Argentina

Article 1 of the regulation brings within the private databases that supply reports any database that exceeds exclusively personal use and any database whose purpose is to cede or transfer personal data, whether the report is given for a fee or free. Article 4 requires the controller to delete data that has lost currency for the purposes for which it was collected, without waiting for the data subject to ask.

Article 5 defines informed consent as consent preceded by an explanation to the data subject, in a form suited to their social and cultural level, of the information that article 6 of the Act lists. Under article 5, consent to the processing of personal data may be revoked at any time, and the revocation has no retroactive effect.

Article 25 requires a contract that binds a processor to the controller and provides that the processor acts only on the controller's instructions and that the obligations of article 9 of the Act also fall on the processor. The Executive issued Decreto 1558/2001 on 29 November 2001 and it was published in the Boletín Oficial on 3 December 2001.

Ley 25.326 requires free, express, and informed consent before processing personal data, with exceptions for data from unrestricted public-access sources, data gathered for a State function or legal obligation, short listings limited to name and identifying numbers, data arising from a contractual, scientific, or professional relationship, and financial-entity customer data under Ley 21.526.

Article 4 requires personal data to be true, adequate, relevant, and not excessive for the purpose it was obtained, collected lawfully, used only for the purpose that motivated its collection, kept accurate and updated, corrected or deleted when found inaccurate or incomplete, stored so the data subject's access right can be exercised, and destroyed once no longer necessary.

Article 9 requires the controller or user of a database to adopt the technical and organizational measures needed to guarantee security and confidentiality and to detect deviations, and bars registering personal data in a file that lacks the technical conditions of integrity and security.

Article 10 binds the controller and everyone who takes part in processing to professional secrecy, surviving the end of their relationship with the database's owner, relievable only by judicial order or for public-security, national-defense, or public-health reasons.

Article 11 lets personal data be disclosed to a third party only for a purpose directly tied to the legitimate interest of both discloser and recipient and with the data subject's prior, revocable consent naming the purpose and the recipient, subject to listed exceptions including a legal mandate, an inter-agency transfer within the same competence, health data needed for public-health or epidemiological reasons under dissociation, or already-dissociated data; the recipient takes on the discloser's same legal obligations and the discloser answers jointly for their observance.

Article 21 requires registering any public or private database intended to provide reports with the National Registry, stating the controller's identity, the file's characteristics and purpose, how data is collected and updated, its recipients, its security measures, its retention period, and how a data subject can exercise their rights, and bars holding data of a different nature than what is declared; article 24 extends that registration duty to any private-sector file not for exclusively personal use.

Article 22 requires a public body to create, modify, or suppress a database only by a general disposition published in the Official Gazette stating the file's characteristics and purpose, the people it covers, how data is obtained and updated, its structure, its planned disclosures or interconnections, the responsible body, and where a data subject can exercise their rights.

Article 23 limits a military, security, police, or intelligence body's processing of personal data for national-defense or public-security purposes, taken without the data subject's consent, to what is strictly necessary for its legally assigned missions, requires the resulting files to be specific and classified by reliability, and requires police-purpose data to be cancelled once no longer needed for the inquiry that justified it.

Article 25 bars a data-processing service provider from using the personal data it processes for a purpose other than the one in the service contract or from disclosing it to others, and requires it to destroy the data once the contracted service ends unless further engagements are reasonably expected, in which case it may keep the data securely for up to two years.

Article 26 limits a credit-information service to patrimonial solvency and credit data obtained from public sources or the data subject's own information or consent, and to payment-default data furnished by the creditor, caps what may be filed or disclosed to the last five years significant to evaluating the person's solvency (two years once the debt is cancelled or otherwise extinguished), and requires disclosing to the data subject on request what was reported about them in the last six months.

Article 27 lets a business collect data for advertising, direct-marketing, or profiling purposes only from sources accessible to the public or furnished by, or with the consent of, the data subject. Article 28 exempts opinion-poll, market-research, and scientific or medical-research data from the Act only while it cannot be attributed to an identifiable person, and requires a dissociation technique where anonymity cannot otherwise be kept during collection.

Article 47, added in 2008, required a credit-reporting database to purge and stop recording delinquency or Central Bank risk-category 2 to 5 entries tied to obligations that fell due between 1 January 2000 and 10 December 2003, once the debt was cancelled or regularized, and required the original creditor to notify any database it had disclosed the default to of that cancellation.

