Paraguay

Article 17 requires the controller, on a personal-data security incident occurring, to notify the supervisory authority and, where applicable, the data subject, within a period that may not exceed seventy-two hours counted from becoming aware of the incident. The conditions and requirements are left to the regulation of the law, which has not been issued.

Article 57 enters the law into force twenty-four months after its official publication, so it is enacted and binds nobody until 27 November 2027.

Article 2 applies the law to any automated or non-automated processing of personal data forming part of a file, by natural or legal persons. Article 4 sets the general principles of personal data protection and article 5 requires at least one lawful basis before personal data may be processed. Article 6 requires consent to be prior, free, informed and unambiguous, article 7 governs the consent of children and adolescents, and article 8 legitimate interest.

Articles 9 to 12 fix the positions of the controller, joint controllers, the processor and their representatives, and article 13 binding self-regulation mechanisms. Article 14 requires an impact assessment before implementing processing that warrants one and article 15 prior consultation of the supervisory authority. Article 16 requires the controller and processor to take security measures, and article 18 provides for the data protection officer.

Articles 24 and 25 govern access to public information alongside data protection, and the exchange of personal data between public institutions. Article 57 enters the law into force twenty-four months after its official publication, so it is enacted and binds nobody until 27 November 2027.

Article 19 permits a transfer of personal data outside the national territory, including an onward transfer, only where the destination country, territory, sector or international organization offers an adequate level of protection, which the Agencia Nacional de Datos Personales assesses by reasoned resolution or by publishing an official list.

Where the destination has no adequate level of protection, the controller or processor must adopt appropriate guarantees so the processing is carried out as the law requires, and those guarantees may consist, among others, of specific or standard contractual clauses or binding corporate rules. Article 57 enters the law into force twenty-four months after its official publication, so it is enacted and binds nobody until 27 November 2027.

Article 26 sets the general provisions on how the data subject's rights are exercised, and article 27 gives a right to information. Article 28 gives a right of access, article 29 a right of rectification, article 30 a right to object, article 31 a right of erasure and article 32 a right to portability. Article 33 gives the data subject rights against individual decisions taken by automated or semi-automated means.

Article 57 enters the law into force twenty-four months after its official publication, so it is enacted and binds nobody until 27 November 2027.

Article 34 establishes the supervisory and control authority and articles 35 to 40 set its functions and powers, its financial resources, and the appointment, duties, qualifications and term of its Director General. Article 41 gives the data subject administrative protection alongside the constitutional guarantee, and article 42 provides for corrective measures where the law is not complied with.

Article 43 defines what counts as a fault, article 44 the minor faults and article 45 the grave ones, with article 46 setting the administrative sanctions, article 47 the criteria for applying them, article 48 the prescription of their execution and article 49 the payment of fines. Article 50 addresses non-compliance by public institutions.

Articles 51 to 56 govern a complaint to the supervisory authority, its resolution, the procedure for establishing a fault and applying a sanction, precautionary administrative measures, reconsideration and the contentious-administrative action. Article 57 enters the law into force twenty-four months after its official publication, so it is enacted and binds nobody until 27 November 2027.

Article 1 states the object of the law as guaranteeing the protection of a person's credit data and regulating the collection of, and access to, credit-information data, as well as the constitution, organization, operation, rights, obligations and dissolution of the legal persons dedicated to that activity; State agencies and pension-fund administrators count among the sources of credit-relevant information the law reaches.

The law's own definition of sensitive data mirrors the later comprehensive law's, reaching racial or ethnic origin, religious belief, union affiliation, political opinion, health, sexual orientation, genetic data and biometric data aimed at uniquely identifying a natural person. Article 21 assigns enforcement jointly to the Banco Central del Paraguay and the Secretaría de Defensa del Consumidor y el Usuario, each within its own competence, over the infractions the article lists.

Article 23 sets administrative sanctions rising from a warning to a fine of up to 15,000 minimum daily wages, doubled on repetition up to a ceiling of 50,000, to a suspension of data-processing operations of six months to five years or a permanent closure for sensitive-data infractions, none of which are stated as a fixed currency amount.

Article 30 repealed Ley N° 1682/2001, which had regulated privately held personal information generally, along with its amending laws, in the same act that created this credit-specific regime.

