Argentina Personal Data Protection Law — Law No. 25,326

Why does it matter?

Law 25,326 combines familiar privacy principles with a registration regime and a fast court remedy, so a missed access or correction deadline opens the way to a habeas data claim.

Key benefits include:

• Registration clarity

A database is lawful only when properly registered, and the registry is public and free to consult (Articles 3, 13, and 21).

• A defined consent rule

Consent must be free, express, and informed, with exceptions such as publicly accessible sources, a legal obligation, and contractual need (Article 5).

• Short, fixed deadlines

Access requests are answered within 10 calendar days, and correction, update, or deletion is done within five business days (Articles 14 and 16).

• A transfer rule

Transfers of personal data to countries or international bodies without adequate protection are prohibited, subject to listed exceptions (Article 12).

• Defined sanctions

The control authority can issue warnings, suspensions, fines of 1,000 to 100,000 pesos as the law is written, and closure or cancellation of a database (Article 31).

How does it work?

The law has seven chapters: general provisions (Articles 1 and 2), general principles (3 to 12), rights of data holders (13 to 20), users and database controllers (21 to 28), control (29 and 30), sanctions (31 and 32), and the habeas data action (33 to 44). A database that is not for exclusively personal use must be registered (Articles 21 and 24), and the registration records the controller, purpose, data types, recipients, security measures, and retention time.

Processing on behalf of third parties has its own rule: the data may not be used for any purpose other than the service contract or passed to others, and it must be destroyed when the contract ends unless the client expressly authorizes storage of up to two years (Article 25). Credit information services may keep only data significant to solvency over the last five years, reduced to two years once a debt is paid (Article 26).

In SmartSuite, Privacy Management holds the data inventory, assessments, and requests, and Workflow Orchestration runs the 10-day and five-day request clocks with owners and dates.

Key Elements

• Database registration (Articles 3, 21, and 24)

Databases must be registered with the control authority, and no user may hold personal data of a type not declared in the registry. The AAIP operates the Registro Nacional de Bases de Datos.

• Data quality and purpose (Article 4)

Data must be accurate, adequate, and not excessive, collected by fair means, used only for compatible purposes, updated when necessary, and destroyed when no longer needed.

• Consent and information (Articles 5 and 6)

Consent must be free, express, and informed. At collection the person is told the purpose and recipients, the database and its controller, whether answers are mandatory, the consequences of giving or refusing data, and their access, correction, and deletion rights.

• Sensitive data and health data (Articles 7 and 8)

Sensitive data covers racial and ethnic origin, political opinions, religious, philosophical or moral convictions, union membership, and health or sex life. No one can be compelled to provide it, and health professionals may process patient data under professional secrecy.

• Security, confidentiality, and transfers (Articles 9 to 12)

Controllers adopt technical and organizational measures against adulteration, loss, and unauthorized consultation or processing, and everyone involved owes professional secrecy even after the relationship ends. Disclosure needs revocable consent, and the disclosing party remains jointly responsible for the recipient's compliance.

• Rights of data holders (Articles 13 to 19)

Anyone may consult the public registry. Data holders have access rights, free of charge at intervals of at least six months, and rights to rectification, update, deletion, or confidentiality. Public bodies may refuse for defense, public order, or third-party rights by a reasoned decision.

• Control, sanctions, and habeas data (Articles 29 to 44)

The control authority keeps the registry, checks security rules, and applies sanctions, and can join criminal proceedings. The habeas data action lets a person obtain their data, or have false, inexact, or outdated data corrected, through the courts.

What does it cover?

The law applies to personal data in public databases and private databases intended to supply reports, and to private databases that are not for exclusively personal use (Articles 1 and 24). Personal data means information on identified or identifiable natural persons or legal persons, and the law applies to data on legal persons where relevant. Opinion surveys, statistics, and market research are excluded where the data cannot be attributed to a person (Article 28).

What are its objectives?

The law has a constitutional purpose and a practical one.

Protect personal data fully, to guarantee the right to honor and privacy and access to information held about people (Article 1).

Require databases to be registered and operated under the law's principles (Article 3).

Give individuals access, rectification, update, and deletion rights with short deadlines (Articles 14 and 16).

Restrict disclosure and international transfers of personal data (Articles 11 and 12).

Provide sanctions and the habeas data action to enforce the rules (Articles 31 to 44).

Framework in Context

Law 25,326 is Argentina's general data protection statute, and the AAIP also publishes tools on international transfers and has published a book on a bill to update the law. Organizations commonly compare it with the GDPR, Convention 108+, and Brazil's LGPD, and map it to the frameworks below.

Common Framework Mappings

Organizations that operate in Argentina and elsewhere map Law 25,326 to the frameworks below to reuse privacy controls across jurisdictions.

Mapped frameworks include:

APEC PF

CCPA/CPRA

Convention 108+

GDPR

ISO 27701

LGPD

NIST Privacy Framework v1.0

OECD Privacy Guidelines