ParaguayLey N° 7593/2025, tratamiento de datos sensibles y categorías especiales
Ley 7593/2025, arts. 20-23 (datos sensibles, crediticios, videovigilancia y penales)
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Access restriction
- Audit expectation
- none
What it requires
- Treat racial or ethnic origin, religious or political belief, health, sexual orientation, genetic data and biometric data used to uniquely identify a person as sensitive data, and process it only on one of the law's narrow grounds.
- Do not process sensitive data at all unless one of the narrow grounds article 20 lists applies, such as the data subject's own consent or data the person has made public.
- Process data for video-surveillance purposes only as article 22 allows, and data of a criminal nature, sanctions and infractions only as article 23 allows.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 20 prohibits processing sensitive data unless a listed ground applies, article 21 leaves credit data to its own law (Ley 6534/2020), article 22 allows video surveillance for security with limits on filming the public road, and article 23 sends criminal and administrative-offense data to their own laws. None asks the controller for a log, register or proof of the ground relied on, and none gives the authority a power to demand one. Article 22 does require footage kept to prove acts against persons or property to be handed to the competent authority within seventy-two hours, but that footage is the personal data the system captures and the article names no record of the processing, so it states no log duty.
- Kind
- None
- As of
What this law does
Article 20 prohibits the processing of sensitive data except on the narrow grounds it lists, such as the data subject's own consent or a case where the person has made the data public. Article 3 defines personal data sensibles to include racial or ethnic origin, religious or political belief, health, sexual orientation, genetic data and biometric data aimed at uniquely identifying a person.
Article 21 governs the processing of credit information data, which Ley N° 6534/2020 continues to regulate in its own right, article 22 processing for video-surveillance purposes, and article 23 the processing of data of a criminal nature, sanctions and infractions. Article 57 enters the law into force twenty-four months after its official publication.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or provides financial services.
Back to the example · Lint your app
Page updated .