Countries › Paraguay › Guide › 16. What is normal abroad but not here › A general data protection law, but only from late 2027

A general data protection law, but only from late 2027

Last verified: 2026-10-28 · Status: Changing

Abroad, groups used to GDPR style rules expect a general data protection regime and a regulator. Paraguay enacted one in Ley 7593/2025, published on 27 November 2025, but it enters into force only 24 months after publication. When it applies it reaches foreign controllers targeting Paraguay, requires 72 hour breach notice and allows fines up to 10,000 daily minimum wages.

USD figures use PYG 5,868.31 per US dollar, the Banco Central del Paraguay reference quotation for 28 October 2026 (planilla de cotizaciones). Conversions are for orientation only.

Key facts

Months from publication until Ley 7593/2025 enters into force	24 monthsLey 7593/2025 art. 57, as of 2025-11-27 · pending
Breach notification deadline	72 hoursLey 7593/2025 art. 17, as of 2025-11-27 · pending
Maximum fine (children's sensitive data)	10000 daily minimum wagesLey 7593/2025 art. 46, as of 2025-11-27 · pending
Minimum daily wage (jornal mínimo) from 1 July 2026	117077 PYGDecreto 6225/2026; Res. MTESS 670/2026, as of 2026-07-01 · in force
BCP reference rate, PYG per US dollar, 28 October 2026	5868.31 PYGBCP planilla de cotizaciones, as of 2026-10-28 · in force

The rule

1. Late entry into force. The law protects the personal data of individuals and enters into force 24 months after its official publication, which was on 27 November 2025, so its duties apply from late November 2027.
Cost to do it: No cost before entry into force; budget the compliance project during 2027.
Example: A Paraguayan subsidiary maps its databases during 2027 to be ready for late November 2027. / Not applicable.Ley Nº 7593/2025, personal data protection (promulgated and published 27 November 2025), art. 1 and 57, 2025-11-27 official text · verified 2026-10-28 · changed: Ley Nº 7593/2025, published 27 November 2025, creates a general data protection regime in force 24 months after publication (art. 57).

2. Wide reach. The law covers automated and partly automated processing, and non automated processing of data in files, by controllers or processors established in Paraguay even if processing happens abroad, and by those not established in Paraguay that process data of people located there, offer goods or services to its residents or monitor their behaviour there.
Cost to do it: No registration fee in the law.
Example: A foreign e commerce site selling to Paraguayan residents falls within the law once in force. / Not applicable.Ley Nº 7593/2025, art. 2, 2025-11-27 official text · verified 2026-10-28

3. Breach notice, officer and regulator. A controller must notify a security incident to the authority and, where relevant, to the data subject within 72 hours of learning of it. Controllers and processors must appoint a data protection officer in cases set by regulation; a group may share one. The authority is the new Agencia Nacional de Protección de Datos Personales, a unit of the information technology ministry (MITIC).
Cost to do it: Internal cost of a breach response process and, where required, an officer.
Example: A breach found on a Friday evening must be notified by Monday evening. / Not applicable.Ley Nº 7593/2025, art. 17, 18 and 34, 2025-11-27 official text · verified 2026-10-28

4. Fines in daily minimum wages. Sanctions are a warning, fines of 20 to 2,500 daily minimum wages, up to 5,000 for sensitive data and up to 10,000 for sensitive data of children and adolescents, and suspension of processing, applied separately or together, weighed by criteria such as gravity, benefit, good faith and cooperation.
Cost to do it: At today's jornal of PYG 117,077: PYG 2,341,540 to PYG 292,692,500; up to PYG 585,385,000 and PYG 1,170,770,000.
Example: The top fine for children's sensitive data would be PYG 1,170,770,000 at the July 2026 jornal. / About US$399 to US$49,877; up to US$99,754 and US$199,507.Ley Nº 7593/2025, art. 46 and 47, 2025-11-27 official text · verified 2026-10-28

Case	Daily minimum wages	PYG at the July 2026 jornal
General	20 to 2,500	PYG 2,341,540 to PYG 292,692,500
Sensitive data	up to 5,000	PYG 585,385,000
Sensitive data of minors	up to 10,000	PYG 1,170,770,000

Fines under Ley 7593/2025 art. 46

Worked example

A regional software group runs a single privacy programme built for GDPR. In Paraguay it treats 2026 and 2027 as a preparation window, appoints a contact for the future agency, and sets up a 72 hour breach process for the law's entry into force in late November 2027.

Step by step

Inventory personal data processed in or about Paraguay.
Plan consent, notices and data subject request handling for 2027.
Set up a 72 hour incident notification procedure.
Watch for the implementing regulation, which will define when an officer is mandatory.

Common traps

Assuming the law already applies: it enters into force 24 months after 27 November 2025 (art. 57).
Assuming no presence means no exposure: the law reaches foreign controllers targeting Paraguayan residents (art. 2).
Budgeting fines in fixed money: they are in daily minimum wages, which rise with each wage decree.

Sources

← No bearer shares, fast share transfer notices and a 10 percent beneficial owner testConsumer contracts: no automatic renewal, no forced arbitration →

Get rule changes weekly

Free. One email a week from The LatAm Thread.

One more step after you press the button: we take you to Substack, where your email is already filled in. Confirm there to start. No spam, unsubscribe anytime, we never share your address. By subscribing you agree to the privacy policy.