ParaguayLey N° 7593/2025, automated or semi-automated individual decisions
Ley 7593/2025, art. 33 (automated or semi-automated individual decisions)
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Let a data subject ask for review of a decision based on automated processing of their personal data that adversely affects their interests or produces legal effects, express their point of view and contest it, and on request give them clear, complete information about the criteria and procedures the decision used.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 33 gives the data subject a right to ask for review of decisions based on automated processing, to state a view and to contest the decision, and requires the controller to give clear information on the criteria and procedures used whenever asked, while respecting trade secrets. Giving information on request is a disclosure duty to the data subject, and the article names no log of the decision, no record kept, and no authority access.
- Kind
- None
- As of
What this law does
Article 33 gives a data subject the right to ask for review of a decision based on automated processing of their personal data that adversely affects their interests or produces legal effects, including a decision that defines their personal, professional, consumer, credit or personality aspects, and the right to express their point of view and contest the decision.
The controller must, on request, give clear, complete and adequate information about the criteria and procedures the automated decision used, respecting trade and industrial secrets. Article 57 enters the law into force twenty-four months after its official publication.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .