Paraguay Passes Data Law, Sets SIPAP Fees

New personal data law

Paraguay has approved a new personal data law that adds rights of access, correction, deletion, objection, portability and review of automated decisions. The law also requires the principle of data minimization, according to coverage published by La Nación in Paraguay.

The same report says the process for citizens will be free of charge. If they have a complaint about improper use of their data, they must first go to the organization involved and, if that does not lead to a sufficient response, they can take the case to the Agency or seek habeas data.

Security breaches and the supervisory authority

According to a specialized publication on Paraguay, the law requires security breaches to be reported to the Agency and, where appropriate, to affected data subjects within 72 hours of becoming aware of them.

That same source says the data authority will be responsible for oversight, enforcement, rulemaking, handling complaints, opening disciplinary proceedings, carrying out audits and imposing administrative sanctions.

Regulatory impact on payments

On the financial side, the BCP set fee caps for SIPAP services, with limits covering PISP, payment requests, direct debits or automatic debits, interbank transfers in proprietary systems and QR-initiated payments. La Nación’s coverage of the measure includes those categories within the scope of the decision.

Cybersecurity environment

A Mucho Texto report on cybersecurity in Paraguay identifies visibility, authentication and the cybercrime law as key defense pillars. Against that backdrop, the changes to data protection and payment service fees add to a local environment with higher compliance demands for companies and financial players.