Ley de Protección de los Datos Personales (Law No. 25,326)

· About Ley de Protección de los Datos Personales (Law No. 25,326)

Key Takeaways

  • Law No. 25,326 applies to public and private databases that process personal data in Argentina and protects privacy, honor, and access rights under the Constitution; it remains the operative federal data-protection statute.[1][9]
  • The Agencia de Acceso a la Información Pública (AAIP) enforces the law and continues to issue implementing resolutions and updates, including measures in 2025 and 2026 that modify administrative requirements but do not replace the statute.[3][4][15]
  • Foreign organizations can be in scope if they process data in a way that targets or uses Argentine data subjects or local databases, especially where they maintain operations, vendors, or transfers tied to Argentina; the law’s structure is not limited to Argentine-incorporated entities.[1][9]
  • Sensitive data, cross-border transfers, and direct-marketing style uses face stricter rules than ordinary processing, and controllers must document consent or another legal basis and maintain security safeguards.[1][13]
  • The law’s sanctions include monetary fines, temporary suspension of databases, and criminal penalties for certain unlawful acts, making governance and records management essential for controllers and processors.[1][13]
  • As of 23 October 2026, reform remains unsettled: official materials show the 2000 law and its reglamentación still in force, while newer legislative proposals have not displaced it.[9][13][15]

What It Is

Law No. 25,326 is Argentina’s federal Ley de Protección de los Datos Personales, a general privacy statute that regulates the collection, use, disclosure, storage, and transfer of personal data in files, records, databases, and other processing systems.[1][9] Its stated purpose is to protect personal data while safeguarding honor, privacy, and the constitutional habeas data right.[1]

The law is enforced by the Agencia de Acceso a la Información Pública (AAIP), which also administers the national personal-data registry and issues interpretive and procedural rules.[1][3] The implementing regulation remains Decree No. 1558/2001, which approved the regulatory framework for the statute.[13]

The law was adopted on 4 October 2000 and the regulatory decree was issued in 2001.[9][13] The official updated text continues to describe the 2000 law as the active statute, and official amendment listings through 2025–2026 show complementary administrative changes rather than a replacement law.[9][15] No enacted 2025–2026 overhaul appears to have displaced the statute in force.

Who Must Comply

The law covers public-sector and private-sector databases and processing systems that handle personal data in Argentina.[1][9] It is not limited to a single industry, and it reaches banks of data “destined to give reports,” which has long made it relevant to credit, employment, customer management, and compliance databases.[1]

The law also has practical extraterritorial reach where an organization outside Argentina processes Argentine personal data through local operations, local databases, or cross-border transfers tied to Argentine data subjects.[1][13] In practice, any controller using Argentine data through a local establishment, vendor chain, or hosted infrastructure should assume compliance obligations may attach.

Exemptions are narrow and mostly function-based rather than entity-based. The law and its reglamentación preserve exceptions for certain journalistic, artistic, academic, and household activities, and they also preserve limited public-interest and state-security processing in specific circumstances.[13] Sensitive-data rules are stricter, and some processing may be exempt from consent where another legal basis applies under the statute and regulation.[1][13]

Core Requirements

  1. Lawful collection and notice: Controllers must collect personal data for lawful, specific, and explicit purposes and inform data subjects of the identity of the controller, the purpose of processing, and the consequences of providing or withholding data.[1][13]
  1. Consent or another legal basis: Personal data generally requires express and informed consent, unless a statutory exception applies; sensitive data requires a higher threshold and is subject to tighter restrictions.[1][13]
  1. Purpose limitation and minimization: Data may be used only for the purposes communicated at collection, and controllers should not retain or process more data than is necessary for the stated purpose.[1][13]
  1. Data-quality and security controls: Controllers must keep data accurate, updated, and secure, and implement technical and organizational measures appropriate to the sensitivity and risk of the processing.[1][13]
  1. Data-subject rights handling: Individuals may access their data and request rectification, updating, and suppression in the cases recognized by the law; controllers must have a workflow to respond within the statutory framework.[1][13]
  1. Cross-border transfer review: Transfers abroad are restricted unless the destination provides an adequate level of protection or another lawful transfer mechanism applies under the law and AAIP criteria.[1][13]
  1. Registration and governance obligations: Controllers operating databases subject to registration or notice requirements must maintain accurate records and comply with AAIP procedural rules.[1][3][15]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Law enacted | 4 October 2000 | Federal personal-data protection rules enter into force framework. | | Regulatory decree | 29 November 2001 | Decree No. 1558/2001 approves the regulation of Law 25,326.[13] | | AAIP procedural updates | 2025–2026 | Administrative updates and derogations affecting registry and compliance procedures continue, but the statute remains in force.[4][15] |

Maximum sanctions under the law include fines, temporary or permanent closure/suspension of the database, and criminal penalties for certain offenses such as unlawful disclosure or misuse of data.[1][13] The monetary fine ranges and criminal exposure depend on the specific violation and the applicable article, so enforcement risk should be assessed by offense type rather than treated as a single flat penalty.[1][13] In serious cases, courts may also order cessation of unlawful processing or database suspension.[1][13]

How to Comply

  1. Map processing and classify data: Build a data inventory covering all Argentine personal data, including employee, customer, vendor, surveillance, and marketing records, then classify sensitive and high-risk categories.
  1. Document lawful bases and notices: Align notices, consents, and contractual disclosures to the purpose actually used in each system, and make sure the language is understandable and specific.
  1. Set up rights-handling procedures: Create an intake and verification workflow for access, correction, update, and deletion requests, with service-level targets and escalation rules.
  1. Strengthen security controls: Use an information-security baseline aligned to ISO 27001 for governance, access control, logging, incident response, and supplier management, because those controls map directly to the law’s security expectations.[13]
  1. Embed risk management: Use NIST CSF 2.0 to organize identify, protect, detect, respond, and recover activities, especially for databases that contain sensitive or large-scale personal data.
  1. Operationalize accountability: Use ISO 42001 where AI systems ingest or profile personal data, so governance, human oversight, change control, and incident escalation are built into model deployment.
  1. Review transfers and vendors: Contractually assess foreign recipients and processors, including onward-transfer limits, security commitments, and breach reporting duties.
  1. Audit and retrain regularly: Perform periodic compliance audits, test request-response and incident procedures, and retrain business owners on lawful collection, retention, and destruction.

Related Regulations

  • Argentina Constitution, Article 43 anchors habeas data and is the constitutional basis for the statute’s privacy-rights framework.[1]
  • Decree No. 1558/2001 is the core implementing regulation and shapes practical compliance duties, especially around consent, security, and transfers.[13]
  • General health-data or banking secrecy rules may overlap where the same dataset is regulated by sector-specific confidentiality duties, creating higher compliance expectations rather than replacing Law 25,326.
  • EU GDPR is relevant for multinational groups because many controls are similar, but Argentina’s law is older, narrower in some areas, and does not map one-to-one on breach notification or DPO obligations.
  • Brazil LGPD is the closest regional comparator and can conflict operationally on retention, transfer, and legal-basis documentation, so regional programs should be harmonized carefully.

FAQ

Does Law 25,326 apply to companies outside Argentina?

Yes, if an outside company processes personal data in a way that uses Argentine databases, local operations, or Argentina-linked transfers, it can fall into scope.[1][13] The statute is not limited to Argentine citizens or domestic corporate entities. Multinationals should assume applicability where Argentine personal data is collected, stored, hosted, or disclosed from a system under their control.

Is consent always required under Law 25,326?

No, but express and informed consent is the default rule for many processing activities.[1][13] The law and regulation recognize exceptions, such as where processing is necessary for a contractual relationship, a statutory duty, or another recognized basis. Sensitive data remains subject to much stricter conditions than ordinary data.

Does Argentina require a GDPR-style 72-hour breach notification?

Not under the 2000 statute currently in force.[9][13][15] Recent reform efforts have circulated, but no enacted 2025–2026 amendment has replaced the existing framework with a GDPR-style mandatory 72-hour breach rule. Organizations should still maintain incident response, escalation, and regulator-assessment procedures because security duties remain mandatory.[13]

Are there transfer restrictions for sending data abroad?

Yes. Cross-border transfers are restricted unless the destination affords adequate protection or another lawful mechanism applies under the law and AAIP criteria.[1][13] That means controllers should review destination risk, contractual safeguards, and the receiving party’s security posture before transferring data.

What penalties can a non-compliant organization face?

The law allows monetary fines, database suspension, and criminal sanctions for certain serious violations.[1][13] The exact exposure depends on the conduct, the article breached, and whether the facts involve unauthorized disclosure, unlawful collection, or obstruction of rights requests. Enforcement risk is highest where the processing is intentional, repeated, or affects sensitive data.

Sources

Put it into practice

More compliance guides