ParaguayLey N° 6534/2020, de Protección de Datos Personales Crediticios
Ley N° 6534, del año 2020, de Protección de Datos Personales Crediticios
In force since .
A sensitive categories rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Enforcement body
- Banco Central del Paraguay y Secretaría de Defensa del Consumidor y el Usuario
- Obligation class
- Licensing, Disclosure, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Provide credit-reference services only as a credit-information company (a Buró de Información Crediticia) authorized by the Banco Central del Paraguay, supply them only to the identified users article 14 lists, keep credit data lawful, accurate, complete and up to date, retain it for no more than five years from the recorded event unless a special rule sets another period or the parties agree a shorter one, and protect it with security measures and a duty of secrecy.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 6 requires consent to be express and unequivocal and to be recorded in writing, electronically, digitally or by another reliable mechanism, and puts on the controller the burden of proving that the data subject consented, so the consent record is what the controller must be able to produce. Article 20 makes the Banco Central del Paraguay, through the Superintendencia de Bancos, supervise the custody and use mechanisms of the credit bureaus, and lets the consumer-defense secretariat order inspections and expert examinations and request reports, which gives the regulators a power to check. Articles 9 and 19 cap the period credit data may be kept or published at five years, which limits the data and not a log. Article 2 applies the Law to data collected or stored in the national territory, a location test that takes no hook value, and article 1 protects any person whatever their nationality or residence, which is not a hook either.
- Kind
- Implicit
- As of
- Provision
- Article 6
- Trigger
- consent_or_optout
What this law does
Article 1 states the object of the law as guaranteeing the protection of a person's credit data and regulating the collection of, and access to, credit-information data, as well as the constitution, organization, operation, rights, obligations and dissolution of the legal persons dedicated to that activity; State agencies and pension-fund administrators count among the sources of credit-relevant information the law reaches.
The law's own definition of sensitive data mirrors the later comprehensive law's, reaching racial or ethnic origin, religious belief, union affiliation, political opinion, health, sexual orientation, genetic data and biometric data aimed at uniquely identifying a natural person. Article 21 assigns enforcement jointly to the Banco Central del Paraguay and the Secretaría de Defensa del Consumidor y el Usuario, each within its own competence, over the infractions the article lists.
Article 23 sets administrative sanctions rising from a warning to a fine of up to 15,000 minimum daily wages, doubled on repetition up to a ceiling of 50,000, to a suspension of data-processing operations of six months to five years or a permanent closure for sensitive-data infractions, none of which are stated as a fixed currency amount.
Article 30 repealed Ley N° 1682/2001, which had regulated privately held personal information generally, along with its amending laws, in the same act that created this credit-specific regime.
From its entry into force, twenty-four months after its publication, Ley N° 7593/2025 treats this law's references to the Secretaría de Defensa del Consumidor y el Usuario as references to the new National Personal Data Protection Agency, and its Article 59 repeals article 4, subparagraphs a) and b) of article 3, subparagraph b) of article 20, and subparagraph x) of article 21 of this law.
When LexLint raises it
When your app profile says your app makes credit decisions or processes personal data.
Back to the example · Lint your app
Page updated .