Ley 25.326, Ley de Protección de los Datos Personales

Ley 25.326 requires free, express, and informed consent before processing personal data, with exceptions for data from unrestricted public-access sources, data gathered for a State function or legal obligation, short listings limited to name and identifying numbers, data arising from a contractual, scientific, or professional relationship, and financial-entity customer data under Ley 21.526.

Article 4 requires personal data to be true, adequate, relevant, and not excessive for the purpose it was obtained, collected lawfully, used only for the purpose that motivated its collection, kept accurate and updated, corrected or deleted when found inaccurate or incomplete, stored so the data subject's access right can be exercised, and destroyed once no longer necessary.

Article 9 requires the controller or user of a database to adopt the technical and organizational measures needed to guarantee security and confidentiality and to detect deviations, and bars registering personal data in a file that lacks the technical conditions of integrity and security.

Article 10 binds the controller and everyone who takes part in processing to professional secrecy, surviving the end of their relationship with the database's owner, relievable only by judicial order or for public-security, national-defense, or public-health reasons.

Article 11 lets personal data be disclosed to a third party only for a purpose directly tied to the legitimate interest of both discloser and recipient and with the data subject's prior, revocable consent naming the purpose and the recipient, subject to listed exceptions including a legal mandate, an inter-agency transfer within the same competence, health data needed for public-health or epidemiological reasons under dissociation, or already-dissociated data; the recipient takes on the discloser's same legal obligations and the discloser answers jointly for their observance.

Article 21 requires registering any public or private database intended to provide reports with the National Registry, stating the controller's identity, the file's characteristics and purpose, how data is collected and updated, its recipients, its security measures, its retention period, and how a data subject can exercise their rights, and bars holding data of a different nature than what is declared; article 24 extends that registration duty to any private-sector file not for exclusively personal use.

Article 22 requires a public body to create, modify, or suppress a database only by a general disposition published in the Official Gazette stating the file's characteristics and purpose, the people it covers, how data is obtained and updated, its structure, its planned disclosures or interconnections, the responsible body, and where a data subject can exercise their rights.

Article 23 limits a military, security, police, or intelligence body's processing of personal data for national-defense or public-security purposes, taken without the data subject's consent, to what is strictly necessary for its legally assigned missions, requires the resulting files to be specific and classified by reliability, and requires police-purpose data to be cancelled once no longer needed for the inquiry that justified it.

Article 25 bars a data-processing service provider from using the personal data it processes for a purpose other than the one in the service contract or from disclosing it to others, and requires it to destroy the data once the contracted service ends unless further engagements are reasonably expected, in which case it may keep the data securely for up to two years.

Article 26 limits a credit-information service to patrimonial solvency and credit data obtained from public sources or the data subject's own information or consent, and to payment-default data furnished by the creditor, caps what may be filed or disclosed to the last five years significant to evaluating the person's solvency (two years once the debt is cancelled or otherwise extinguished), and requires disclosing to the data subject on request what was reported about them in the last six months.

Article 27 lets a business collect data for advertising, direct-marketing, or profiling purposes only from sources accessible to the public or furnished by, or with the consent of, the data subject. Article 28 exempts opinion-poll, market-research, and scientific or medical-research data from the Act only while it cannot be attributed to an identifiable person, and requires a dissociation technique where anonymity cannot otherwise be kept during collection.

Article 47, added in 2008, required a credit-reporting database to purge and stop recording delinquency or Central Bank risk-category 2 to 5 entries tied to obligations that fell due between 1 January 2000 and 10 December 2003, once the debt was cancelled or regularized, and required the original creditor to notify any database it had disclosed the default to of that cancellation.