Countries › Paraguay › Guide › 10. Capital markets and finance › Credit bureaus and financial consumer data in Paraguay: the credit data law, the five year limit, BCP licensed bureaus and the 2027 data protection law

Credit bureaus and financial consumer data in Paraguay: the credit data law, the five year limit, BCP licensed bureaus and the 2027 data protection law

Last verified: 2026-10-28 · Status: Changing

Ley 6534/2020 protects credit data of anyone, of any nationality, and requires express, informed consent to collect and use personal data, with free access, rectification, deletion, objection and portability rights. Credit reports may be provided only by credit bureaus authorized and supervised by the Banco Central del Paraguay (BCP), adverse data cannot be kept more than five years, and credit data cannot be used for hiring or firing decisions or to deny emergency medical care. Fines reach 15,000 daily minimum wages, PYG 1,756,155,000 (US$299,261); the general data protection law Ley 7593/2025 takes effect in November 2027 and moves the consumer authority's role to a new data protection agency.

USD figures use PYG 5,868.31 per US dollar, the Banco Central del Paraguay reference quotation for 28 October 2026. Fines tied to the minimum wage use PYG 3,044,000 per month and PYG 117,077 per daily jornal, in force from 1 July 2026 under Resolución MTESS Nº 670/2026. Conversions are for orientation only.

Key facts

Credit bureaus need BCP authorization	Yes Ley 6534/2020 art. 13, as of 2026-10-28 · in force
Maximum period adverse credit data can be reported	5 yearsLey 6534/2020 art. 9 and 19, as of 2026-10-28 · in force
Use of credit data for employment decisions	Prohibited Ley 6534/2020 art. 15, as of 2026-10-28 · in force
Maximum first fine for credit data breaches	15000 daily minimum wagesLey 6534/2020 art. 23, as of 2026-10-28 · in force
Maximum first fine in guaraníes at the July 2026 jornal	1756155000 PYGLey 6534/2020 art. 23; Res. MTESS 670/2026, as of 2026-10-28 · in force
General personal data protection law Ley 7593/2025	Enters into force 24 months after publication of 27 November 2025 Ley 7593/2025 art. 57, as of 2026-10-28 · pending

The rule

1. Consent and data subject rights. The law protects credit data of every person, whatever nationality, residence or domicile, and applies to processing of personal data in public or private registers collected or stored in Paraguay. Persons must be told expressly and clearly of the purpose and give express, unequivocal consent in writing, electronically or by another reliable means; consent can be revoked free of charge without retroactive effect. Data must be lawful, accurate, complete and up to date. Data subjects may at any time request access, update, rectification, deletion, objection and portability through simple, accessible and free procedures. Those processing credit data owe secrecy, lifted only by court order.
Cost to do it: Exercise of rights must be free for the data subject.
Example: A lender must obtain express consent in its loan application before querying a bureau. / A foreign fintech scoring Paraguayan users needs the same consent and must honour portability requests.Ley Nº 6534/2020 De Protección de Datos Personales Crediticios, Art. 1, 2, 5 to 8 and 11, 2020-10-27 official text · verified 2026-10-28

2. Credit bureaus and users. Credit reference services may be provided only by credit information companies (burós de información crediticia) authorized and supervised by the BCP, which also sets requirements for their shareholders and directors. Only identified users may consult them: supervised financial entities, INCOOP supervised cooperatives, businesses that lend as a business, mutuals, lending and pawn houses, and persons with a RUC and commercial licence, among others. Users must provide positive and negative data on their clients, use reports confidentially only for credit risk, and report portfolio sales. Bureaus may not alter data and must rectify on request of the source or the data subject. The BCP also runs the Central de Información of the Superintendencia de Bancos for the financial system.
Cost to do it: Bureau licence requirements set by BCP regulation; BCP may charge a fee for Central de Información access.
Example: A retailer selling on instalments can consult a bureau if it has a RUC and commercial licence, but must report its own customers' payment behaviour. / A foreign credit analytics firm cannot sell credit reports in Paraguay without a BCP bureau licence.Ley Nº 6534/2020; Ley Nº 861/96 art. 89 and 91 as reworded by Ley Nº 5787/2016, Ley 6534/2020 art. 12 to 14, 17, 18 and 20; Ley 861/96 art. 89 and 91, 2020-10-27 official text · verified 2026-10-28

3. Retention limits and prohibited uses. Data that may harm the data subject cannot be kept more than five years from the events recorded, unless a special rule sets another term or the parties agreed a shorter one; beyond that they must be dissociated. Credit information may be published for at most five years from the last significant event (default, reclassification, collection suit, judgment, bankruptcy) or from the original maturity, whichever is later. Users may not use or provide credit data for employment decisions (hiring, promotion, transfer or dismissal), or to deny or limit prepaid medical cover or emergency medical care.
Cost to do it: No fee.
Example: A debt that went into default in March 2021 and was not followed by any other significant event should drop from bureau reports by March 2026, if the original maturity was earlier. / An employer screening candidates cannot use bureau data, whatever the role.Ley Nº 6534/2020 De Protección de Datos Personales Crediticios, Art. 9, 15 and 19, 2020-10-27 official text · verified 2026-10-28

4. Sanctions and the 2027 data protection law. The BCP and the consumer protection secretariat (SEDECO) sanction breaches within their competences. Sanctions include a warning, a fine of up to 15,000 daily minimum wages, doubling for repeat breaches up to 50,000 for persons with annual turnover above PYG 6,000,000,000, suspension of processing for up to 6 months, a 6 month to 5 year ban from posts in the financial and credit system and closure; infractions prescribe in five years. Ley 7593/2025 on personal data protection, promulgated 27 November 2025, enters into force 24 months after publication; it creates the Agencia Nacional de Protección de Datos Personales, which takes over SEDECO's role under Ley 6534/2020 except powers assigned to the BCP, and repeals art. 3 a) and b), art. 4, art. 20 b) and art. 21 x) of Ley 6534/2020.
Cost to do it: Fine up to PYG 1,756,155,000 (US$299,261); repeat breaches up to PYG 5,853,850,000 (US$997,536) for turnover above PYG 6,000,000,000 (US$1.02 million).
Example: A bureau that sells reports to an unidentified user faces a fine of up to 15,000 jornales and suspension. / The maximum first time fine is about US$299,000; repeat fines for larger firms reach about US$1 million.Ley Nº 6534/2020 art. 21 to 24; Ley Nº 7593/2025 De Protección de Datos Personales art. 35, 57, 58 and 59, Ley 6534/2020 art. 21 to 24; Ley 7593/2025 art. 57 to 59, 2025-11-27 official text · verified 2026-10-28 · changed: Ley 7593/2025 (promulgated and published 27 November 2025) takes effect 24 months after publication and will amend Ley 6534/2020 as described; until then Ley 6534/2020 applies unchanged.

Topic	Rule	Norm
Consent	Express, informed, revocable for free	Ley 6534/2020 art. 6
Rights	Access, update, rectification, deletion, objection, portability; free	Ley 6534/2020 art. 8
Who may report	BCP authorized bureaus only	Ley 6534/2020 art. 13
Retention	5 years	Ley 6534/2020 art. 9 and 19
Banned uses	Employment, prepaid medicine, emergency care	Ley 6534/2020 art. 15
Fines	Up to PYG 1,756,155,000 (US$299,261); repeat up to PYG 5,853,850,000 (US$997,536)	Ley 6534/2020 art. 23
Reform	Ley 7593/2025 in force 24 months after 27 Nov 2025	Ley 7593/2025 art. 57

Credit data rules (jornal PYG 117,077 from 1 Jul 2026)

Worked example

A foreign consumer lender launching in Paraguay: it collects express consent in its app (Ley 6534/2020 art. 6), contracts with a BCP authorized bureau and reports positive and negative data on its own borrowers (art. 13 and 18), stops reporting adverse data after five years (art. 19), and plans for the new data protection agency's oversight once Ley 7593/2025 takes effect.

Step by step

1. Add express, specific consent wording to onboarding and keep evidence of it.
2. Build free channels for access, rectification, deletion, objection and portability.
3. Contract only with BCP authorized bureaus and report your own clients' data.
4. Set five year deletion or dissociation rules in the database.
5. Prepare for Ley 7593/2025 obligations from its entry into force.

Common traps

Credit data cannot be used in hiring or dismissals, a common practice elsewhere (art. 15).
Bureaus cannot fix data on their own initiative unless the error is theirs; corrections come from the source (art. 17).
Fines are in daily minimum wages and change each time the minimum wage is reset.

Sources

← Payments, e money and fintech in Paraguay: the 2025 National Payment System law, payment providers designated by the BCP, tokenized securities and card feesReal estate and land in Paraguay: foreign ownership, the border security zone, the property registry and the taxes on buying, holding, renting and selling →

Get rule changes weekly

Free. One email a week from The LatAm Thread.

One more step after you press the button: we take you to Substack, where your email is already filled in. Confirm there to start. No spam, unsubscribe anytime, we never share your address. By subscribing you agree to the privacy policy.