What Is Bolivia Privacy Protections: Constitution + Constitutional Procedure Code (No Enacted Comprehensive Data Protection Law)?
No enacted comprehensive general personal-data-protection statute was located in the official-source review in the 9 October 2026 review. The official Chamber of Deputies register lists PL No. 538/2025–2026, "Ley de Protección de Datos Personales," as a project under treatment, while AGETIC describes the proposed authority and statute as future or under review. No standalone general data-protection authority was located. The operative framework is fragmented. Constitutional Articles 21(2), 25, and 130–131, together with Constitutional Procedure Code Law 254 and Constitutional Tribunal procedural Law 027, provide the Acción de Protección de Privacidad. This ARCO-like action can cover data held in public or private files and databases and can support access, objection, deletion, or rectification in the circumstances identified by the constitutional procedure. Sectoral protections supplement that action. Telecommunications rules address communications secrecy, public-directory exclusion, correction and suppression of directory data, complaints, and limits on advertising access. Digital-citizenship and financial-services rules provide narrower controls over credentials, interoperable data, financial records, and credit information. No general portability, restriction, automated-decision objection, universal erasure, breach-notification, or cross-border regime was located.
At a glance
- Full name
- Bolivia Privacy Protections: Constitution + Constitutional Procedure Code (No Enacted Comprehensive Data Protection Law)
- Short code
- Art. 21(2), 25, 130–131 + Law 254
- Jurisdiction
- Bolivia (Plurinational State of)
- Enacted
- 2009
- Last major update
- PL No. 538/2025–2026 remains a project under treatment; no enacted comprehensive statute or standalone general data-protection authority was located in the 9 October 2026 review
- Regulator
- No standalone general data-protection authority located; sectoral oversight includes the ATT and ASFI
- Private right of action
- Yes
Scope, who Art. 21(2), 25, 130–131 + Law 254 covers
Protected data
Data subject rights
Right to know data held in public or private files or databases
Right to object to processing through the Acción de Protección de Privacidad where the constitutional conditions are met
Right to seek deletion or rectification of erroneous data or data affecting intimacy, personal or family privacy, image, honor, or reputation
Standing for affected natural or legal persons, authorized representatives, certain heirs, the Ombudsman, and child/adolescent defenders
Telecommunications right to free exclusion from public directories and to check, correct, or suppress directory data
Digital-citizenship right to control credentials and authorize or supervise access by integrated entities
Financial-services privacy action for data held by financial entities
No general enacted right to portability, restriction of processing, objection to automated decisions, universal erasure, or general breach notification was located
Notable features
Bolivia is a no-enacted-comprehensive-law case with an unusually broad constitutional privacy action. Law 254 expressly reaches persons compiling personal data in registers intended to produce reports, regardless of commercial purpose and even if the information has not been circulated. The framework remains fragmented, with no located standalone general authority, general cross-border regime, or data-broker-specific administrative route.
Enforcement & penalties
Penalties: No general personal-data statute or general data-protection fine schedule was located. Constitutional proceedings may identify civil or criminal responsibility, estimate damages, refer criminal indicators to prosecutors, and impose coercive or progressive fines for resistance; no fixed general fine amount was located. Telecommunications sanctions include warning, seizure or embargo, fines, and temporary disqualification, with general fines of 1–500 days multa and temporary disqualification of 5–360 calendar days. Penal Code Article 363 Ter provides up to one year of work service or a fine up to 200 days for specified unauthorized data conduct causing harm; Article 363 Bis provides 1–5 years’ imprisonment plus 60–200 days multa for specified data manipulation causing patrimonial transfer.
Private right of action: The Acción de Protección de Privacidad provides a direct constitutional judicial route for affected natural or legal persons and other listed representatives. Relief is limited to the constitutional and sectoral conditions described above; no general compensation route or universal civil action for ordinary data misuse was located.
Relevance to data brokers
The closest general route is the Acción de Protección de Privacidad. Law 254 expressly reaches public or private persons compiling personal data in registers intended to produce reports, regardless of commercial purpose, and affected individuals may seek access, objection, deletion, or rectification where the constitutional conditions are met. A separate data-broker registry, mandatory broker opt-out, or public-record-specific administrative deletion or complaint route was not located.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does Bolivia have a comprehensive data-protection law?+
No enacted comprehensive general personal-data-protection statute was located in the 9 October 2026 review. PL No. 538/2025–2026 is listed as a project under treatment, and AGETIC describes the proposed authority and statute as future or under review.
What privacy remedy currently exists in Bolivia?+
The Acción de Protección de Privacidad under Constitution Articles 21(2), 25, and 130–131, together with Law 254, can allow a person to seek access, objection, deletion, or rectification concerning data held in public or private files or databases, subject to the stated constitutional and procedural limits.
Can I request deletion from a Bolivian data broker?+
The closest general route is the constitutional privacy action, which can reach persons compiling personal data in registers intended to produce reports. A separate data-broker or public-record-specific administrative deletion or complaint route was not located.
Official sources & citations
Other international privacy regimes
Art. 21(2), 25, 130–131 + Law 254 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: