Countries › Paraguay › Guide › 13. Regulation › Personal data protection in Paraguay: Ley 7593/2025, legal bases, transfers, breach notice and fines from November 2027

Personal data protection in Paraguay: Ley 7593/2025, legal bases, transfers, breach notice and fines from November 2027

Argentina. For full detail on Argentina, go to The Argentine Thread.

Last verified: 2026-10-28 · Status: Changing

Ley 7593/2025, published on 27 November 2025, is Paraguay's first general data protection law and enters into force 24 months after publication, on 27 November 2027; its implementing regulation is due within the same 24 months. It reaches controllers and processors in Paraguay and foreign ones that process data of people in Paraguay, target its residents or monitor behaviour there, with GDPR style legal bases, impact assessments, a 72 hour breach notice and transfer rules. A new Agencia Nacional de Protección de Datos Personales under MITIC can fine 20 to 2,500 daily minimum wages, up to 5,000 for sensitive data and 10,000 for children's sensitive data (about US$200,000).

USD figures use PYG 5,868.31 per US dollar, the Banco Central del Paraguay reference quotation for 28 October 2026. Amounts set in minimum wages use the monthly minimum wage of PYG 3,044,000 and the daily minimum wage (jornal) of PYG 117,077 in force since 1 July 2026 under Resolución MTESS 670/2026. Conversions are for orientation only and move with each wage adjustment.

Key facts

General data protection law in force from	2027-11-27 dateLey 7593/2025 art. 57, as of 2026-10-28 · pending
Deadline for the implementing regulation	24 months from publication (by 27 November 2027) Ley 7593/2025 art. 60, as of 2026-10-28 · pending
Breach notification to authority	72 hoursLey 7593/2025 art. 17, as of 2026-10-28 · pending
Applies to foreign controllers targeting or monitoring people in Paraguay	Yes Ley 7593/2025 art. 2, as of 2026-10-28 · pending
Data protection officer mandatory	In cases set by the implementing regulation Ley 7593/2025 art. 18, as of 2026-10-28 · pending
Deadline to answer data subject requests	30 calendar daysLey 7593/2025 art. 26, as of 2026-10-28 · pending
Age below which parental consent is required	16 yearsLey 7593/2025 art. 7, as of 2026-10-28 · pending
International transfer mechanism	Adequacy by the Agency or safeguards (standard or specific clauses, BCRs, codes, certification); listed exceptions Ley 7593/2025 art. 19, as of 2026-10-28 · pending
Maximum data protection fine (ordinary data)	2,500 daily minimum wages (PYG 292,692,500) PYGLey 7593/2025 art. 46, as of 2026-10-28 · pending
Maximum fine, sensitive data	5,000 daily minimum wages (PYG 585,385,000) PYGLey 7593/2025 art. 46, as of 2026-10-28 · pending
Maximum fine, children's sensitive data	10,000 daily minimum wages (PYG 1,170,770,000) PYGLey 7593/2025 art. 46, as of 2026-10-28 · pending
Supervisory authority	Agencia Nacional de Protección de Datos Personales (within MITIC) Ley 7593/2025 art. 34, as of 2026-10-28 · pending

The rule

1. Scope and territorial reach. The law covers automated processing and filing system processing of personal data of individuals, whatever the medium, the controller's seat or where the data sit, when done by a controller or processor established in Paraguay (even if processing happens abroad) or by one not established in Paraguay that processes data of individuals located in Paraguay (except mere transit), offers goods or services to residents of Paraguay, or monitors behaviour taking place in Paraguay. Purely household processing is excluded, and public security, migration, defence and criminal investigation processing is only partly covered. The implementing regulation will define when foreign controllers and processors must appoint a representative in Paraguay.
Cost to do it: No registration fee; the cost is the compliance programme and, where required, a local representative.
Example: An Asunción app developer hosting its database in the United States is covered because it is established in Paraguay (art. 2 num. 1). / A Miami based online store shipping to Paraguayan buyers is covered because it offers goods to residents of Paraguay (art. 2 num. 2 b).Ley Nº 7593/2025, De Protección de Datos Personales en la República del Paraguay, Art. 2 and 12, 2025-11-27 official text · verified 2026-10-28 · changed: New law promulgated and published on 27 November 2025; in force 24 months after publication (art. 57).

2. Legal bases, consent and children. Processing is lawful only on at least one basis: consent for specific purposes; a legal obligation; public functions; performance of a contract or pre contractual steps requested by the data subject; exercise of rights in judicial, administrative or arbitral proceedings; legitimate interest of the controller or a third party unless the data subject's rights prevail (not available to the state); or protection of life and health by health professionals or court ordered protection. Consent must be prior, free, informed and unambiguous, by statement or clear affirmative action, separate from other terms, revocable at any time as easily as it was given; the controller bears the burden of proving it. Data of children under 16 need the prior express consent of the parent or guardian, and sensitive data of 16 and 17 year olds need both the adolescent's and the guardian's consent. Sensitive data are prohibited except in listed cases such as explicit consent, labour and social security duties, vital interests, legal claims, health care and public health.
Cost to do it: No fee; consent management and records are an internal cost.
Example: A gym that wants to use members' fingerprints (biometric, sensitive) needs explicit consent or another art. 20 exception. / An ad tech firm relying on legitimate interest must be able to show the balancing and tell users which interest it pursues (art. 8).Ley Nº 7593/2025, Art. 5, 6, 7, 8 and 20, 2025-11-27 official text · verified 2026-10-28

3. Controller duties: accountability, impact assessments, security, breach notice and officers. Controllers must apply and be able to demonstrate technical and organisational measures, including privacy by design and by default as the regulation will detail. Joint controllers are jointly and severally liable to data subjects. Processors act under a written contract stating object, duration, nature, purpose, data types and obligations, and may sub delegate only on the same terms. A data protection impact assessment is mandatory before systematic profiling with legal or similarly significant effects, large scale processing of sensitive or criminal data, or large scale systematic monitoring of public places; if it shows unmitigated risk the controller must consult the Agency and wait for its written advice, due within 30 business days. Controllers must notify security incidents to the Agency and, where appropriate, to data subjects within 72 hours of becoming aware. A data protection officer, internal or under a service contract and shareable within a corporate group, is mandatory in cases the regulation will define.
Cost to do it: Professional cost of impact assessments, security programmes and, where required, an officer; the law sets no fee for prior consultation.
Example: A bank rolling out an automated credit scoring model must complete an impact assessment first (art. 14 a) and, if residual risk remains, consult the Agency and wait up to 30 business days. / A breach discovered at 9:00 on a Monday must be notified to the Agency by 9:00 on Thursday.Ley Nº 7593/2025, Art. 9, 10, 11, 14, 15, 16, 17 and 18, 2025-11-27 official text · verified 2026-10-28

4. International transfers. Personal data may leave Paraguay, including onward transfers, only to countries, territories, sectors or international organisations the Agency finds adequate by reasoned resolution or official list. Otherwise the controller or processor must adopt appropriate safeguards, such as specific or standard contractual clauses, binding corporate rules, codes of conduct or certification. Safeguards are not needed for transfers under treaties, international judicial cooperation, intelligence cooperation against serious crime, transfers needed to perform a contract with the data subject (including authentication, support, quality monitoring and billing), bank or stock exchange transfers, medical treatment, or with the data subject's prior, informed, express and unambiguous consent.
Cost to do it: Drafting standard clauses or binding corporate rules is a professional cost; no transfer authorisation fee is set.
Example: A Paraguayan retailer using a cloud CRM in Brazil will need either an adequacy finding for Brazil or contractual clauses once the law applies. / A SaaS provider serving Paraguayan customers can rely on the contract performance exception for data needed to run and bill the service, but not for unrelated analytics.Ley Nº 7593/2025, Art. 19, 2025-11-27 official text · verified 2026-10-28

5. Data subject rights. Individuals may request access, rectification, erasure, objection and portability at any time, free of charge, and the controller must answer within 30 calendar days. After an objection, processing must stop within 10 business days unless compelling legitimate grounds or legal claims prevail, and within 15 business days for direct marketing. Rectified data must be notified to recipients within the fifth business day, with data blocked or flagged while under review. Portability applies to electronic processing unless excessive burden, third party privacy, legal duties or anonymisation apply. People may request review of automated decisions that affect them and obtain information on the criteria used, respecting trade secrets. If the controller does not answer or answers insufficiently, the data subject may complain to the Agency within 15 business days of the answer (or at any time after the deadline lapses) or bring a habeas data action, but not both.
Cost to do it: Rights must be handled free of charge; charging a fee is a serious infringement (art. 45).
Example: A customer who objects to marketing emails on 2 December 2027 must stop receiving them within 15 business days. / A platform must explain, on request, the main criteria of an automated decision to suspend a user account (art. 33).Ley Nº 7593/2025, Art. 26 to 33, 51 and 52, 2025-11-27 official text · verified 2026-10-28

6. Enforcement and fines. The Agencia Nacional de Protección de Datos Personales, a body within MITIC with functional autonomy, supervises the law; it also takes over the consumer authority's role under the credit data law (Ley 6534/2020), and parts of that law are repealed. Infringements are minor (prescribing in 1 year), such as incomplete or late breach notices, or serious (prescribing in 2 years), such as unlawful transfers, failing to notify a breach, missing impact assessments, officers or representatives, invalid consent, charging for rights or processing sensitive data without a legal basis. Sanctions are a warning with corrective deadlines, fines of 20 to 2,500 daily minimum wages, up to 5,000 for sensitive data and 10,000 for children's sensitive data, and suspension of processing, alone or combined. Fines are graded by gravity, good faith, intent, benefit, economic situation, recidivism, cooperation and compliance programmes, and are payable within 30 business days. Corrective orders are not suspended by appeals; reconsideration and the Tribunal de Cuentas action suspend fines.
Cost to do it: Fines of PYG 2,341,540 to PYG 292,692,500 (about US$399 to US$49,877); up to PYG 585,385,000 (about US$99,754) for sensitive data and PYG 1,170,770,000 (about US$199,507) for children's sensitive data.
Example: A clinic that leaks patient files without notifying the Agency risks up to 5,000 jornales, PYG 585,385,000, plus suspension of processing. / For a foreign edtech company mishandling children's health data, the ceiling is about US$199,507 per sanction at the July 2026 wage, before any suspension order.Ley Nº 7593/2025, Art. 34, 42 to 49, 55, 56, 58 and 59, 2025-11-27 official text · verified 2026-10-28

Duty	Deadline	Article
Breach notice to the Agency (and data subjects where appropriate)	72 hours from awareness	17
Answer access, rectification, erasure, objection or portability requests	30 calendar days	26
Stop processing after objection	10 business days (15 for direct marketing)	30
Notify rectification to recipients	Fifth business day	29
Agency advice after prior consultation	30 business days	15
Data subject complaint to the Agency	15 business days after the controller's answer	51
Pay a fine	30 business days from notification	49

Key deadlines under Ley 7593/2025 (from 27 November 2027)

Case	Jornales	PYG	USD
Minimum fine	20	2,341,540	399
Ordinary data, maximum	2,500	292,692,500	49,877
Sensitive data, maximum	5,000	585,385,000	99,754
Children's sensitive data, maximum	10,000	1,170,770,000	199,507

Fine ceilings in daily minimum wages (July 2026 jornal PYG 117,077; USD at PYG 5,868.31)

Worked example

A regional online retail group with a Paraguayan subsidiary suffers a ransomware attack on 6 December 2027 that exposes customer addresses and card tokens. It must notify the Agency within 72 hours and, where appropriate, affected customers (art. 17). Late or incomplete notice is a minor infringement; no notice at all is a serious one. Fines range from PYG 2,341,540 to PYG 292,692,500 (about US$49,877) for ordinary data, assessed per infringement and payable within 30 business days.
The same group's analytics vendor in the United States receives customer data. Unless the Agency lists the United States as adequate, the group needs standard or specific contractual clauses or binding corporate rules before 27 November 2027 (art. 19).

Step by step

Before November 2027, inventory personal data, purposes and legal bases, and flag sensitive and children's data.
Review consent flows for prior, separate and revocable consent, and age gates at 16 for services used by minors.
Run impact assessments for profiling with significant effects, large scale sensitive data and public space monitoring.
Sign written processor agreements with every vendor and add transfer clauses for vendors outside Paraguay.
Build a 72 hour incident response plan with a named contact for the Agency.
Track the implementing regulation (due by 27 November 2027) for officer and local representative thresholds and security minimums.

Common traps

The law is not in force until 27 November 2027, but it has no grandfathering for data collected earlier; processing must have a legal basis from that date.
Foreign companies with no Paraguayan entity are in scope if they target residents or monitor behaviour in Paraguay, and failing to appoint a required representative is a serious infringement (art. 45).
Credit data keep their own law (Ley 6534/2020), with the new law applying in gaps; the Agency replaces the consumer authority under that law (art. 21 and 58).
A data subject who chooses habeas data in court cannot also complain to the Agency (art. 26).
Corrective orders such as stopping processing or deleting data take effect despite an appeal (art. 42); only fines are suspended (art. 56).
Fines are set in daily minimum wages, so their guaraní value rises with each wage adjustment.

Sources

← Cartels and abuse of dominance in Paraguay: prohibited conduct, CONACOM investigations, fines and appealsAnti money laundering in Paraguay: obligated subjects, due diligence, suspicious reports, SEPRELAD sanctions and the laundering offence →

Get rule changes weekly

Free. One email a week from The LatAm Thread.

One more step after you press the button: we take you to Substack, where your email is already filled in. Confirm there to start. No spam, unsubscribe anytime, we never share your address. By subscribing you agree to the privacy policy.