Paraguay data law expands crypto reporting

Operation timeline

Attack chain and TTPs

There is no classic attack chain here, and no indicators of intrusion, malware, or technical exploitation in the material provided. The case should be read as a regulatory and compliance sequence, where the tax authority defines a new data collection surface and the data protection law sets the legitimacy boundaries for that processing. The main tension is procedural, documentary, and organizational, not forensic.

The identifiable exposure vector is the expansion in the amount and granularity of information that DNIT requires for tax oversight. According to the sources, the form may include date and time, identities when possible, wallets, networks, amounts, fees, gas costs, hash, and source and destination addresses. That level of detail turns the reporting process into a sensitive repository, with confidentiality, integrity, and data minimization implications.

From a compliance TTP perspective, several mandatory practices and friction points stand out. Registering obligation 959 in the RUC, using Marangatu, and filing annually in the third month after year-end show a formalized and repeatable workflow. The friction appears in the lack of clarity over the exact moment the income tax trigger arises for crypto transactions, a persistent question in the reviewed coverage. That uncertainty can lead to interpretation errors, incomplete filings, or mismatches between tax authority and taxpayer criteria.

Regional impact

Regional outlook

The regional significance of the Paraguayan case does not come from a direct export of law, but from the combination of two moves that many Latin American jurisdictions are watching closely, a data protection law with sanctions and robust rights, and a fiscal rule that demands detailed traceability of cryptoassets. The available material shows that the debate is not limited to a form. It reaches the way a state justifies collecting personal data for tax purposes and how it prepares companies, platforms, and taxpayers to comply.

The 24-month grace period is central to the regional picture. According to the sources, Law No. 7,593/2025 will enter full force on November 27, 2027. During that window, the National Personal Data Protection Agency should consolidate its operations and controllers should adapt policies, contracts, response procedures, and security controls. At the same time, RG 47/2026 already imposes an initial compliance wave in March 2027, so the transition happens on two separate clocks.

Paraguay

Paraguay is the only country in the material with extensive and convergent verified facts. Law No. 7,593/2025 sets the general personal data regime, creates the National Personal Data Protection Agency inside MITIC, establishes meaningful administrative fines, and requires information rules, data subject response, incident notification within 72 hours, and oversight of international transfers. The crypto rule, in turn, creates obligation 959, DJI Cryptoassets, inside Marangatu.

The USD 5,000 annual threshold becomes the trigger for the report. Sources specify that the obligation applies to natural persons, legal entities, Paraguayan entities, and, in some cases, platform operators working in Paraguay. It also covers transactions on foreign platforms and those made without intermediaries. The technical report finds no indication that implementation is confined to a narrow niche. On the contrary, the scope described is broad and reaches a significant range of users and operators.

The regulatory friction appears in data handling. ABC Color reports that DNIT must justify the necessity and proportionality of each personal data field required. That requirement becomes especially important because the form demands detailed information per transaction, and because the data law recognizes a broad concept of personal data and gives data subjects specific rights to control how it is processed.

Argentina

No additional verifiable facts were identified in the material provided for Argentina.

Chile

No additional verifiable facts were identified in the material provided for Chile.

Bolivia

No additional verifiable facts were identified in the material provided for Bolivia.

Peru

No additional verifiable facts were identified in the material provided for Peru.

Colombia

No additional verifiable facts were identified in the material provided for Colombia.

Brazil

No additional verifiable facts were identified in the material provided for Brazil.

Mexico

No additional verifiable facts were identified in the material provided for Mexico.

USA

No additional verifiable facts were identified in the material provided for the United States.

Uruguay

No additional verifiable facts were identified in the material provided for Uruguay.

Technical indicators

No classic technical IOCs were published, such as IP addresses, domains, malware hashes, or intrusion artifacts. The available material describes regulatory obligations, reporting thresholds, deadlines, requested data types, and administrative sanctions, but not forensic indicators of compromise.

