What Is Law No. 7593/2025, De Protección de Datos Personales en la República del Paraguay?
Paraguay's Law No. 7593/2025 was sanctioned 5 November 2025 and promulgated/published 27 November 2025, establishing an integral personal-data regime applying to automated and relevant non-automated processing by public or private persons, including some processing by organizations not established in Paraguay. Article 57 provides that the law enters into force 24 months after official publication; MITIC's own 2026 explanation places the operative date at the end of 2027, describing an adjustment period. The law provides access, rectification, suppression, opposition, and portability rights exercisable at any time through simple, expedited, accessible, and free means, with a maximum 30-calendar-day controller response. Objection carries a 10-business-day cessation period; direct-marketing objection carries 15 business days. The law creates the Agencia Nacional de Protección de Datos Personales within MITIC, but MITIC's own guidance describes the agency's creation and operational supervision prospectively, tied to the law's eventual entry into force. This is a source-backed evidence profile: the statute is enacted and published, but should not be presented as fully commenced on the current review date. Credit-data protection remains separately governed by Law 6534/2020. No Paraguay-specific data-broker register or people-search opt-out service was located.
At a glance
- Full name
- Law No. 7593/2025, De Protección de Datos Personales en la República del Paraguay
- Short code
- Paraguay Law 7593/2025
- Jurisdiction
- Paraguay
- Enacted
- 2025
- Last major update
- Sanctioned 5 November 2025, published 27 November 2025; enters into force 24 months after publication per Article 57 (around late 2027)
- Regulator
- Agencia Nacional de Protección de Datos Personales (created by the law, within MITIC; not yet confirmed operational)
- Private right of action
- Limited
Scope, who Paraguay Law 7593/2025 covers
Protected data
Data subject rights
Access, rectification, suppression, opposition, and portability at any time, via simple/expedited/accessible/free means, with a maximum 30-calendar-day response (Articles 26–32)
Objection with a 10-business-day cessation period after the request, subject to overriding-interest and litigation exceptions (Article 30)
Direct-marketing objection with a 15-business-day cessation period (Article 31)
Habeas data judicial action where a request is unsatisfied or the response is insufficient (choosing habeas data forecloses the parallel authority procedure, and vice versa)
Notable features
The law's 24-month deferred-commencement clause (Article 57) is unusual among the jurisdictions in this dataset; MITIC's own guidance places full operative status around the end of 2027, meaning the Agencia Nacional de Protección de Datos Personales it creates is not yet confirmed as an operating regulator on the current review date.
Enforcement & penalties
Penalties: MITIC’s 2026 explanatory materials for this research pass focused on scope and the entry-into-force timeline rather than a consolidated fine schedule; a penalty figure should be checked directly against the enacted text once the Agency is operational.
Private right of action: Article 51 requires first requesting action from the controller, then filing a free complaint through an authority-enabled channel within 15 business days of the response (or any time after the response period lapses without an answer); the law also preserves the separate judicial habeas data action.
Relevance to data brokers
No Paraguay-specific data-broker register, people-search opt-out service, or broker-specific public-record suppression route was located. Credit-information businesses remain separately governed by Law 6534/2020, with the Banco Central del Paraguay as supervisor for credit bureaus.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
Is Paraguay’s new data-protection law already in effect?+
It is enacted and published, but Article 57 delays entry into force to 24 months after publication; MITIC’s own guidance places the operative date around the end of 2027.
Is there already an operating data-protection authority in Paraguay?+
The law creates the Agencia Nacional de Protección de Datos Personales within MITIC, but MITIC describes its creation and supervisory role prospectively, tied to the law’s eventual entry into force.
Official sources & citations
Other international privacy regimes
Paraguay Law 7593/2025 sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: