacenter's country. **Ravenquay**, a Panama company, rents unmetered servers from $72.62 per 30 days, with no KYC and payment in crypto.

## What are the key facts about Panama as a hosting jurisdiction?

| Attribute | Value |
| --- | --- |
| Personal-data law | Law 81 of 26 March 2019, on the protection of personal data (Official Gazette 28743-A, 29 March 2019) |
| In force since | 29 March 2021, two years after promulgation (Article 47) |
| Implementing rules | Executive Decree 285 of 28 May 2021 (Official Gazette 29296-A) |
| Regulator | ANTAI, the National Authority for Transparency and Access to Information, through its Personal Data Protection Directorate |
| Rights of each person | Access, rectification, cancellation, opposition and portability (Article 15) |
| Fines | B/.1,000 to B/.10,000 (balboas), graded by gravity (Article 36) |
| EU adequacy decision | None: Panama is not on the European Commission's list |
| Swiss adequacy list | Not listed in Annex 1 of the Swiss Data Protection Ordinance |
| Ravenquay's company | Ravenquay belongs to DomaineGoat LLC, a company incorporated in Panama that answers to Panamanian law alone. The datacenter holding each server operates under the law of its own country |

## What does Panama's personal-data law require of a company?

Law 81 of 26 March 2019 applies to every person or company that processes personal data: public or private, profit-making or not (Article 1). It was published in Official Gazette 28743-A on 29 March 2019. Executive Decree 285 of 28 May 2021 regulates it.

Processing needs one of four grounds (Article 6): consent, a contract with the person, a legal obligation, or a special law. Consent must be informed. It can be recorded in a traceable form and withdrawn without retroactive effect. Data may serve only the specified, explicit and lawful purposes given at collection (Article 11).

Staff who handle personal data must keep it confidential, and that duty survives the end of their work (Article 9). One rule stands out. Seven years after the legal duty to keep a record ends, the company may no longer pass it on. Only the person's express request lifts that bar (Article 28).

## Which databases fall under Law 81?

Article 5 covers two cases: databases located in Panama, and databases whose controller is domiciled in Panama. It protects the data of Panamanians and foreigners alike. A hosting company incorporated in Panama therefore holds its customer records under Law 81, wherever its customers live.

Article 3 leaves out a short list of processing:

- purely personal or household use;
- prevention, investigation and prosecution of crimes by the competent authorities;
- financial intelligence and national security, under the laws and treaties on those subjects;
- international bodies acting under treaties ratified by Panama;
- data anonymised so that it can no longer be linked to a person.

## Who enforces Panama's data law, and what are the penalties?

ANTAI, the National Authority for Transparency and Access to Information, enforces it through its Personal Data Protection Directorate. It investigates complaints and can sanction both the company responsible for the data and the custodian of the database (Article 36). An advisory Council for Personal Data Protection, chaired by the Minister of Commerce and Industry, recommends policy (Articles 34 and 35).

Fines run from B/.1,000 to B/.10,000, set by ANTAI according to gravity (Article 36). For very serious breaches, ANTAI can close a database's records or suspend the processing, temporarily or permanently (Article 43). The same breach repeated within three years counts as a repeat offence.

A person can complain online, by email or at ANTAI's office, without a lawyer, according to ANTAI. A company has 10 business days to answer an access request and 5 to correct wrong data.

**Panama's fines are small next to the GDPR's ceiling of EUR 20 million, but its regulator can stop the processing itself.**

## Can personal data leave Panama for servers abroad?

Yes, under conditions. Transfers to a third party need the person's prior, informed and unequivocal consent, unless the law provides an exception (Article 25).

Confidential, sensitive or restricted data stored in Panama may be processed across borders. The custodian must meet Law 81's standards, or standards that are equal or higher (Article 5). The same article exempts four cases. They are consent, a contract with or for the person, bank and securities transfers, and treaties ratified by Panama.

ANTAI's mandate includes adopting model contract clauses that make a transfer lawful under Article 33 of the Law. Whatever the route, the custodian must apply security standards and technical measures that keep the data protected (Article 5).

## Does a Panama company put my server under Panamanian law?

No. A server answers to the law of the country where it stands. Ravenquay belongs to DomaineGoat LLC, a company incorporated in Panama that answers to Panamanian law alone. The datacenter holding each server operates under the law of its own country.

