ParaguayLey N° 7593/2025, de Protección de Datos Personales en la República del Paraguay
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Consent, Security, DPIA, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a valid legal basis, such as the data subject's consent or a contract, before processing any personal data, and make sure any consent obtained is prior, free, informed and unambiguous.NIST Privacy FrameworkCT.PO-P1
- Obtain the consent of a child or adolescent only on the terms article 7 sets, and rely on legitimate interest only where article 8 allows.NIST Privacy FrameworkCT.PO-P1
- Carry out an impact assessment before implementing processing that warrants one, and consult the supervisory authority beforehand where article 15 requires it.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkGV.PO-P5
- Take the security measures article 16 requires of a controller and of a processor.NIST Privacy FrameworkPR.DS-P5
- Appoint a data protection officer as article 18 provides.NIST Privacy FrameworkGV.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 6 puts on the controller the burden of proving that the data subject consented, which cannot be shown without a consent record. Article 9 has the controller apply measures so as to guarantee and be able to demonstrate compliance, and article 4 (diligencia debida) asks it to demonstrate that its measures are effectively implemented; neither names a log or register. Article 8 lets the control authority require the controller's prior analysis justifying a legitimate-interest basis, which gives the authority a demand over that document. Article 4's storage-limitation principle limits the data, not a record, and sets no period for one. Article 14 requires an impact assessment before risky processing, with its content left to the regulation, and article 15 requires prior consultation of the authority, which is a filing. The authority's audit powers are in article 35, outside the row. The hook lists the four limbs of article 2: establishment in Paraguay, processing of data of persons located in Paraguay, offering goods or services to residents, and monitoring behavior in Paraguay.
- Kind
- Implicit
- As of
- Provision
- Articles 4, 6, 8 and 9
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Article 2 applies the law to any automated or non-automated processing of personal data forming part of a file, by natural or legal persons. Article 4 sets the general principles of personal data protection and article 5 requires at least one lawful basis before personal data may be processed. Article 6 requires consent to be prior, free, informed and unambiguous, article 7 governs the consent of children and adolescents, and article 8 legitimate interest.
Articles 9 to 12 fix the positions of the controller, joint controllers, the processor and their representatives, and article 13 binding self-regulation mechanisms. Article 14 requires an impact assessment before implementing processing that warrants one and article 15 prior consultation of the supervisory authority. Article 16 requires the controller and processor to take security measures, and article 18 provides for the data protection officer.
Articles 24 and 25 govern access to public information alongside data protection, and the exchange of personal data between public institutions. Article 57 enters the law into force twenty-four months after its official publication.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .