Paraguay

Article 17 requires the controller, on a personal-data security incident occurring, to notify the supervisory authority and, where applicable, the data subject, within a period that may not exceed seventy-two hours counted from becoming aware of the incident. The conditions and requirements are left to the regulation of the law, which has not been issued. Article 57 enters the law into force twenty-four months after its official publication.

Article 2 applies the law to any automated or non-automated processing of personal data forming part of a file, by natural or legal persons. Article 4 sets the general principles of personal data protection and article 5 requires at least one lawful basis before personal data may be processed. Article 6 requires consent to be prior, free, informed and unambiguous, article 7 governs the consent of children and adolescents, and article 8 legitimate interest.

Articles 9 to 12 fix the positions of the controller, joint controllers, the processor and their representatives, and article 13 binding self-regulation mechanisms. Article 14 requires an impact assessment before implementing processing that warrants one and article 15 prior consultation of the supervisory authority. Article 16 requires the controller and processor to take security measures, and article 18 provides for the data protection officer.

Articles 24 and 25 govern access to public information alongside data protection, and the exchange of personal data between public institutions. Article 57 enters the law into force twenty-four months after its official publication.

Article 19 permits a transfer of personal data outside the national territory, including an onward transfer, only where the destination country, territory, sector or international organization offers an adequate level of protection, which the Agencia Nacional de Datos Personales assesses by reasoned resolution or by publishing an official list.

Where the destination has no adequate level of protection, the controller or processor must adopt appropriate guarantees so the processing is carried out as the law requires, and those guarantees may consist, among others, of specific or standard contractual clauses or binding corporate rules. Article 57 enters the law into force twenty-four months after its official publication.

Article 33 gives a data subject the right to ask for review of a decision based on automated processing of their personal data that adversely affects their interests or produces legal effects, including a decision that defines their personal, professional, consumer, credit or personality aspects, and the right to express their point of view and contest the decision.

The controller must, on request, give clear, complete and adequate information about the criteria and procedures the automated decision used, respecting trade and industrial secrets. Article 57 enters the law into force twenty-four months after its official publication.

Article 26 sets the general provisions on how the data subject's rights are exercised, and article 27 gives a right to information. Article 28 gives a right of access, article 29 a right of rectification, article 30 a right to object, article 31 a right of erasure and article 32 a right to portability. Article 57 enters the law into force twenty-four months after its official publication.

Article 34 establishes the supervisory and control authority and articles 35 to 40 set its functions and powers, its financial resources, and the appointment, duties, qualifications and term of its Director General. Article 41 gives the data subject administrative protection alongside the constitutional guarantee, and article 42 provides for corrective measures where the law is not complied with.

Article 43 defines what counts as a fault, article 44 the minor faults and article 45 the grave ones, with article 46 setting the administrative sanctions, article 47 the criteria for applying them, article 48 the prescription of their execution and article 49 the payment of fines. Article 50 addresses non-compliance by public institutions.

Articles 51 to 56 govern a complaint to the supervisory authority, its resolution, the procedure for establishing a fault and applying a sanction, precautionary administrative measures, reconsideration and the contentious-administrative action. Article 57 enters the law into force twenty-four months after its official publication.

Article 1 states the object of the law as guaranteeing the protection of a person's credit data and regulating the collection of, and access to, credit-information data, as well as the constitution, organization, operation, rights, obligations and dissolution of the legal persons dedicated to that activity; State agencies and pension-fund administrators count among the sources of credit-relevant information the law reaches.

The law's own definition of sensitive data mirrors the later comprehensive law's, reaching racial or ethnic origin, religious belief, union affiliation, political opinion, health, sexual orientation, genetic data and biometric data aimed at uniquely identifying a natural person. Article 21 assigns enforcement jointly to the Banco Central del Paraguay and the Secretaría de Defensa del Consumidor y el Usuario, each within its own competence, over the infractions the article lists.

Article 23 sets administrative sanctions rising from a warning to a fine of up to 15,000 minimum daily wages, doubled on repetition up to a ceiling of 50,000, to a suspension of data-processing operations of six months to five years or a permanent closure for sensitive-data infractions, none of which are stated as a fixed currency amount.

Article 30 repealed Ley N° 1682/2001, which had regulated privately held personal information generally, along with its amending laws, in the same act that created this credit-specific regime.

From its entry into force, twenty-four months after its publication, Ley N° 7593/2025 treats this law's references to the Secretaría de Defensa del Consumidor y el Usuario as references to the new National Personal Data Protection Agency, and its Article 59 repeals article 4, subparagraphs a) and b) of article 3, subparagraph b) of article 20, and subparagraph x) of article 21 of this law.

Article 20 prohibits the processing of sensitive data except on the narrow grounds it lists, such as the data subject's own consent or a case where the person has made the data public. Article 3 defines personal data sensibles to include racial or ethnic origin, religious or political belief, health, sexual orientation, genetic data and biometric data aimed at uniquely identifying a person.

Article 21 governs the processing of credit information data, which Ley N° 6534/2020 continues to regulate in its own right, article 22 processing for video-surveillance purposes, and article 23 the processing of data of a criminal nature, sanctions and infractions. Article 57 enters the law into force twenty-four months after its official publication.

Article 174 b punishes accessing a computer system or its components, using one's own identity or someone else's, or exceeding an authorization, with imprisonment of up to three years or a fine, and defines a computer system broadly to reach any device or interconnected set of devices whose function is data processing by a computer program. The provision's text does not require circumventing a security measure, unlike article 146 b below.

Article 146 b, narrower, punishes obtaining access to data that is specially protected against unauthorized access, without authorization and by violating a security system, also with imprisonment of up to three years or a fine, so ordinary access to unprotected, publicly available data falls outside its plain terms.

The same Ley N° 4439/2011 also introduced article 175, renaming and widening the pre-existing sabotage offence into sabotage of computer systems, punishing obstruction of a data-processing operation by an article 174-type act or by destroying, disabling, removing or altering processing infrastructure, with imprisonment of up to five years or a fine, and article 175 b, which conditions prosecution of articles 174 and 175 on the victim's complaint except where the public interest requires prosecution ex officio.

Article 8 excludes several categories from copyright protection outright: ideas, official legislative, administrative or judicial texts, the news of the day, and mere facts or data. Article 40 permits quoting a lawfully disclosed work without the author's authorization or payment, on condition that the author's name and the source are indicated and the quotation conforms to fair practice and is justified by its purpose.

Article 41 separately permits, without authorization or payment and subject to naming the author and the source, the reproduction and distribution by the press, or transmission by any medium, of current-affairs articles on economic, social, artistic, political or religious questions published in the media or broadcast, but only where the reproduction or disclosure has not been made the subject of an express reservation by the rightsholder, and article 45 requires every exception in this chapter to be interpreted restrictively and never applied contrary to fair practice.

No text-and-data-mining exception, machine-readable or otherwise, has been enacted in Paraguay, so scraping a copyrighted text for model training rests only on articles 40 and 41's general exceptions, both narrower than a text and data mining (TDM) carve-out and both defeated by an express reservation.

Article 4, numeral 14 lists collections of works, such as encyclopedias and anthologies, and of other elements, such as a database, among the works copyright protects, but only where the collection is original by reason of the selection, coordination or arrangement of its contents; the enumeration is stated to be illustrative rather than exhaustive.

Paraguay confers no separate sui generis database right of the kind some other jurisdictions register: a database that is merely an unoriginal aggregation of data is not protected at all, and one that is original is protected as a compilation under ordinary copyright, not under a distinct right. Article 44's exception for personal copying does not extend to a database or compilation of data, so even a use that would otherwise be personal copying does not reach a protected database.

Article 20, paragraph 1 requires qualified and non-qualified trust service providers to adopt the technical and organizational measures appropriate to manage the security risks of the trust services they provide. Article 13, paragraph 2 requires providers to manage the security incidents that affect them, with mechanisms for prevention, detection, analysis and resolution.

Article 21, paragraph 4, item k lists the failure to resolve security incidents in networks and information systems among the serious infractions. Article 22 sets a fine of 1,001 to 5,000 minimum daily wages (jornales mínimos) for a serious infraction and 5,001 to 10,000 minimum daily wages for a very serious one. Article 104 of the Law provides that it enters into force four months after its promulgation.

Resolución MITIC N° 346/2020 approves and implements the regulation on mandatory reporting of cyber security incidents by state bodies to the Ministerio de Tecnologías de la Información y Comunicación through CERT-PY, regulating Article 44 of Decreto N° 2274/2019. The regulation requires every public servant to report any possible cyber security incident to the information security officer of the institution or, failing one, to the director of its UETIC.

The regulation makes it the duty of that officer or director to report every cyber security incident to CERT-PY by email, with a description and any data that helps investigate it. The regulation defines a cyber security incident as an imminent threat to the information security policies of an institution, or any event that compromises the security of an information system. The regulation provides that MITIC keeps the details of reported cyber incidents confidential.

Article 20, paragraph 2 requires a qualified or non-qualified trust service provider to notify the supervisory body and the Centro de Respuestas a Incidentes Cibernéticos of the Ministerio de Tecnologías de la Información y Comunicación of a security breach with a significant impact on the trust service, without undue delay and in any case within twenty-four hours of becoming aware of it.

Article 20, paragraph 2 requires the provider to notify a natural or legal person to whom it provided the service when the security breach may harm that person. Article 20, paragraph 2 provides that the notified supervisory body informs the public of the breach, or requires the provider to do so, when it considers that disclosure is in the public interest.

Article 13, paragraph 1 requires qualified and non-qualified trust service providers to notify the Autoridad de Aplicación of the security breaches they suffer. Article 13, paragraph 3 requires providers to expand the information in the initial notification once the incident is resolved, following the guidelines the Autoridad de Aplicación may set.

Article 21, paragraph 4, items f and g lists the failure to give the twenty-four hour notification, or to notify an affected person, among the serious infractions. Article 22 sets a fine of 1,001 to 5,000 minimum daily wages (jornales mínimos) for a serious infraction and 5,001 to 10,000 minimum daily wages for a very serious one. Article 104 of the Law provides that it enters into force four months after its promulgation.

Article 8 excludes the news of the day and mere facts or data from copyright protection outright, alongside ideas and official legislative, administrative or judicial texts: a bare fact, or the news of the day as such, is never a protected work under Paraguayan law, whichever outlet reports it first.

Article 41 separately permits, without the author's authorization or payment, and provided the author's name and source are clearly credited, the reproduction and distribution by the press, or transmission by any medium, of current-affairs articles on economic, social, artistic, political or religious questions published in the media or broadcast, but only where the reproduction or disclosure has not been made the subject of an express reservation by the rightsholder.

The exception is not capped at a headline-length or short-extract threshold and is not confined to the press industry, but article 45 requires it to be interpreted restrictively and never applied contrary to fair practice.