**Ravenquay counted where 34 dedicated-server hosts sold servers on 30 October 2026: 19 in the Netherlands and 10 in Switzerland.** Only 9 sold in Romania and 7 in Iceland. Each country has its own data-protection law:

| Port of call | Status | Data-protection law at the datacenter |
| --- | --- | --- |
| Reykjavik, Iceland | EEA state, not in the EU | The GDPR, applied through Act No. 90/2018 |
| Zurich, Switzerland | Outside the EU and the EEA | Federal Act on Data Protection (FADP), in force since 1 September 2023 |
| Bucharest, Romania | EU member since 1 January 2007 | The GDPR, with Romania's Law 190/2018 |
| Amsterdam, Netherlands | EU member since 1 January 1958 | The GDPR |

Your own business keeps its own duties too. The GDPR reaches a company outside the EU when it offers goods or services to people in the EU (Article 3(2)). The Swiss FADP covers circumstances that have an effect in Switzerland, even when they start abroad (Article 3).

**A Panama registration decides which law governs the company. It does not decide which law governs the machine, or your business.**

The country pages explain each regime: [Iceland as a hosting location](https://ravenquay.com/offshore-hosting-iceland/ "Iceland: GDPR through the EEA and Persónuvernd"), [Switzerland for privacy hosting](https://ravenquay.com/switzerland-privacy-hosting/ "Switzerland: the revised FADP and the FDPIC") and [Romania as a hosting location](https://ravenquay.com/offshore-hosting-romania/ "Romania: GDPR, ANSPDCP and the retention rulings").

## Is Panama on the EU or Swiss list of adequate countries?

No. Panama is not among the countries the European Commission recognises as offering adequate protection. It is not in Annex 1 of the Swiss Data Protection Ordinance either.

This matters when personal data itself goes to a company in Panama, such as customer records sent to a provider there. Without an adequacy decision, GDPR Article 46 requires appropriate safeguards, such as standard data protection clauses. Swiss law works the same way. FADP Article 16 lists treaties, approved clauses and binding corporate rules, and Article 17 adds exceptions such as explicit consent.

Data on a server in Zurich, Reykjavik, Bucharest or Amsterdam stays in that country. What crosses to Panama is the billing and account record described below. What you read here is general information on the law, not legal advice.

## What does Ravenquay keep about its customers?

Very little. No logs: neither connection nor traffic records, no IP address of any visitor or customer, and no trace of how you found the site apart from a referral code if your link had one. We hold only what billing and operating your server need: the account number and an email if you add one; every top-up and order (amount, coin, network, transaction ID, date); and per server its name, plan, term, location, system, SSH public key, IP addresses and dates, as well as the temporary root password we set when you gave no key, which no longer opens the server once you change it. We have no control over the datacenter’s network equipment. We hand over records only when a Panamanian court orders it.

No KYC: no ID, no selfie, no documents, no card and no phone number, ever. Article 5 brings that small record under Law 81. Article 15 gives each customer the rights of access, rectification, cancellation, opposition and portability over it.

What foreign police can and cannot obtain from a server abroad is covered on [can police seize my server in another country](https://ravenquay.com/can-police-seize-my-server-abroad/ "Cross-border seizure of a rented server"). Retention duties by country are compared on [which European countries still have data retention laws](https://ravenquay.com/data-retention-laws-europe/ "Data retention laws in Europe, country by country").

## What does a Ravenquay server cost?

Harbor 8 $72.62, Harbor 16 $205.27, Harbor 10G $356.25, each for 30 days. Reykjavik (Iceland), Zurich (Switzerland), Bucharest (Romania) and Amsterdam (Netherlands): every berth in every port of call, at one price. There is no setup fee: you pay the price of your chosen term, both when you order and when you renew.

You pay in BTC, USDT, USDC, ETH, SOL, LTC, XMR, from a $1 top-up. Every berth, term and discount is listed on [how much a Ravenquay server costs](https://ravenquay.com/pricing/ "Ravenquay berths, terms and prices").

## Which berth fits my project?

| Plan | Quantity | 30 days | 3 months | 6 months | 1 year |
| --- | --- | --- | --- | --- | --- |
| Harbor 8 | 8 cores · unmetered 1 Gbit/s | $72.62 | $196.07 (−10%) | $348.57 (−20%) | $610 (−30%) |
| Harbor 16 | 16 cores · unmetered 1 Gbit/s | $205.27 | $554.22 (−10%) | $985.29 (−20%) | $1,724.26 (−30%) |
| Harbor 10G | 24 cores · unmetered 10 Gbit/s | $356.25 | $961.87 (−10%) | $1,710 (−20%) | $2,992.50 (−30%) |

In every plan: Unmetered port · Tor exits allowed · RAID 1 · Dedicated IPv4 · No logs · No KYC

**Before you pay**

- Minimum top-up $1. Top up once in crypto, then buy any plan from your balance.
- Credit on your balance does not expire and renews any of your servers. When a top-up is only made to reach the minimum, the unspent part comes back on request within 30 days of payment, in USDT or USDC. The rest of a balance is not paid out unless the law requires it.
- Credited once your payment is checked on the blockchain. Typical network confirmation time: BTC ≈ 20 min · USDT TRC-20 ≈ 1 min · USDT ERC-20 ≈ 5 min · USDC ERC-20 ≈ 5 min · ETH ≈ 5 min · SOL ≈ 1 min · LTC ≈ 15 min · XMR ≈ 20 min

## Panama as a hosting jurisdiction: common questions

### Is Panama's data protection law in force?

Yes. Law 81 of 2019 took effect on 29 March 2021, two years after promulgation. Executive Decree 285 of 28 May 2021 sets its implementing rules, and ANTAI enforces both.

### Does Panama have a data protection authority?

Yes. ANTAI's Personal Data Protection Directorate receives complaints, investigates and imposes sanctions. An advisory Council for Personal Data Protection, chaired by the Minister of Commerce and Industry, recommends policy and regulations.

### Does the GDPR apply to a company registered in Panama?

It can. Article 3(2) of the GDPR covers companies outside the EU that offer goods or services to people in the EU. Whether it applies depends on the facts of each case.

### Can I rent from Ravenquay without giving my name?

Yes. No KYC: no ID, no selfie, no documents, no card and no phone number, ever. An account number is all you need to sign in; an email address is optional.

### Where are Ravenquay's servers?

Reykjavik (Iceland), Zurich (Switzerland), Bucharest (Romania) and Amsterdam (Netherlands): every berth in every port of call, at one price. Each server follows the data-protection law of its own country, not Panama's.

**A Panama company, servers in four countries** Pick the law your data lives under: Iceland, Switzerland, Romania or the Netherlands. From $72.62 per 30 days. No KYC, paid in crypto. [See berths and prices](https://ravenquay.com/pricing/ "How much does a Ravenquay unmetered server cost?") · [Harbor 8 in Reykjavik](https://ravenquay.com/app/checkout/?plan=harbor-8&location=is-rkv&lang=en)

## Sources

1. [Ley 81 de 26 de marzo de 2019, sobre protección de datos personales (Legispan text of the National Assembly)](https://www.superbancos.gob.pa/documentos/sac/leyes/ley_2019_645_3008.pdf) — Asamblea Nacional de Panamá (Legispan), copy published by the Superintendencia de Bancos de Panamá (read 2026-11-01)
2. [Gaceta Oficial Digital No. 28743-A, 29 March 2019 (Ley N° 81)](https://www.gacetaoficial.gob.pa/pdfTemp/28743_A/GacetaNo_28743a_20190329.pdf) — Gaceta Oficial de la República de Panamá (read 2026-11-01)
3. [Gaceta Oficial Digital No. 29296-A, 28 May 2021 (Decreto Ejecutivo N° 285, que reglamenta la Ley 81 de 2019)](https://www.gacetaoficial.gob.pa/pdfTemp/29296_A/GacetaNo_29296a_20210528.pdf) — Gaceta Oficial de la República de Panamá (read 2026-11-01)
4. [Preguntas frecuentes de Protección de Datos Personales](https://antai.gob.pa/preguntas-frecuentes-de-proteccion-de-datos-personales/) — Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) (read 2026-11-01)
5. [Dirección de Protección de Datos Personales](https://antai.gob.pa/direccion-de-proteccion-de-datos-personales/) — Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) (read 2026-11-01)
6. [Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) — European Commission (read 2026-11-01)
7. [Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 3, 46 and 83](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679) — EUR-Lex, Publications Office of the European Union (read 2026-11-01)
8. [Federal Act on Data Protection (FADP), SR 235.1](https://www.fedlex.admin.ch/eli/cc/2022/491/en) — Swiss Confederation, Fedlex (read 2026-11-01)
9. [Data Protection Ordinance (DPO), SR 235.11, Annex 1](https://www.fedlex.admin.ch/eli/cc/2022/568/en) — Swiss Confederation, Fedlex (read 2026-11-01)
10. [EU countries](https://european-union.europa.eu/principles-countries-history/eu-countries_en) — European Union (read 2026-11-01)

---

Ravenquay: Ravenquay rents offshore dedicated servers with unmetered 1 and 10 Gbit/s ports in Reykjavik, Zurich, Bucharest and Amsterdam: each one a whole physical machine with root access and no monthly traffic quota, paid in crypto with no KYC (no ID, no selfie, no documents). It is run by DomaineGoat LLC, a company registered in Panama, and each server also falls under the data-protection law of its datacenter's country. On the 30-day term, each berth is priced at least 25% under a named comparable unmetered server from 10 no-KYC crypto hosts, read on 30 October 2026.