Duty LXD-7154
Runs an essential service, in Paraguay
Each law's tag says when it binds: since in force from , in 12 months not yet in force
Trust Services Law, Security Requirements for Trust Service Providerssince 4 lines
Ley N° 6822/2021 De los servicios de confianza para las transacciones electrónicas, arts. 13(2), 20(1) y 21 · Read the law's page
- Adopt the technical and organizational measures that are appropriate to manage the security risks of the trust services you provide, at a level of security proportionate to the degree of risk (Article 20, paragraph 1).
- Take measures to prevent and minimize the impact of security incidents and to inform the persons concerned of their negative effects (Article 20, paragraph 1).
- Manage the security incidents that affect you, with mechanisms for their prevention, detection, analysis and resolution (Article 13, paragraph 2).
- Resolve security incidents in your networks and information systems, because failing to do so is a serious infraction (Article 21, paragraph 4, item k).
- This binds a qualified or non-qualified trust service provider (prestador de servicios de confianza), a natural or legal person that provides one or more trust services such as electronic signatures, seals, time stamps or certificates, whether it is a private business or a public body (reached by declaring that you operate an essential service).
Trust Services Law, Security Breach Notification by Trust Service Providerssince 4 lines
Ley N° 6822/2021 De los servicios de confianza para las transacciones electrónicas, del documento electrónico y los documentos transmisibles electrónicos, arts. 13, 20(2) y 21 · Read the law's page
- Notify the supervisory body and the Centro de Respuestas a Incidentes Cibernéticos of the Ministerio de Tecnologías de la Información y Comunicación (CERT-PY) of any security breach that has a significant impact on the trust service you provide or on the related personal data, without undue delay and in any case within twenty-four hours of becoming aware of it (Article 20, paragraph 2).
- Notify the Autoridad de Aplicación of every such breach, treating as a security breach an event that critically affects the confidentiality, integrity or availability of information assets (Article 13, paragraph 1).
- Where the breach may harm a natural or legal person to whom you provided the service, notify that person too, without undue delay (Article 20, paragraph 2).
- After the incident is resolved, expand the information you gave in the initial notification, following any guidelines the Autoridad de Aplicación sets (Article 13, paragraph 3).
- This binds a qualified or non-qualified trust service provider (prestador de servicios de confianza), a natural or legal person that provides one or more trust services such as electronic signatures, seals, time stamps or certificates, whether it is a private business or a public body (reached by declaring that you operate an essential service).
- Expect the supervisory body to inform the public of the breach, or to require you to do so, where it considers that disclosure is in the public interest (Article 20, paragraph 2).
Ley N° 7593/2025, notificación de un incidente de seguridadfrom , in 12 months2 lines
Ley 7593/2025, art. 17 (notificacion de un incidente de seguridad) · Read the law's page
- Notify the National Data Protection Agency, and the affected person where relevant, of a security incident within 72 hours of becoming aware of it.
- Meet the conditions and requirements that the regulation of the law sets for that notification; article 17 leaves them to the regulation.