Enactment of the Personal Data Protection Law

The Executive Branch of Paraguay has enacted Law No. 7593/2025, establishing a comprehensive legal framework for the protection of personal data and strengthening the constitutional right to privacy in an increasingly digital environment. This legislation expressly prohibits the processing of personal data by public or private entities without a valid legal basis, such as informed consent or the fulfillment of contractual obligations. Its primary objective is to ensure full respect for individuals’ fundamental rights regarding the handling of their personal information.

The law introduces key rights for data subjects, including access, rectification, objection, deletion, portability, and the right to freely revoke consent, with enhanced safeguards for children and adolescents. It also requires organizations to implement robust technical and organizational security measures, ensure data minimization, and limit processing activities to clearly defined purposes, while imposing strict regulations on the handling of sensitive data to prevent misuse. Furthermore, the law mandates full transparency regarding the identity of the personal data controller, data retention periods, and any potential international data transfers.

To oversee implementation, the law creates the National Agency for the Protection of Personal Data, an autonomous authority responsible for supervising regulatory compliance, addressing inquiries and complaints, issuing technical guidelines, and imposing sanctions when necessary. The law will enter into force 24 months after its promulgation date on November 27, 2025, during which time the Executive Branch will develop the corresponding regulatory framework.

Additionally, existing rules governing the disclosure of public information related to public officials—such as remuneration and asset declarations—remain unchanged and will continue to apply.