Analysis for security teams

For security, privacy, and compliance teams, this should be treated as a regulatory implementation with direct impact on data inventories, information classification, and access controls. The first priority is to understand which transactional and personal data fields fall under obligation 959, how they are extracted from internal or third-party systems, and what controls apply before they reach Marangatu. The level of detail reported by the sources suggests a processing chain that includes capture, validation, retention, and transmission, with exposure risk at each step.

The second priority is to document necessity and proportionality. ABC Color’s coverage makes clear that this is not a decorative issue, but a substantive standard that may shape implementation. If a team is building forms, integrations, or onboarding flows for users with crypto activity, it should be able to explain why each field is indispensable, what legal basis supports it, and how long it is retained. That documentation will also help answer future requests from the National Personal Data Protection Agency, especially once the regime enters full force.

Operationally, organizations should align three fronts. The tax front, to meet the annual return due in the third month after year-end. The privacy front, to comply with data subject notice, response deadlines, 72-hour incident notification, and international transfer rules. And the security front, to reduce the risk of leakage from a dataset that, because of its granularity, can reveal financial patterns, custody addresses, and movement traceability.

A useful reading is to separate required data from merely convenient data. RG 47/2026, according to the sources, requires many fields, but that does not authorize collecting extra information for operational convenience alone. The minimization principle, as presented in the coverage on Law 7,593/2025, requires a review of each field. That also includes internal procedures, templates, APIs, exports, and logs that may retain more than necessary.

Frequently asked questions

What changes first in Paraguay, the data law or crypto reporting?

Crypto reporting changes first. General Resolution No. 47/2026 already sets the first filing for March 2027 for fiscal year 2026, while Law No. 7,593/2025 enters full force on November 27, 2027. The practical order means privacy and tax compliance must be implemented on different timelines.

What data does DNIT require, and why does that create tension with privacy law?

DNIT requires per-transaction information such as date and time, wallets, hash, amounts, fees, and source and destination addresses. That creates tension with Law No. 7,593/2025 because the personal data law sets a broad protection standard and requires the state to justify necessity and proportionality for each requested field.

Who must file the cryptoasset return in Marangatu?

According to the sources, residents, legal entities, Paraguayan entities, and platform operators working in Paraguay must file when annual activity exceeds USD 5,000. The regime covers local transactions, foreign transactions, and transactions without intermediaries, and it imposes obligation 959, DJI Cryptoassets, within the RUC.

How long do data subjects have to request access or correction in Paraguay?

Law No. 7,593/2025 provides a maximum response time of 30 calendar days, through simple and free channels. That deadline sits alongside notice duties at the time of collection, 72-hour incident notifications, and international transfer rules.

What sanctions appear in the new Paraguayan framework?

The data law sets administrative fines of 20 to 2,500 minimum wage units in the general regime, up to 5,000 when sensitive data is involved, and up to 10,000 if sensitive data of children or adolescents is involved. On the crypto side, ABC Color reported a G. 1,000,000 fine for failing to file the information return.

Limitations of the material

The material does not allow us to confirm with primary evidence the exact level of administrative operability of the National Personal Data Protection Agency in 2026. Some sources describe it as created and endowed with functional autonomy, while others frame its launch as prospective or still being set up. This report preserves that uncertainty.

There is also not enough material to reconstruct a technical attack chain, or to identify IOCs, intrusion vectors, victims of incidents, or malware-related domains. This is a regulatory case, not a classic cyber incident.

As for RG 47/2026, the material does allow us to confirm the threshold, reporting channel, periodicity, and type of information required, but it leaves open the discussion over the exact moment when the income tax trigger is established for crypto transactions. That uncertainty appears in media coverage, not in a definitive DNIT clarification within the research provided.

The countries without additional verifiable coverage in the material are Argentina, Chile, Bolivia, Peru, Colombia, Brazil, Mexico, the United States, and Uruguay.

Charts