Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay

Ley N° 7593/2025, arts. 1-16, 18 y 24-25 (ámbito, principios, seguridad y obligaciones del responsable)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force in 430 days, effective 27 November 2027.

A comprehensive regime rule binding public and private bodies.

As of 19 September 2026.

What it requires

This law was enacted on 27 November 2025 but does not take effect until 27 November 2027; what follows applies from that date.
Establish a valid legal basis, such as the data subject's consent or a contract, before processing any personal data, and make sure any consent obtained is prior, free, informed and unambiguous.
Obtain the consent of a child or adolescent only on the terms article 7 sets, and rely on legitimate interest only where article 8 allows.
Carry out an impact assessment before implementing processing that warrants one, and consult the supervisory authority beforehand where article 15 requires it.
Take the security measures article 16 requires of a controller and of a processor.
Appoint a data protection officer as article 18 provides.

What it reaches

Obligation class

Consent, Security, DPIA, Governance

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 2 applies the law to any automated or non-automated processing of personal data forming part of a file, by natural or legal persons. Article 4 sets the general principles of personal data protection and article 5 requires at least one lawful basis before personal data may be processed. Article 6 requires consent to be prior, free, informed and unambiguous, article 7 governs the consent of children and adolescents, and article 8 legitimate interest.

Articles 9 to 12 fix the positions of the controller, joint controllers, the processor and their representatives, and article 13 binding self-regulation mechanisms. Article 14 requires an impact assessment before implementing processing that warrants one and article 15 prior consultation of the supervisory authority. Article 16 requires the controller and processor to take security measures, and article 18 provides for the data protection officer.

Articles 24 and 25 govern access to public information alongside data protection, and the exchange of personal data between public institutions. Article 57 enters the law into force twenty-four months after its official publication, so it is enacted and binds nobody until 27 November 2027.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

Official text of Ley N° 7593/2025, published by the Biblioteca y Archivo Central del Congreso Nacional (BACN)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app