Data & Privacy - Argentina

Law 25.326 provides integral protection of personal data held in public or private files/databases, guaranteeing rights to honor, privacy, and access to one's own data; it is the country's overarching, cross-sector regime.

The Agency for Access to Public Information (AAIP), an autonomous body with functional independence, is the enforcement authority; its National Directorate for Personal Data Protection (DNPDP) handles registration, supervision, and sanctions.

Controllers must obtain consent, observe purpose limitation and data quality/security, and respect rights of access, rectification, deletion and updating; sensitive data receives heightened protection. Registration of databases in the National Registry is required.

The DNPDP classifies infractions as mild, serious, or very serious; sanctions range from warnings and database suspension/closure to fines, with classification and graduation updated by AAIP Resolution 240/2022.

Argentina was the first Latin American country deemed 'adequate' by the European Commission; the Commission's first review (published 15 January 2024) confirmed continued adequacy, citing its accession to Convention 108/108+ and its independent supervisory authority, while recommending legislative codification of protections currently set at sub-legislative level.

Multiple bills to overhaul Law 25.326 (e.g., Carro 1948-D-2025, Doñate 644-S-2025, Yeza 1625-D-2026) are under debate in Congress, introducing accountability, privacy by design/default, data portability and rights against automated decisions; none had been enacted as of early 2026.