ParaguayLey N° 7593/2025, la Agencia Nacional, faltas y sanciones
Ley 7593/2025, arts. 34-56 (la Agencia Nacional, faltas y sanciones)
An enforcement supervision rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- Yes
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- When the supervisory authority upholds a data subject's complaint under article 52 and requires you to give effect to the right concerned, do so and report it to the authority in writing within fifteen business days of doing so.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.PO-P5
- Comply with the corrective measures the authority orders under article 42, which can include ceasing or suspending the processing, erasing the data or adopting technical, legal and organizational measures; an appeal against them does not suspend their execution.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Agencia Nacional de Protección de Datos Personales
Settledness
- As of
- Open questions
- What peso value of the "jornal mínimo para actividades diversas no especificadas" (minimum daily wage for various unspecified activities) fixes the fine of twenty to two thousand five hundred jornales under Article 46 of Ley 7593/2025?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 34 to 56 create the National Data Protection Agency and give it the functions to supervise and evaluate controllers' and processors' activities, carry out technical audits of processing, and request information from public and private institutions, which must answer within the period set (article 35); the Director General may order inspections and audits (article 38). Article 45 makes it a serious fault not to give the Agency access to the data, information, premises and equipment it requires. The articles name no log, register or record the controller must keep, so no record duty is imposed, and the Agency's demand and audit power is the audit expectation. Articles 41 to 56 on complaints, corrective measures, faults and sanctions name no record.
- Kind
- None
- As of
What this law does
Article 34 establishes the supervisory and control authority and articles 35 to 40 set its functions and powers, its financial resources, and the appointment, duties, qualifications and term of its Director General. Article 41 gives the data subject administrative protection alongside the constitutional guarantee, and article 42 provides for corrective measures where the law is not complied with.
Article 43 defines what counts as a fault, article 44 the minor faults and article 45 the grave ones, with article 46 setting the administrative sanctions, article 47 the criteria for applying them, article 48 the prescription of their execution and article 49 the payment of fines. Article 50 addresses non-compliance by public institutions.
Articles 51 to 56 govern a complaint to the supervisory authority, its resolution, the procedure for establishing a fault and applying a sanction, precautionary administrative measures, reconsideration and the contentious-administrative action. Article 57 enters the law into force twenty-four months after its official publication.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .