Paraguay sets data protection law for 2027

Update August 26, 2026: the law now has a 24-month vacatio legis, with full effect set for November 2027. It also adds details on the enforcement authority, 72-hour breach notification and the scope of fines.

Paraguay’s Personal Data Protection Law No. 7593/2025 is already shaping compliance requirements for sectors that process large volumes of customer information, including e-commerce, mobile apps, financial services, insurance and telecom, according to a specialized analysis cited by EMERiCs.

Who does the new law apply to?

The law applies to companies operating in Paraguay even if they process data in another country, to organizations handling data from people located in Paraguay, to those offering goods or services in Paraguay, and to entities monitoring the behavior of individuals located in Paraguay, according to a corporate client analysis by Daniel Advogados. That extraterritorial reach puts it closer to frameworks such as the GDPR.

Coverage in Paraguayan media says the law adds rights to access, correct, delete records without justification, object to the use of data for commercial or advertising purposes, move data between providers, and challenge decisions made solely by algorithms or automated systems.

That same reporting highlights the data minimization principle. In practice, it requires companies to collect only the information needed to provide a service or carry out a specific activity.

What obligations does it add for companies?

The law adds security, confidentiality and incident response rules, along with oversight by the National Personal Data Protection Agency, created by Law No. 7593/2025 itself as the enforcement authority.

An analysis by the European IP Helpdesk notes that this is Paraguay’s first comprehensive data protection law and that it introduces rights such as access, correction, deletion and portability, along with special protection for children and adolescents, under ANPDP supervision and within MITIC.

Local legal sources say that in the event of a security breach, the controller must notify the authority and, where appropriate, affected individuals within no more than 72 hours after becoming aware of it. International compliance guides for companies reinforce that same notification standard.

What happens if companies do not comply?

The penalty regime provides for fines of 20 to 2,500 minimum daily wages for general violations, up to 5,000 daily wages for sensitive data, and up to 10,000 daily wages when sensitive data of children and adolescents is involved, according to legal coverage and Paraguayan business press.

A local legal source also reported that the law was enacted on November 27, 2025, and that the sanction regime allows fines of up to 10,000 minimum daily wages in the most serious cases. ABC Color translated those ceilings into amounts that, in business terms, no company can ignore because of their potential financial impact.

How are complaints handled and when does it take effect?

The procedures for exercising the rights set out in the law will be free of charge, according to coverage published by La Nación in Paraguay. If a person detects improper use of their data, they must first file a complaint with the company. If that response is not enough, they can turn to the Data Protection Agency or use the constitutional habeas data remedy.

The same material indicates that full implementation was deferred through a 24-month vacatio legis, setting November 2027 as the start of complete application. Pasmor Abogados describes that period as a critical window for organizations to adjust their technical and corporate compliance architectures.

At the same time, the available material points to stronger compliance obligations in industries that process customer data. EMERiCs places that reach in both the private sector and areas tied to the management of personal information.

What changes in the institutional structure?

The law expressly creates the National Personal Data Protection Agency, or ANPDP, as the enforcement authority responsible for oversight, handling complaints and applying the sanction regime established by the statute, according to Olmedo Abogados, EnRegla and the European IP Helpdesk.

On that basis, the law represents a regulatory shift that goes beyond listing rights. It also adds concrete complaint mechanisms, minimization duties and an institutional framework for handling complaints and reviewing automated decisions.