Argentina. Comprehensive data protection. Law
PDPL 25.326Personal Data Protection Law No. 25,326 (Ley de Protección de los Datos Personales)
In force
§1Summary
- Synopsis
Argentina's general data protection law implementing the constitutional habeas data right. It requires consent or another legal basis, database registration, security measures and restricts transfers to countries without adequate protection.
- Key themes
- Unique features
One of the first EU-adequate regimes in the Americas; mandatory registration of databases in the National Register; AAIP issues model transfer clauses.
- SaaS relevance
SaaS providers processing data of Argentine users via local databases or customers must respect consent, security and transfer rules; customers need transfer agreements for foreign hosting.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- No general statutory duty (incident records required; AAIP may request)
- DPO
- No
- Cross-border transfers
- Adequacy list or model contract clauses/consent
- Maximum penalty
- Fines set by AAIP resolution; criminal penalties under Penal Code
§3Dates
- Key dates
- Adopted
- In force
- Regulatory Decree 1558/2001; AAIP designated authority by Decree 746/2017; reform drafts circulated (2018, 2023, AAIP participatory process) - none enacted as of Oct 2026
§4Text and authority
- Text
- Authoritative text argentina.gob.ar
- Authority
- Agencia de Acceso a la Información Pública (AAIP)
§5Where it applies
- Domestic law of
- Argentina
§6Sources and verification
- Sources consulted
- Verification
High confidence.
EU adequacy decision 2003, reaffirmed Jan 2024 review. Reform bill not passed by either chamber.