CiberLATAMbywhalemate

Paraguay advances critical infrastructure bill

The Senate is reviewing a bill to protect critical infrastructure as Paraguay continues implementing its personal data law 7593/2025.

Whalemate Labs · AI-assisted researchPublished:Updated 3 min read

Paraguay has a pending Critical Infrastructure Protection Bill that has already been introduced and reviewed by the Senate Commission on Science, Technology, Innovation and the Future. The text calls for a National Registry under the Executive Branch and assigns enforcement to CODENA, in coordination with ANDE, ESSAP and MITIC.

Paraguay is moving on two regulatory fronts tied to digital security and the protection of strategic assets: implementing Personal Data Law 7593/2025 and processing the Critical Infrastructure Protection Bill in Congress. The Senate is reviewing the initiative, while Law 7593/2025 is already in force, although the available material does not detail its rules or the current state of corporate compliance.

What is being discussed on critical infrastructure?

The Critical Infrastructure Protection Bill was introduced and reviewed by the Senate’s Commission on Science, Technology, Innovation and the Future. Its stated goal is to create a legal framework to identify, protect and ensure the resilience of the country’s critical infrastructure.

Among its main points, the text envisions the creation of a National Critical Infrastructure Registry, which would be established by the Executive Branch. It also gives the National Defense Commission, CODENA, responsibility for implementation in coordination with ANDE, ESSAP and MITIC.

What is happening with Personal Data Law 7593/2025?

Law 7593/2025 is already in force, but the available material does not detail its implementing rules or the current state of corporate compliance. What does appear in this process is that the country now has a specific personal data law, while the institutional debate is also shifting toward the resilience of essential systems and services.

What are the next expected steps?

Specialized analysis cited by Consultora BBRA places the short-term horizon, over the next 0 to 12 months, on passage of the law, rollout of the National Registry, vulnerability assessments and the creation of a permanent interagency committee for critical infrastructure protection.

With those elements in play, Paraguay is adding a regulatory debate that combines data protection, interinstitutional coordination and the safeguarding of essential services, with a bill that has already cleared committee in the Senate and still needs to move through the legislative process.

Sources

View all