ParaguayLey N° 7593/2025, transferencias internacionales de datos personales
Ley 7593/2025, art. 19 (transferencias internacionales de datos personales)
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Before transferring personal data outside Paraguay, confirm the destination offers an adequate level of protection or put in place safeguards such as standard contractual clauses, binding corporate rules or a code of conduct.
- Apply the same rule to an onward transfer from the destination, not only to the first transfer out.
- Check the Agencia Nacional de Datos Personales' reasoned resolution or official list before treating a destination as offering an adequate level of protection.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 19 allows a transfer outside the country only to a destination the National Agency has found adequate, or with appropriate safeguards such as specific or standard contractual clauses, binding corporate rules, codes of conduct or certification, subject to listed exceptions including the data subject's prior, informed, express and unequivocal consent. The safeguards and consent are conditions on the transfer; the article names no log or register of transfers and gives the authority no demand power.
- Kind
- None
- As of
What this law does
Article 19 permits a transfer of personal data outside the national territory, including an onward transfer, only where the destination country, territory, sector or international organization offers an adequate level of protection, which the Agencia Nacional de Datos Personales assesses by reasoned resolution or by publishing an official list.
Where the destination has no adequate level of protection, the controller or processor must adopt appropriate guarantees so the processing is carried out as the law requires, and those guarantees may consist, among others, of specific or standard contractual clauses or binding corporate rules. Article 57 enters the law into force twenty-four months after its official publication.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .