ParaguayLey N° 7593/2025, notificación de un incidente de seguridad
Ley 7593/2025, art. 17 (notificacion de un incidente de seguridad)
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the National Data Protection Agency, and the affected person where relevant, of a security incident within 72 hours of becoming aware of it.
- Meet the conditions and requirements that the regulation of the law sets for that notification; article 17 leaves them to the regulation.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 17 requires the controller to notify the control authority and, where applicable, the data subject of a security incident within seventy-two hours of learning of it. It is a duty to notify only: the article does not require the incident to be documented or a register to be kept, and the conditions are left to the regulation. The incident is defined in article 3.
- Kind
- None
- As of
What this law does
Article 17 requires the controller, on a personal-data security incident occurring, to notify the supervisory authority and, where applicable, the data subject, within a period that may not exceed seventy-two hours counted from becoming aware of the incident. The conditions and requirements are left to the regulation of the law, which has not been issued. Article 57 enters the law into force twenty-four months after its official publication.
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .