Duty LXD-1002
Processes personal data, in Paraguay
Each law's tag says when it binds: since in force from , in 12 months not yet in force
Ley N° 6534/2020, de Protección de Datos Personales Crediticiossince 1 line
Ley N° 6534, del año 2020, de Protección de Datos Personales Crediticios · Read the law's page
- Provide credit-reference services only as a credit-information company (a Buró de Información Crediticia) authorized by the Banco Central del Paraguay, supply them only to the identified users article 14 lists, keep credit data lawful, accurate, complete and up to date, retain it for no more than five years from the recorded event unless a special rule sets another period or the parties agree a shorter one, and protect it with security measures and a duty of secrecy.
Ley N° 7593/2025, notificación de un incidente de seguridadfrom , in 12 months2 lines
Ley 7593/2025, art. 17 (notificacion de un incidente de seguridad) · Read the law's page
- Notify the National Data Protection Agency, and the affected person where relevant, of a security incident within 72 hours of becoming aware of it.
- Meet the conditions and requirements that the regulation of the law sets for that notification; article 17 leaves them to the regulation.
Ley N° 7593/2025, transferencias internacionales de datos personalesfrom , in 12 months3 lines
Ley 7593/2025, art. 19 (transferencias internacionales de datos personales) · Read the law's page
- Before transferring personal data outside Paraguay, confirm the destination offers an adequate level of protection or put in place safeguards such as standard contractual clauses, binding corporate rules or a code of conduct.
- Apply the same rule to an onward transfer from the destination, not only to the first transfer out.
- Check the Agencia Nacional de Datos Personales' reasoned resolution or official list before treating a destination as offering an adequate level of protection.
Ley N° 7593/2025, derechos del titular de datosfrom , in 12 months3 lines
Ley 7593/2025, arts. 26-32 (derechos del titular de datos) · Read the law's page
- Honor a data subject's rights of access, rectification, deletion, objection and portability, free of charge.
- Tell a data subject what article 27 requires about the processing of their personal data.
- Answer a request under articles 28 to 32 on the terms article 26 sets for the exercise of those rights.
Ley N° 7593/2025, la Agencia Nacional, faltas y sancionesfrom , in 12 months2 lines
Ley 7593/2025, arts. 34-56 (la Agencia Nacional, faltas y sanciones) · Read the law's page
- When the supervisory authority upholds a data subject's complaint under article 52 and requires you to give effect to the right concerned, do so and report it to the authority in writing within fifteen business days of doing so.
- Comply with the corrective measures the authority orders under article 42, which can include ceasing or suspending the processing, erasing the data or adopting technical, legal and organizational measures; an appeal against them does not suspend their execution.
Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguayfrom , in 12 months5 lines
Ley N° 7593/2025, arts. 1-16, 18 y 24-25 (ámbito, principios, seguridad y obligaciones del responsable) · Read the law's page
- Establish a valid legal basis, such as the data subject's consent or a contract, before processing any personal data, and make sure any consent obtained is prior, free, informed and unambiguous.
- Obtain the consent of a child or adolescent only on the terms article 7 sets, and rely on legitimate interest only where article 8 allows.
- Carry out an impact assessment before implementing processing that warrants one, and consult the supervisory authority beforehand where article 15 requires it.
- Take the security measures article 16 requires of a controller and of a processor.
- Appoint a data protection officer as article 18 provides.