Data protection & privacy law in Argentina (2026)

Law 25.326 (2000), together with Regulatory Decree 1558/2001, governs the processing of personal data by public and private entities and enshrines the constitutional habeas data right (Article 43 of the Constitution).

The Agencia de Acceso a la Información Pública (AAIP), an autarkic body under the Chief of Cabinet, is the data protection authority. It issues binding resolutions, registers databases, audits controllers, handles complaints and imposes administrative sanctions.

The Act grants rights of access, rectification, updating, suppression and confidentiality, requires informed consent for processing (with limited exceptions), heightened protection for sensitive data, and mandates security and confidentiality measures by data controllers.

Argentina was recognized as providing adequate protection by European Commission Decision 2003/490/EC, and this status was reaffirmed on 15 January 2024 in the Commission's first review of pre-GDPR adequacy decisions, allowing free flow of personal data from the EU without additional safeguards.

Argentina ratified Council of Europe Convention 108 in 2019 and Convention 108+ in 2023; the AAIP has issued guidelines on Binding Corporate Rules (Resolution 159/2018) and standard contractual clauses for cross-border transfers.

Several bills to replace Law 25.326 with a GDPR-aligned regime are in Congress in 2025-2026, including Senate bill S-0644/2025 and Chamber bill 1948-D-2025 introducing breach notification, DPIAs, DPOs, automated-decision rules and higher fines; none has been enacted as of mid-2026, and Law 25.326 continues to apply.

AAIP Resolution 126/2024 unified and updated the sanctions regime under Law 25.326 (raising fine ceilings and clarifying gradation), and Resolution 145/2025 established a compliance program for the public administration; the AAIP has also issued guidance on AI, biometrics and video surveillance.