Processes personal data, in Argentina

Ley 25.326, Ley de Protección de los Datos Personales (2000), arts. 1-5, 9-11, 21-28, 47 (general regime, data quality, security, confidentiality, disclosure, registration, and sector rules) · Read the law's page

• Obtain the data subject's free, express, and informed consent before processing their personal data, unless it comes from an unrestricted public-access source, is needed for a State function or legal obligation, is limited to a short listing of name and identifying numbers, arises from a contractual, scientific, or professional relationship, or is financial-entity customer data covered by Ley 21.526.
• Collect only personal data that is true, adequate, relevant, and not excessive for the purpose you obtained it, use it only for that purpose, keep it accurate and updated, correct or delete it once you learn it is inaccurate or incomplete, store it so the data subject's access right can be exercised, and destroy it once it is no longer necessary.
• Adopt the technical and organizational measures needed to guarantee the security and confidentiality of personal data and to detect unauthorized or accidental deviations, and do not register personal data in a file that lacks adequate technical integrity and security conditions.
• Keep personal data confidential during and after your involvement in processing it, and disclose it to a third party only for a purpose tied to both parties' legitimate interest and with the data subject's prior, revocable, informed consent naming the purpose and the recipient, unless a listed exception applies.
• Register any database intended to provide reports, public or private, with the National Registry before operating it, stating your identity, the file's purpose, its data sources, recipients, security measures, retention period, and how a data subject can exercise their rights, and do not hold data of a kind you did not declare.
• As a public body, create, modify, or suppress a database only through a general disposition published in the Official Gazette that states the file's characteristics and purpose, how data is obtained and updated, and where a data subject can exercise their rights.for a public body
• As a military, security, police, or intelligence body, limit consent-free processing of personal data for defense or public-security purposes to what your legally assigned mission strictly requires, keep the resulting files specific and classified by reliability, and cancel police-purpose data once it is no longer needed for the inquiry that justified it.when it serves a public body
• As a data-processing service provider acting for another party, use the personal data only for the purpose stated in the service contract, do not disclose it to others, and destroy it once the contracted service ends unless further engagements are reasonably expected, in which case you may keep it securely for up to two years.
• As a credit-information service, process only patrimonial solvency and credit data from public sources or the data subject's own information or consent and payment-default data the creditor furnishes, keep it no longer than five years significant to evaluating solvency (two years once the debt is cancelled or extinguished), and disclose to the data subject on request what was reported about them in the last six months.
• Build an advertising, direct-marketing, or profiling database only from sources accessible to the public or furnished by, or with the consent of, the data subject.
• Treat opinion-poll, market-research, or scientific-research data as outside this Act only while it cannot be attributed to an identifiable person, and apply a dissociation technique where anonymity cannot otherwise be kept during collection.
• If you operate a credit-reporting database, purge and stop recording any delinquency or Central Bank risk-category 2 to 5 entry tied to an obligation that fell due between January 1, 2000 and December 10, 2003 once the debt is cancelled or regularized, and tell any database you disclosed the original default to about the cancellation.

Ley 25.326, art. 12 (cross-border transfer) · Read the law's page

• Before transferring personal data of any kind to a country or international or supranational organization, confirm it provides an adequate level of protection; the transfer is prohibited otherwise.
• Rely on the prohibition's exceptions only for international judicial cooperation, health-data exchange the affected person's treatment or an epidemiological investigation requires under dissociation safeguards, a banking or securities transfer under its own applicable law, a treaty-based transfer to which Argentina is a party, or intelligence-agency cooperation against organized crime, terrorism, or drug trafficking.

Ley 25.326, arts. 29-43 (supervisory authority, sanctions, and habeas data) · Read the law's page

• Give the control body the antecedents, documents, programs, or other elements about your personal-data processing that it requests, and let it verify your compliance with the Act, including through a judicially authorized inspection.
• Expect the control body to impose a warning, suspension, a fine of one thousand to one hundred thousand pesos, or closure of the file for a violation, graded to the violation's gravity and harm under due process, without prejudice to civil or criminal liability.
• Do not access a personal database without authorization, disclose personal data you are bound to keep secret, or insert data into a personal-data file illegitimately; a heavier penalty applies when the conduct reaches a genetic-data databank or DNA registry.
• Register a private-sector code of conduct for personal-data processing practices with the control body before relying on it as your compliance standard.
• Expect an affected person, their guardian, or their universal successor to bring a habeas data judicial action against you to learn, correct, delete, or restrict their personal data, and expect the court's judgment to be reported to the control body's own registry.

