Argentina Personal Data Protection Law — Law No. 25,326
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting. Framework text may require a separate license unless explicitly provided.
Overview
Argentina Personal Data Protection Law — Law 25,326 (PDPL) is a national data protection regulation that establishes rights for individuals and obligations for entities that collect, store, and process personal data in Argentina. The law aims to protect privacy and enable individuals to control their personal information.
Enacted by the Argentine Congress and enforced by the Agency of Access to Public Information (AAIP), Law 25,326 applies to data files, registries, databases, and data banks in both the public and private sectors. It establishes principles for data processing, data subject rights, obligations for controllers and processors, and cross-border transfer requirements.
Organizations implement the PDPL by establishing data protection policies, registering databases with the AAIP where required, implementing security safeguards, and creating processes for responding to data subject requests. Compliance aligns with international privacy standards supporting cross-border data flows.
Why it Matters
Argentina’s PDPL establishes fundamental data protection rights protecting individual privacy in an increasingly digital economy.
Key benefits include:
- Protect personal data rights
Establish individual rights to access, correct, and delete personal information in accordance with Argentine law.
- Meet regulatory requirements
Comply with AAIP requirements maintaining data processing authorization and avoiding regulatory penalties.
- Support international transfers
Maintain Argentina’s adequacy status enabling data transfers from the EU and other regions.
- Build stakeholder trust
Demonstrate commitment to data protection supporting customer and partner confidence in data handling.
- Enable cross-border business
Satisfy international trading partners requiring adequate data protection for cross-border data flows.
How it Works
Law 25,326 establishes principles for lawful data processing, database registration requirements, data quality standards, data subject rights, and security obligations. Organizations must register databases with the AAIP, implement appropriate security measures, and respond to data subject access, rectification, and deletion requests.
Organizations implement compliance through privacy policy development, database registration, security control implementation, staff training, and ongoing AAIP reporting. Cross-border transfers require AAIP authorization or adequacy recognition.
Key Elements
- Database Registration
Requires registration of personal data databases with AAIP for oversight and regulatory compliance.
- Data Subject Rights
Provides individuals rights to access, rectification, suppression, and confidentiality of personal data.
- Security Safeguards
Mandates technical and organizational measures protecting personal data from unauthorized access.
- Cross-Border Transfer Rules
Establishes requirements for international personal data transfers including adequacy assessments.
Framework Scope
Argentina PDPL applies to entities processing personal data of Argentine residents in public and private sector databases. Covers both automated and manual data processing activities.
Framework Objectives
Argentina PDPL establishes data protection rights and obligations protecting personal information in Argentina.
- Protect individual privacy through fundamental data protection rights
- Establish lawful processing principles for personal data in Argentina
- Enable data subject access, correction, and deletion rights
- Maintain Argentina’s international data transfer adequacy status
- Support regulatory compliance through AAIP oversight
Common Framework Mappings
Mapped frameworks include:
EU General Data Protection Regulation (GDPR)
ISO/IEC 27001
ISO/IEC 27701
NIST Privacy Framework
OECD Privacy Guidelines
- ClassicifationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeFrameworkLegal InstrumentLawSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionLatin AmericaRegion DetailArgentinaPublisherAgencia de Acceso a la Información Pública
- VersioningVersionLaw No. 25,326Effective DateOctober 28, 2000Issue DateOctober 28, 2000
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
Argentina's Personal Data Protection Law is publicly available through official Argentine government publications.
How SmartSuite Supports Argentina PDPL
Manage Argentina Personal Data Protection Law (Law No. 25,326) requirements by organizing privacy controls, tracking personal data processing activities, and maintaining evidence supporting compliance with national data protection obligations.
Personal Data Inventory and Classification
Maintain records of personal data categories, processing purposes, and storage locations.
Consent and Purpose Limitation Governance
Track consent collection, legal basis, and purpose limitation for data use.
Data Subject Rights and Request Handling
Manage access, rectification, and deletion requests with full audit trails.
Personal Data Safeguard Implementation
Track safeguards protecting confidentiality, integrity, and availability of personal data.
Data Incident and Regulatory Response Monitoring
Monitor data incidents and manage response workflows aligned to regulatory expectations.
Privacy Posture and Compliance Readiness Reporting
Provide dashboards showing privacy posture, control coverage, and compliance readiness.
Related frameworks
APEC Privacy Framework helps organizations manage cross-border privacy risks and facilitate data flows among Asia-Pacific economies.
CCPA/CPRA is California privacy law giving residents control over personal data and requiring businesses to protect and disclose data practices.
GDPR is an EU regulation that protects individuals' personal data and strengthens organizations' accountability for privacy.
ISO/IEC 27701 extends ISO/IEC 27001 to help organizations manage privacy and protect personally identifiable information.
Frequently Asked Questions For Argentina Personal Data Protection Law (Law No. 25,326)
The law establishes legal requirements for processing personal data, aiming to safeguard individuals’ privacy rights and prevent the misuse or unauthorized access to personal information. It outlines specific obligations for both public and private organizations managing personal data in Argentina.
Yes, compliance with Law No. 25,326 is mandatory for organizations that process personal data within Argentina. Both public agencies and private companies must adhere to its requirements or face potential sanctions and enforcement actions from the Argentine data protection authority.
The law applies to any organization, regardless of size or sector, that processes or stores personal data in Argentina. This includes both local and international organizations operating in Argentina and covers data subjects who are residents or citizens of the country.
Key requirements include obtaining data subject consent, ensuring data quality and accuracy, implementing robust security measures, registering relevant databases, and providing individuals with rights to access, correct, or delete their data. The law also regulates cross-border data transfers and mandates notification of data breaches.
Organizations should establish and document privacy policies, appoint a data protection officer if needed, conduct risk and impact assessments, and maintain technical and organizational security controls. Regular training, ongoing monitoring, and proactive compliance assessments are essential to address evolving regulatory expectations and threats.
While Law No. 25,326 shares similarities with the EU GDPR, especially regarding data subject rights and international transfers, it is tailored to the Argentine legal context. Multinational organizations often harmonize compliance frameworks by mapping GDPR controls and practices to local requirements under Law No. 25,326.
Continuous activities include updating records of processing activities, maintaining evidence of consent, performing regular risk assessments, updating security controls, managing incident response processes, and ensuring ongoing staff training. Organizations must also be prepared for audits and respond to data subject requests in a timely manner.
SmartSuite assists organizations in managing Law No. 25,326 by enabling risk tracking, mapping obligations to a control library, and organizing compliance evidence and documentation. It supports control management, audit readiness, regulatory reporting, and workflow automation for ongoing regulatory oversight.
Put CRI Profile into action with SmartSuite
Map controls, collect evidence, run assessments, manage remediation, and report readiness - all from a single connected system.