Paraguay enacts data law, creates ANPDP

Paraguay enacted Law No. 7,593 on Personal Data Protection on Nov. 27, 2025, setting a comprehensive framework for any organization that processes data belonging to individuals in the country. The law gives organizations a 24-month transition period and is set to take full effect in November 2027. It also creates the National Personal Data Protection Agency, which will operate within MITIC and hold oversight, inspection and sanctioning powers.

What changes for organizations in Paraguay?

The law requires personal data processing to have a lawful basis and, when applicable, prior, free and informed consent. It also requires clear privacy notices and records of processing activities, according to local analyses published by InfoNegocios Paraguay.

That package of obligations puts companies and other organizations before a formal compliance process, with two years to adjust internal processes, documentation and controls before the law takes full effect in November 2027. Local coverage also presents it as inspired by international frameworks such as the GDPR and Brazil's LGPD.

Which body will enforce the new law?

The National Personal Data Protection Agency, created by Law 7,593, will operate within the Ministry of Information and Communication Technologies and will have supervisory, inspection and sanctioning powers.

Última Hora says the law includes financial penalties for violations and that, in serious cases involving sensitive data, including cases involving children's data, the maximum tier can reach up to 10,000 minimum wages. Under that setup, enforcement is concentrated in a specific authority with the power to intervene in compliance with the regime.

How does it intersect with Brazil's LGPD?

The comparison with Brazil sits at the center of the discussion because the LGPD also applies to processing with extraterritorial effect when the goal is to offer goods or services to people located in Brazil, or when the data was collected there, regardless of where the controller is based.

For Paraguayan companies operating in the Brazilian market, the risk does not end in Asunción. Brazil's federal ANPD can impose fines of up to 2% of group revenue in Brazil, capped at 50 million reais per violation, and it also regulates, guides and oversees LGPD compliance, receives incident notifications and applies the sanctions provided for in the law.

The reference to the LGPD and the ANPD leaves Paraguayan companies facing a dual compliance standard when they process data tied to Brazil. In one case, Paraguay's new regime sets its own obligations and penalties. In the other, Brazilian rules already provide an enforcement and fine structure with broad relevance for regional operators.

Paraguay, government, parliament, consumer privacy and data breach in the data law

Paraguay's Law 7,593 was enacted by the government on Nov. 27, 2025, and establishes a comprehensive personal data protection regime. It also creates a dedicated authority, the ANPDP, within MITIC, with supervisory, inspection and sanctioning powers.

The law applies to organizations that process data of individuals in the country and sets a 24-month compliance period before full effectiveness in November 2027. Among the obligations it sets are a lawful basis for processing, consent when required, privacy notices and records of processing activities.

The legislative debate ended with enactment, but the law's content remains central for companies and consumers handling personal data. Local coverage also notes that the reference to Brazil's LGPD places Paraguayan companies under a more demanding regional compliance framework.