Ley N° 7593/2025 will, once it enters into force on 27 November 2027, treat this law's references to the Secretaría de Defensa del Consumidor y el Usuario as references to the new National Personal Data Protection Agency, and repeals article 4, subparagraphs a) and b) of article 3, subparagraph b) of article 20, and subparagraph x) of article 21 of this law in advance of that date.

Article 20 prohibits the processing of sensitive data except on the narrow grounds it lists, such as the data subject's own consent or a case where the person has made the data public. Article 3 defines personal data sensibles to include racial or ethnic origin, religious or political belief, health, sexual orientation, genetic data and biometric data aimed at uniquely identifying a person.

Article 21 governs the processing of credit information data, which Ley N° 6534/2020 continues to regulate in its own right, article 22 processing for video-surveillance purposes, and article 23 the processing of data of a criminal nature, sanctions and infractions. Article 57 enters the law into force twenty-four months after its official publication, so it is enacted and binds nobody until 27 November 2027.

Article 174 b punishes accessing a computer system or its components, using one's own identity or someone else's, or exceeding an authorization, with imprisonment of up to three years or a fine, and defines a computer system broadly to reach any device or interconnected set of devices whose function is data processing by a computer program. The provision's text does not require circumventing a security measure, unlike article 146 b below.

Article 146 b, narrower, punishes obtaining access to data that is specially protected against unauthorized access, without authorization and by violating a security system, also with imprisonment of up to three years or a fine, so ordinary access to unprotected, publicly available data falls outside its plain terms.

The same Ley N° 4439/2011 also introduced article 175, renaming and widening the pre-existing sabotage offence into sabotage of computer systems, punishing obstruction of a data-processing operation by an article 174-type act or by destroying, disabling, removing or altering processing infrastructure, with imprisonment of up to five years or a fine, and article 175 b, which conditions prosecution of articles 174 and 175 on the victim's complaint except where the public interest requires prosecution ex officio.

Article 8 excludes several categories from copyright protection outright: ideas, official legislative, administrative or judicial texts, the news of the day, and mere facts or data. Article 40 permits quoting a lawfully disclosed work without the author's authorization or payment, on condition that the author's name and the source are indicated and the quotation conforms to fair practice and is justified by its purpose.

Article 41 separately permits, without authorization or payment and subject to naming the author and the source, the reproduction and distribution by the press, or transmission by any medium, of current-affairs articles on economic, social, artistic, political or religious questions published in the media or broadcast, but only where the reproduction or disclosure has not been made the subject of an express reservation by the rightsholder, and article 45 requires every exception in this chapter to be interpreted restrictively and never applied contrary to fair practice.

No text-and-data-mining exception, machine-readable or otherwise, has been enacted in Paraguay, so scraping a copyrighted text for model training rests only on articles 40 and 41's general exceptions, both narrower than a text and data mining (TDM) carve-out and both defeated by an express reservation.

Article 4, numeral 14 lists collections of works, such as encyclopedias and anthologies, and of other elements, such as a database, among the works copyright protects, but only where the collection is original by reason of the selection, coordination or arrangement of its contents; the enumeration is stated to be illustrative rather than exhaustive.

Paraguay confers no separate sui generis database right of the kind some other jurisdictions register: a database that is merely an unoriginal aggregation of data is not protected at all, and one that is original is protected as a compilation under ordinary copyright, not under a distinct right. Article 44's exception for personal copying does not extend to a database or compilation of data, so even a use that would otherwise be personal copying does not reach a protected database.

Article 8 excludes the news of the day and mere facts or data from copyright protection outright, alongside ideas and official legislative, administrative or judicial texts: a bare fact, or the news of the day as such, is never a protected work under Paraguayan law, whichever outlet reports it first.

Article 41 separately permits, without the author's authorization or payment, and provided the author's name and source are clearly credited, the reproduction and distribution by the press, or transmission by any medium, of current-affairs articles on economic, social, artistic, political or religious questions published in the media or broadcast, but only where the reproduction or disclosure has not been made the subject of an express reservation by the rightsholder.

The exception is not capped at a headline-length or short-extract threshold and is not confined to the press industry, but article 45 requires it to be interpreted restrictively and never applied contrary to fair practice.