On May 27, 2025, the Chamber of Deputies approved Paraguay’s Personal Data Protection Bill (hereinafter, the “Bill”), which provides for a comprehensive regulatory framework aimed at protecting the personal data of individuals in order to guarantee the exercise of their rights and the free flow of information. It should be noted that currently Law No. 6534 guarantees the protection of credit data of all individuals.
The Bill applies to any processing of personal data, whether automated or not, carried out by natural or legal persons, regardless of the means used, the country in which the data controller is based, or the location of the data.
In addition, the Bill is inspired by the standards of the European Union’s General Data Protection Regulation, and introduces fundamental principles for data processing, such as accuracy, lawfulness, transparency, security, and confidentiality. The Bill also introduces new legal bases for data processing, in addition to consent such as the legitimate interest. With respect to international data transfers, the Bill sets forth general guidelines and allows the use of model contractual clauses when the destination country does not provide an adequate level of protection.
Finally, the regulation provides for the creation of the National Agency for the Protection of Personal Data, an entity with broad powers to monitor, supervise, and even issue the necessary regulations to ensure compliance with the Bill. This agency will also be responsible for handling complaints and imposing sanctions.
The Bill has received preliminary approval from the Chamber of Deputies and is still pending review and approval by the Chamber of Senators. If enacted, the law will come into effect two years after its official publication.