Ley 25.326, arts. 6, 13-16, 19, 27.3 (data subject rights) · Read the law's page

• Before collecting a data subject's personal data, tell them in clear, express terms the purpose it will be processed for and who may receive it, that a file or database exists together with its controller's identity and address, whether answering is mandatory or optional, the consequences of answering, refusing, or answering inaccurately, and that they may exercise access, rectification, and erasure rights.
• Let a data subject query the control body's public, free registry to learn what personal-data files exist, their purposes, and their controllers' identity.
• On a verified-identity request, give the data subject their personal data from a public or private reporting database within ten running days, free of charge at intervals no shorter than six months absent a legitimate interest, in clear language without codes, covering the whole record without revealing a third party's data, in the medium the data subject chooses.
• Rectify, update, or, where appropriate, delete or restrict a data subject's inaccurate, incomplete, or outdated personal data within five business days of the claim or of learning of the error, and notify any recipient the data were disclosed to within five business days, unless erasure would harm a third party's legitimate rights or a legal duty requires retention.
• Provide rectification, updating, or erasure of inaccurate or incomplete personal data free of charge, and mark a record as under review while you verify its accuracy.
• Let a data subject request the removal or blocking of their name from an advertising, direct-marketing, or profiling database at any time.

Ley 25.326, arts. 7-8 (sensitive data categories and health data) · Read the law's page

• Do not require a person to provide sensitive data (racial or ethnic origin, political opinions, religious, philosophical, or moral convictions, union membership, or health or sexual-life information).
• Collect and process sensitive data only for a reason of general interest authorized by law, or for statistical or scientific purposes where the data subject cannot be identified.
• Do not form a file, bank, or registry whose purpose is to store information that directly or indirectly reveals sensitive data, unless it is a membership registry a church, religious association, or political or union organization keeps of its own members.
• Process a person's criminal or administrative-offense record only if you are a competent public authority acting under the applicable laws and regulations.
• As a health establishment or health professional, collect and process a patient's physical or mental health data under the rules of professional secrecy.

Ley 26.529, arts. 14, 19, 20 and 21 (patient rights: access to the clinical record) · Read the law's page

• On a patient's simple request, give them a copy of their clinical record authenticated by the competent authority of the care institution, within forty-eight hours of the request except in an emergency.
• Release the clinical record on request only to the patient and their legal representative, to their spouse or cohabiting partner and forced heirs with the patient's authorization unless the patient cannot give it, or to doctors and other health professionals the patient or their representative has expressly authorized, and hold a backup copy of the record for that purpose.
• Expect a person entitled to the record to bring a direct habeas data action against you if you refuse, delay or stay silent on a request for it.

Ley 26.529, arts. 2(c), 2(d), 13 and 18 (patient rights: confidentiality, integrity and custody of health information) · Read the law's page

• Treat a patient's clinical information and documentation with strict respect for their privacy and the confidentiality of their sensitive data whenever you obtain, classify, use, administer, hold or transmit it, without prejudice to Ley 25.326.
• Keep the clinical documentation confidential, and make everyone who takes part in preparing or handling it or has access to it do the same, unless a competent court orders otherwise or the patient authorizes disclosure.
• If you keep the clinical record in magnetic form, use restricted access with identification keys, non-rewritable storage media, field-modification control or another suitable technique to preserve its integrity, authenticity, unalterability, durability and recoverability.
• As a care establishment or a health professional with a private practice, hold the clinical record in custody as depositary and put in place the means and resources to prevent access to it by unauthorized persons, for at least ten years from the last entry recorded.

