Ley para la Protección de Datos Personales

Article 1 sets the Law's object as regulating the lawful and informed treatment of personal data to guarantee the right to privacy and informational self determination, and article 2 binds any natural or legal person, public or private, that processes personal data manually, partially or fully automated, or through a third party, including one that processes personal data without meeting this Law's requirements, while subjecting organs of the State and municipal authorities specifically to Title III.

Article 3 excludes credit history data already regulated by its own statute, except for financial system supervised entities' non credit data, purely personal or domestic processing, public safety and criminal justice processing, and processing under the civil registry and national identity document statutes.

Article 5 states ten governing principles: accuracy, loyalty, consent and purpose, data minimization, transparency in plain language, security, a six ground lawful basis test built on consent, contractual necessity, a legal obligation, vital interests, public interest, or legitimate interest, storage limitation, demonstrated accountability, and progressive exercise of children's faculties.

Article 26 requires consent to be express, given verbally, in writing, or through unequivocal signs recorded by a physical, electronic, or other technological means, and article 27 requires that consent to be free, specific, informed, express, and individualized.

Article 28 excuses consent for personal data from a publicly accessible source that is not sensitive, medical emergencies, dissociated data, missing persons, contractual or scientific relationships, data the data subject has already made public, and historical or scientific archives, and articles 29 to 31 let a data subject revoke consent at any time without retroactive effect, require the delegate to act on a revocation within five business days, and let a data subject complain to the Entidad Rectora over a refused revocation.

Article 32 confines a private entity's processing to data directly related to the services it provides that data subject, and bars transferring or processing a third party's data for another purpose without that party's authorization. Article 33 requires a documented ARCO POL procedure and requires any subcontractor with access to personal data to submit to this Law.

Article 34 requires the responsible party to limit processing to the purpose consented to, implement security measures, and keep the data confidential, and article 36 requires the responsible party and any processor to maintain the security measures the Entidad Rectora sets for integrity, availability, and confidentiality. Article 40 conditions any transfer of personal data on the data subject's prior consent, informed of the transfer's purpose and the identity of the recipient.

Title III's articles 46 to 49 let a public body process personal data within its legal competence without the data subject's consent, while preserving a narrower set of ARCO POL rights, an information duty, and a bar on transferring or disseminating the data outside listed exceptions. Article 64 brings the decree into force eight days after its publication in the Diario Oficial, following its 12 November 2024 adoption and 15 November 2024 Diario Oficial publication.