Data protection & privacy law in Argentina (2026)
Data protection in Argentina: comprehensive law.
Argentina has an in-force, omnibus personal-data protection regime built around Law 25.326 (2000), enforced by the AAIP, and holds a European Commission adequacy decision (most recently reconfirmed in January 2024). The framework predates GDPR-era concepts, so several reform bills (notably S-0644/2025 and 1948-D-2025) are pending in Congress to modernize it, but none has been enacted and Law 25.326 remains the operative law.
Legal framework
Personal Data Protection Act (Ley 25.326 de Protección de los Datos Personales, 2000) and Regulatory Decree 1558/2001, enforced by the Agencia de Acceso a la Información Pública (AAIP). Argentina is also party to Council of Europe Convention 108 and Convention 108+.
Key points: data & privacy in Argentina
Primary statute
Law 25.326 (2000), together with Regulatory Decree 1558/2001, governs the processing of personal data by public and private entities and enshrines the constitutional habeas data right (Article 43 of the Constitution).
Supervisory authority
The Agencia de Acceso a la Información Pública (AAIP), an autarkic body under the Chief of Cabinet, is the data protection authority. It issues binding resolutions, registers databases, audits controllers, handles complaints and imposes administrative sanctions.
Data subject rights & obligations
The Act grants rights of access, rectification, updating, suppression and confidentiality, requires informed consent for processing (with limited exceptions), heightened protection for sensitive data, and mandates security and confidentiality measures by data controllers.
EU adequacy status
Argentina was recognized as providing adequate protection by European Commission Decision 2003/490/EC, and this status was reaffirmed on 15 January 2024 in the Commission's first review of pre-GDPR adequacy decisions, allowing free flow of personal data from the EU without additional safeguards.
International transfers & Convention 108+
Pending reform (not yet in force)
Several bills to replace Law 25.326 with a GDPR-aligned regime are in Congress in 2025-2026, including Senate bill S-0644/2025 and Chamber bill 1948-D-2025 introducing breach notification, DPIAs, DPOs, automated-decision rules and higher fines; none has been enacted as of mid-2026, and Law 25.326 continues to apply.
Recent AAIP enforcement measures
AAIP Resolution 126/2024 unified and updated the sanctions regime under Law 25.326 (raising fine ceilings and clarifying gradation), and Resolution 145/2025 established a compliance program for the public administration; the AAIP has also issued guidance on AI, biometrics and video surveillance.
Timeline of decisions
- Law · officialAAIP relaunches modernization of Personal Data Protection Law
The data protection authority reopened a multisectoral dialogue process to update Law 25.326, reviewing critical points of its earlier draft amid three competing reform bills in Congress. Aims to align Argentina with GDPR/Convention 108+ as the EU has urged legislative modernization.
AAIP (Argentina.gob.ar)
- Guidance · officialAAIP creates Program to Strengthen Data Protection in Public Administration
Resolution 145/2025 launched a three-year program requiring federal agencies to adopt PDPL-aligned privacy policies, appoint and train data protection officers, and register all government databases. Signals a shift toward more proactive enforcement in the public sector.
Boletín Oficial
- LawAI-specific data protection bill (4243-D-2025) introduced
A bill in the Chamber of Deputies proposed AI-focused data rules including a National AI Registry, mandatory risk assessments for medium/high-risk systems, and audit powers. Reflects growing legislative attention to automated decision-making.
IAPP
- Law · officialComprehensive reform bills to replace Law 25.326 presented in Congress
Deputy Pablo Carro filed bill 1948-D-2025 (paralleled by Senator Doñate's S-644/2025) to overhaul the 25-year-old data protection law, adding accountability, privacy by design/default, data portability, breach notification (72h) and rights against automated decisions, modeled on GDPR.
Cámara de Diputados (HCDN)
- Guidance · officialAAIP publishes guide on transparency and data protection for responsible AI
The authority released a preliminary guide for public and private entities covering impact assessments, protection by design, explainability, bias testing and accountability across the AI lifecycle. Open for public comment until October 30, 2024.
AAIP (Argentina.gob.ar)
- Decision · officialAAIP enacts new sanctions regime for data protection breaches
Resolution 126/2024 approved a reformed classification of infringements and graduated penalties under Law 25.326 and the 'No Llame' Law 26.951, effective June 1, 2024, unifying and modernizing the enforcement framework with a 50% discount for voluntary fine payment.
Boletín Oficial
- IncidentRENAPER national identity database breach exposes millions of records
Personal data and DNI images of Argentines, including the president and public figures, were exfiltrated via misused credentials and offered for sale online, prompting RENAPER to overhaul its verification services to return only true/false responses. A major incident exposing weaknesses in state data security.
Chequeado
- Law · officialAccess to Public Information Law (27.275) creates the AAIP
The law established the Agency for Access to Public Information as an autonomous body that also serves as the enforcement authority for the Personal Data Protection Law 25.326, the regulator now central to online data and safety oversight.
InfoLEG (Min. Justicia)
- Law · officialPersonal Data Protection Law 25.326 (Habeas Data) enacted
Argentina established its foundational data protection regime, granting individuals rights over their personal data and imposing data-security duties on controllers, later overseen by the AAIP. It underpins data-security and breach obligations applicable to cybersecurity today.
Argentina.gob.ar
- Law · officialLey 25.326: Personal Data Protection Act Enacted
Argentina enacted one of Latin America's first comprehensive data protection statutes, establishing rights of access, rectification, and deletion over personal data held in public and private databases; the law later earned EU adequacy status (2003) and, enforced by the AAIP, remains the cornerstone data-security obligation, with a legislative reform draft pending in Congress since 2022.
InfoLEG – Ministerio de Justicia y Derechos Humanos
- Law · officialPersonal Data Protection Law 25.326 (Habeas Data) enacted
Argentina's foundational data-protection statute implemented the constitutional habeas data right, regulating public and private databases and granting rights of access, rectification and deletion. It later earned EU adequacy status and remains the backbone of online data governance.
InfoLEG (Min. Justicia)
Sources
- unodc.org/cld/uploads/res/uncac/LegalLibrary/Argentina/Laws/Argentina%20Persona
- argentina.gob.ar/aaip
- commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection
- iapp.org/news/a/european-commission-upholds-11-adequacy-decisions
- coe.int/en/web/data-protection/convention108-and-protocol
- digitalpolicyalert.org/event/30514-personal-data-protection-bill-s-06442025-including-govern
- hunton.com/privacy-and-cybersecurity-law-blog/argentina-personal-data-protection
- dataguidance.com/jurisdictions/argentina
- dlapiperdataprotection.com/?t=law&c=AR
- jurist.org/commentary/2025/12/why-argentinas-pioneering-privacy-law-is-now-playi
- iapp.org/news/a/argentine-supervisory-authority-approved-guidelines-for-bindin
- argentina.gob.ar/aaip/datospersonales/sanciones
Next for Argentina: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 19 Jul 2026. Methodology & how to cite · State of Technology Regulation 2026