Paraguay advances critical infrastructure bill

Paraguay is moving ahead on two parallel regulatory fronts tied to digital security and the protection of strategic assets: implementation of Personal Data Law 7593/2025 and legislative review of the Critical Infrastructure Protection Bill.

Personal data protection

Law 7593/2025 is already in force, but the available material does not detail its implementing rules or the current state of company compliance. What does emerge in this process is that the country now has a specific law on personal data, while the institutional debate is also shifting toward the resilience of essential systems and services.

Critical infrastructure bill

The Critical Infrastructure Protection Bill was introduced and reviewed by the Senate Commission on Science, Technology, Innovation and the Future. Its stated goal is to set out a legal framework to identify, protect and ensure the resilience of the country’s critical infrastructure.

Among its core elements, the draft contemplates creating a National Registry of Critical Infrastructure, to be established by the Executive Branch. It also assigns implementation responsibility to the National Defense Commission, CODENA, working in coordination with ANDE, ESSAP and MITIC.

Timelines and next steps

The specialized analysis cited by Consultora BBRA places the short-term horizon, over the next 0 to 12 months, on passage of the law, rollout of the National Registry, vulnerability assessments and the creation of a permanent interagency committee for critical infrastructure protection.

With those pieces in place, Paraguay is pursuing a regulatory discussion that combines data protection, interagency coordination and the safeguarding of essential services, with a bill that has already cleared Senate committee review and still needs to move through the legislative process.