Article 12 of the regulation lifts the Act's prohibition on transfers to countries without adequate protection where the data subject has expressly consented to the transfer. Consent is not needed for a transfer from a legally constituted public register that is open to consultation by the public or by anyone who can show a legitimate interest, provided the legal and regulatory conditions for consultation are met in each case.

The control body may assess, on its own initiative or on request, the level of protection that the rules of a State or international body provide. A State or international body is taken to provide an adequate level of protection when the protection derives directly from its legal system, from self-regulation systems, or from the cover of contractual clauses that provide for the protection of personal data.

Article 1 of Disposición 60-E/2016 approves the model contract clauses for international transfer, one for the cession of personal data and one for the provision of services, to guarantee an adequate level of protection in transfers to countries without adequate legislation.

Article 2 requires a controller that transfers personal data to a country without adequate legislation under a contract that differs from the approved models, or lacks their principles, guarantees and content, to submit the contract to the directorate for approval within thirty calendar days of signing it.

Article 3 treats as countries with adequate legislation the member states of the European Union and the European Economic Area, the United Kingdom, Switzerland, Guernsey, Jersey, the Isle of Man, the Faroe Islands, Canada for its private sector only, Andorra, New Zealand, Uruguay, and Israel for automatically processed data only. Resolución 34/2019 of the Agencia de Acceso a la Información Pública substituted article 3.

The Dirección Nacional de Protección de Datos Personales issued Disposición 60-E/2016 on 16 November 2016 and it was published in the Boletín Oficial on 18 November 2016.

Article 12.1 prohibits transferring personal data of any kind to a country or international or supranational organization that does not provide an adequate level of protection.

Article 12.2 narrows the prohibition to exempt international judicial cooperation, health-data exchange the affected person's treatment or an epidemiological investigation requires, carried out under the dissociation safeguard article 11.3.d states, banking or securities transfers governed by their own applicable law, a transfer agreed under a treaty to which Argentina is a party, and intelligence-agency cooperation against organized crime, terrorism, or drug trafficking.

Resolución 4/2019 of the Agencia de Acceso a la Información Pública approves criteria for applying Ley 25.326 and makes them mandatory for every person the Law covers. Criterio 2 of its Anexo I gives a data subject the right to ask a database controller for an explanation of the logic applied in a decision based solely on automated processing of data that produces adverse legal effects for the data subject or significantly and negatively affects them.

The Director of the Agency issued the resolution under the powers that article 29, paragraph 1, subparagraph b) of Ley 25.326 confers. The resolution was published in the Boletín Oficial on 16 January 2019.

Article 27 of the regulation allows personal data to be collected, processed and ceded for advertising without the data subject's consent when it is used to form profiles that categorize similar preferences and behaviors, provided data subjects are identified only by membership in such generic groups plus the individual data strictly necessary to make the offer.

Every advertising communication sent by mail, telephone, email, the Internet or another distance medium must state expressly and prominently that the data subject may ask for total or partial withdrawal or blocking of their name from the database. The withdrawal may be total or partial, blocking at the data subject's request only the use of particular media such as mail, telephone or email.

On the data subject's request, the controller must disclose the name of the controller or user of the data bank that supplied the information.

Article 14 of the regulation says the request to exercise the right of access needs no specific formula, provided it identifies the data subject, and may be made in person to the controller or by written notice that leaves proof of receipt.

The right of access lets the data subject learn whether they are in the database, all the data held about them, the sources and means by which it was obtained, the purposes for which it was collected, the planned destination of the data, and whether the database is registered as the Act requires. Once the period to answer has expired, the data subject may bring the personal data protection action and report the matter to the control body.

Article 15 requires the controller to answer an access request whether or not it holds data on the person, by any of the means the Act allows at the data subject's option or by the means the requester stated. Article 16 reads the Act's provisions that mention one of the rights of rectification, updating, erasure and confidentiality as referring to all of them.

Article 6 requires telling a data subject, before their personal data is collected, the purpose for which it will be processed and the recipients or classes of recipients, that a file, registry, or database exists together with its controller's identity and address, whether answering the questionnaire is mandatory or optional, the consequences of providing the data, refusing to, or giving inaccurate data, and that they may exercise access, rectification, and erasure rights.

Article 13 lets any person query the control body's public, free registry to learn what personal-data files exist, their purposes, and their controllers' identity.

Article 14 gives the data subject, once their identity is verified, the right to request and obtain their personal data from a public or private reporting database, to be answered within ten running days, exercisable free of charge at intervals no shorter than six months absent a legitimate interest, and exercisable by a deceased person's universal successors.

Article 15 requires the information to be given clearly, without codes, in plain language, covering the subject's whole record without revealing a third party's data, in the medium of the data subject's choice.

Article 16 gives a data subject the right to have their inaccurate, incomplete, or outdated personal data rectified, updated, or, where appropriate, deleted or made confidential, requires the controller to act within five business days of the claim or of learning of the error, requires notifying any recipient the data were disclosed to within five business days, bars erasure where it would harm a third party's legitimate rights or a legal duty requires retention, and requires marking a record under review while its accuracy is verified.

Article 19 makes rectification, updating, or erasure of inaccurate or incomplete personal data free of charge. Article 27.3 lets a data subject request the removal or blocking of their name from an advertising, direct-marketing, or profiling database at any time.

Article 1 of Resolución 126/2024 of the Agencia de Acceso a la Información Pública approves the classification of infringements and the regime for grading sanctions for infringements of Leyes 25.326 and 26.951.

Annex I classifies as serious infringements, among others, processing personal data without an adequate legal basis, collecting data without giving the information article 6 of the Act requires, and not attending in due time and form a data subject's request for access, rectification or erasure where legally due.

Annex I classifies as very serious infringements, among others, transferring personal data to countries or international bodies without adequate protection, outside the exceptions of article 12, paragraph 2, of the Act, without meeting the Act's other legal requirements.

Annex I also classifies as very serious collecting and processing sensitive data without the data subject's consent or a reason of general interest authorized by law, or for statistical or scientific purposes without due anonymization.

Annex II sets for minor infringements up to two warnings and/or a fine of 1,000 to 80,000 pesos, for serious infringements up to four warnings, suspension of 1 to 30 days and/or a fine of 80,001 to 90,000 pesos, and for very serious infringements up to six warnings, suspension of 31 to 365 days, closure or cancellation of the database and/or a fine of 90,001 to 100,000 pesos.

Annex II caps the total fine for several fines for identical sanctionable conduct in one proceeding at the maximum of the applicable scale multiplied by 500. Annex II reduces the graduation of a fine by 50 percent when it is paid voluntarily within twenty working days of notification. Annex II lets the control body impose an obligation to act so that the infringer ceases the breach and order mandatory data-protection training.

The resolution took effect on 1 June 2024 and repealed Disposición DNPDP 7/2005 and Resoluciones AAIP 12/2018, 240/2022, 243/2019 and 244/2022.

Article 29 of the regulation, as substituted by Decreto 899/2017, makes the Agencia de Acceso a la Información Pública the control body of Ley 25.326. Under article 31 the size of a sanction is graded by the nature of the personal rights affected, the volume of processing, the benefits obtained, the degree of intent, recidivism, the harm caused to the people concerned and to third parties, and any other circumstance relevant to the degree of unlawfulness and culpability.

The control body opens administrative proceedings for alleged infringements on its own initiative or on a complaint from a person with a particular interest, the Ombudsman of the Nation or a consumer association. A controller asked for a report on a complaint or an ex officio action must answer within ten working days, unless it requests in due form an extension of no more than ten further working days.

Entries in the register of infringers for firm sanctions must be published on the website of the data-protection directorate.

Article 29.1 charges the control body (the AAIP's Dirección Nacional de Protección de Datos Personales) with assisting and advising people about their rights, issuing the rules the Act requires, keeping a census and permanent registry of databases, controlling compliance with data-integrity and security rules, with judicial authorization to inspect premises, equipment, or processing programs, requesting information and records from public and private entities, imposing the administrative sanctions the Act allows, acting as a private prosecutor in a criminal case the Act's violation brings, and controlling a private reporting database's registration requirements.

Article 30 lets an association or entity representing private-sector database controllers or users draft a professional code of conduct for personal-data processing, and requires the control body to register it, which it may refuse where the code does not conform to the applicable rules.

Article 31 lets the control body impose a warning, suspension, a fine of one thousand to one hundred thousand pesos, or closure of the file, without prejudice to any public-sector administrative liability, civil damages, or criminal sanction, graded to the violation's gravity and harm under due process; the enforcement authority's implementing regulation, Resolución AAIP 126/2024, grades these into three severity tiers and caps the aggregate fine for identical multiple sanctions in one proceeding at five hundred times the applicable tier's maximum.

Article 32 inserted articles 117 bis and 157 bis into the Código Penal; article 157 bis, since substituted by Ley 27.759 in 2024, punishes unauthorized access to, disclosure from, or illegitimate insertion into a personal database with one month to two years' imprisonment. The penalty rises to six months to four years, with a further two to five years' special disqualification from practising the profession, for conduct reaching a genetic-data databank or a DNA record, examination or sample.

Articles 33 to 43 arm an affected person, their guardian, or their universal successor with a habeas data judicial action against a public or private reporting database's controller or user, heard by the judge of the plaintiff's or defendant's domicile or of the place the act had effect, with federal jurisdiction over a national public database or one interconnected across jurisdictions, following the ordinary amparo procedure and, where the record's falsity or inaccuracy is manifest, letting the judge provisionally block the file pending the court's judgment, which must be reported to the control body's own registry.

Health data may be processed to make offers of goods and services only if it was obtained in accordance with the Act and without causing discrimination, in the context of a relationship between a consumer or user and providers of medical services or treatments and non-profit entities. Such health data may not be transferred to third parties without the prior, express and informed consent of the data subject.

To give that consent, the data subject must receive a clear notice of the sensitive nature of the data and that they are not obliged to provide it, together with the information in articles 6 and 11, paragraph 1, of the Act and a mention of their right to ask for removal from the database.

Article 7.1 bars requiring any person to provide sensitive data, defined in article 2 as data revealing racial or ethnic origin, political opinions, religious, philosophical, or moral convictions, union membership, or health or sexual-life information; article 7.2 permits collecting and processing it only for reasons of general interest authorized by law, or for statistical or scientific purposes where the data subject cannot be identified.

Article 7.3 bars forming a file, bank, or registry whose purpose is to store information that directly or indirectly reveals sensitive data, but excepts a membership registry the Catholic Church, a religious association, or a political or union organization keeps of its own members. Article 7.4 confines processing of a person's criminal or administrative-offense record to the competent public authorities acting under the applicable laws and regulations.

Article 8 lets a public or private health establishment, or a health professional, collect and process a patient's physical or mental health data under the rules of professional secrecy. The Act's closed sensitive-data list names no biometric identifier, so a faceprint, fingerprint, or voiceprint falls within the Act's general rules rather than this heightened regime.

Article 153 bis punishes with fifteen days to six months' imprisonment, if the act is not a more severely punished offense, a person who knowingly accesses, by any means, without due authorization or exceeding the authorization held, a computer system or data of restricted access. The penalty rises to one month to one year's imprisonment when the access harms a system or data belonging to a state public body or a public-services or financial-services provider.

Because the offense's own text requires the system or data to be one 'de acceso restringido' (of restricted access), a plain reading does not reach reading a public, unauthenticated page that carries no access-control barrier such as a password, permission, or authentication requirement. Ley 26.388 was passed on 4 June 2008 and promulgated de hecho on 24 June 2008. It was published in the Boletín Oficial on 25 June 2008.

The Law ends with an order to communicate it to the Executive and states no day of its own for its entry into force. Article 2 of the Código Civil then in force, as substituted by Ley 16.504, made a law that designates no time binding after the eight days following its official publication. No source located states the day on which the Law became binding.

Article 10 lets anyone publish, for didactic or scientific purposes, commentary, criticism, or notes on intellectual works, including up to one thousand words of a literary or scientific work, or eight musical measures, and only the indispensable portions of the text for that purpose; the same provision reaches teaching works, collections, anthologies, and similar compilations.

Article 1 protects, among literary and scientific works, source and object computer programs and data compilations, so Argentina protects a compilation as a copyright work rather than through a separate sui generis database right, subject to the same originality standard as any other work. Article 1 also states that copyright protection reaches the expression of ideas, procedures, operating methods, and mathematical concepts but not those ideas, procedures, methods, and concepts themselves.

No commencement clause or commencement notice for the Law has been located. The Law was sanctioned on 26 September 1933 and published in the Boletín Oficial of 30 September 1933, issue number 11799.

Ley 25.326 defines personal data as information of any kind referring to identified or identifiable individuals or corporations, without excluding information that is publicly accessible, so scraping personal data from a public Argentine website does not by itself remove the data from the Act's coverage.

Article 5.2.a excuses the consent requirement specifically where the data is obtained from an unrestricted public-access source, but that exception is textually confined to consent, leaving the Act's other duties, registration of the resulting file or database, data quality, security, and the cross-border transfer restriction in article 12, applicable to a scraper that becomes the person in charge of, or user of, a database intended to provide reports.

Ley 25.326 was passed on 4 October 2000 and partially promulgated on 30 October 2000. It was published in the Boletín Oficial on 2 November 2000. The Law ends with an order to communicate it to the Executive and states no day of its own for its entry into force. Article 2 of the Código Civil then in force, as substituted by Ley 16.504, made a law that designates no time binding after the eight days following its official publication. No source located states the day on which the Law became binding.

Communication "A" 7724 of the Banco Central de la República Argentina is addressed to financial entities. Section 1.2 of the rules requires the covered entity to ensure effective practices for internal control and risk management of its technology and information security environment. Section 5.8.2 of the rules requires a vulnerability management process for all systems and applications, whether owned or provided by third parties.

That process must include contact points for notifying vulnerabilities in the entity's internal and external services. Section 8.1 of the rules requires the entity to establish norms and procedures to manage, control and document cyber-incident activities. The Communication takes effect 180 calendar days after its dissemination.

Infractions of the Ley de Entidades Financieras, its regulatory norms and the resolutions the Bank issues are subject to sanction by the Bank under article 41 of that law.

Resolución General 1058/2025 of the Comisión Nacional de Valores was adopted on 12 March 2025 and published in the Boletín Oficial on 14 March 2025. The resolution enters into force 45 days after its publication. The obligations of the chapter, except those the transitory rules name, become enforceable against virtual asset service providers already registered from 31 December 2025.

Article 13 requires virtual asset service providers to establish cybersecurity procedures at all times, on a risk basis. Article 13 requires periodic internal cybersecurity assessments and audits focused on the cyber-resilience of the infrastructure. Article 13 requires systems able to recognize potential incidents or to detect that a security breach has occurred.

Article 13 requires infrastructure that lets the provider continue essential functions and restore critical systems after a cyberattack. Article 14 requires information security policies approved by the provider's administrative body. Breaches of the requirements lead to the sanctions of Chapter I of Title IV of the Ley de Mercado de Capitales 26.831, as article 37 of Ley 27.739 provides.

The guidelines apply to financial entities, to payment service providers in the BCRA register and to systemically important payment systems. Section 3 of the guidelines is mandatory. Section 3.1 requires the covered entities to notify cyber-incidents that affect the normal provision of services to clients or put at risk the availability, integrity or confidentiality of information.

Section 3.3.1 requires an initial notification within the first hour of the incident occurring or being detected, with all the information available. Section 3.3.2 requires updates on the incident's status from the initial notification until its resolution. Section 3.3.3 requires a final report within no more than 5 calendar days after containment, recovery and resolution.

Payment service providers in the register, other than those offering payment accounts, have 60 business days from the communication's dissemination to implement the guidelines. Infractions of the Ley de Entidades Financieras, its regulatory norms and the resolutions the Bank issues are subject to sanction by the Bank under article 41 of that law.

Article 28 makes unsigned articles, anonymous contributions, reports, drawings, engravings, or other original material acquired by a newspaper, magazine, or other periodical, or by a news agency, with exclusivity, the property of that outlet or agency; general-interest news, by contrast, may be used, transmitted, or retransmitted, though its source must be stated whenever it is published in its original form.

Article 27 bars publishing a political or literary speech, or a lecture on an intellectual subject, without the author's express authorization, and separately bars publishing a parliamentary speech for profit without the author's authorization, except for press reporting on it.

Article 10 lets anyone publish, for didactic or scientific purposes, commentary, criticism, or notes on intellectual works, including up to one thousand words of a literary or scientific work or eight musical measures, limited to the portions indispensable for that purpose; it carries no headline-length cap distinct from that word count and is not confined to the press industry.

No reported Argentine decision applies article 28's exclusivity rule, or article 10's quotation exception, to a systematic news aggregator as opposed to a competing news outlet or an individual quoting a published work. Argentina has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, and no located case law on hyperlinking or framed display. No commencement clause or commencement notice for the Law has been located.

The Law was sanctioned on 26 September 1933 and published in the Boletín Oficial of 30 September 1933, issue number 11799.