Resolución 126/2024 de la Agencia de Acceso a la Información Pública, Anexos I y II (clasificación de infracciones y régimen de graduación de las sanciones) · Read the law's page

• Provide the control body, in due time and form, the information and documentation it requests in the exercise of its powers and in an inspection.
• Respect the principle that the rights of access and rectification are free of charge, as articles 14 and 19 of the Act provide.
• Carry out an obligation to act, or the mandatory data-protection training, that the control body imposes together with a sanction.

Decreto 1558/2001, art. 12 (reglamentación de la Ley 25.326: transferencia internacional) · Read the law's page

• To transfer personal data to a country or international body without adequate protection, rely on the data subject's express consent to the transfer, which lifts the prohibition.
• Where the destination's own law is not adequate, you may supply adequate protection through self-regulation or through contractual clauses that provide for the protection of personal data.

Decreto 1558/2001, art. 27 (reglamentación de la Ley 25.326: bases de datos con fines de publicidad, retiro o bloqueo) · Read the law's page

• State in every advertising message sent by mail, telephone, email, the Internet or another distance medium, expressly and prominently, that the recipient may ask to be removed or blocked, in whole or in part, from your database.
• Honor a request for total or partial withdrawal by blocking, at the data subject's request, only the media they name, such as mail, telephone or email.
• On the data subject's request, tell them the name of the controller or user of the data bank that supplied their information.

Decreto 1558/2001, art. 27, último párrafo (reglamentación de la Ley 25.326: datos vinculados a la salud) · Read the law's page

• Use health data to make offers of goods and services only if you obtained it in accordance with the Act, it causes no discrimination, and it arises in a relationship between a consumer or user and providers of medical services or treatments or non-profit entities.
• Do not transfer such health data to third parties without the data subject's prior, express and informed consent.
• To obtain consent to transfer such health data, give the data subject a clear notice that the data is sensitive and that they are not obliged to provide it, with the information required by articles 6 and 11, paragraph 1, of the Act and a mention of their right to ask for removal from the database.

Decreto 1558/2001, arts. 1, 4, 5 and 25 (reglamentación de la Ley 25.326: private reporting databases, stale data, informed consent, processing on behalf) · Read the law's page

• Delete personal data that has lost currency for the purposes for which it was collected, without waiting for the data subject to ask.
• Before you rely on consent, explain to the data subject, in a form suited to their social and cultural level, the information that article 6 of the Act requires.
• Honor a data subject's revocation of consent given at any time; the revocation has no retroactive effect.
• Where a processor handles personal data for you, bind it by contract to act only on your instructions and to carry the obligations of article 9 of the Act.

Decreto 1558/2001, arts. 14-16 (reglamentación de la Ley 25.326: derecho de acceso y derechos de rectificación, actualización, supresión y confidencialidad) · Read the law's page

• Accept an access request in any form that identifies the data subject, made in person or by written notice that leaves proof of receipt; do not require a specific formula.
• Answer every access request, whether or not you hold data on the person, by the means the data subject chose or stated.
• On an access request, tell the data subject whether they are in your database, all the data you hold about them, the sources and means by which you obtained it, the purposes of collection, its planned destination, and whether the database is registered.
• Treat a request under any one of the rights of rectification, updating, erasure and confidentiality as reaching all of them.

Decreto 1558/2001, arts. 29 and 31 (reglamentación de la Ley 25.326: órgano de control y procedimiento sancionatorio) · Read the law's page

• Give the control body the information, background, documents, programs or other elements about your processing of personal data that it requires, and allow its investigations and inspections.
• Answer within ten working days the control body's request for a report on a complaint or an ex officio action, unless you request in due form an extension of no more than ten further working days.

Disposición 60-E/2016 de la Dirección Nacional de Protección de Datos Personales, arts. 1-3 (cláusulas contractuales tipo de transferencia internacional) · Read the law's page

• If you transfer personal data to a country without adequate legislation under a contract that departs from the approved model clauses or lacks their principles, guarantees and content, submit the contract to the control body for approval within thirty calendar days of signing it.
• For a transfer to a country without adequate legislation, use the approved model contract clauses, one for the cession of personal data and one for the provision of services.