Paraguay data law awaits regulations

Update October 30, 2026: Law No. 7593/2025 now has a firm effective date, November 27, 2027. Minister Gustavo Villate also said the oversight authority will be an independent national directorate within MITIC, and that sanctions will remain in the hands of the state.

Paraguay's Personal Data Protection Law No. 7593/2025 will take effect on November 27, 2027, although its implementing regulations are still pending. In parallel, the minister of information and communication technologies, Gustavo Villate, said enforcement and penalties for violations will remain exclusively under state authority while the oversight body is being defined.

What does the law say about consent?

The law includes rights tied to consent, including the ability to withdraw it through simple, fast, effective and free mechanisms, according to reporting on the pending regulations. That is part of the package of guarantees that will need to be in place once the implementing rules are approved.

The future regulations will also need to spell out how those mechanisms work in practice. So far, available coverage says the law has been enacted, but the operational details needed for uniform enforcement are still missing.

Who does it apply to, and what data does it cover?

The law will cover, in addition to credit information, patient data and employee records. It will also require organizations to define the purpose of processing, the retention period, the source of the information, and who can access it, according to ABC Color.

ABC Color also reported that the rules call for a specialized agency under the Ministry of Information and Communication Technologies, with functional autonomy and national directorate status. That matches what Villate later confirmed when he referred to an independent national directorate within MITIC's administrative structure.

What did Villate say about the regulations?

Villate said the final draft of the regulations was prepared together with the National Directorate of Tax Revenues and the Ministry of Economy, and that it would be made public in the following months for civil society to review, according to ABC Color.

The minister also said the oversight authority will be an independent National Directorate within MITIC. That setup is meant to sort out the law's institutional framework before it takes effect in 2027.

What is expected on voter rolls?

Reporting by Última Hora says the regulations are expected to set clear and fast mechanisms to correct party affiliations made without consent. It also included recommendations from Tedic to establish rules for the use of voter rolls and personal data in an electoral context.

That area stands out as one of the most sensitive applications of the law, because it links personal data processing with the use of party affiliation lists. In that context, the expectation is that the implementation rules will address fraudulent affiliations and other electoral uses of personal information.

Coverage from Ahendu distinguishes between the public consultation of the Permanent Civic Registry administered by the TSJE and the internal membership rolls kept by each political party. That distinction could be relevant in defining the technical and legal scope of the future regulations on voter rolls and party affiliations.

Could it conflict with access to public information?

Última Hora reported that organizations and specialists warn that Law No. 7593/2025 could begin to be used to deny public information before it takes effect. The identified point of conflict is Article 24, which allows access to public-source information to be limited when necessary to protect private interests tied to personal data.

According to that reporting, the regulations will need to clarify how privacy and transparency are balanced in access requests. The debate opened before the law takes effect, because using it as a basis to restrict information has already drawn criticism in the sector.

What has been said about the pending regulations?

The regulations for Law No. 7593/2025 are still pending at MITIC, and they will need to set out how the law is implemented across several fronts, from consent to the use of voter rolls. Public discussion has also raised the need for a multisector working group to support a gradual transition.

ABC Color also noted that available coverage did not show a public first draft of the regulations. That gap leaves several operational decisions unresolved as the effective date gets closer.

Reporting by Última Hora says the regulations are expected to set clear and fast mechanisms to correct party affiliations made without consent. It also included recommendations from Tedic to establish rules for the use of voter rolls and personal data in an electoral context.

That area stands out as one of the most sensitive applications of the law, because it links personal data processing with the use of party affiliation lists. In that context, the expectation is that the implementation rules will address fraudulent affiliations and other electoral uses of personal information.

Coverage from Ahendu distinguishes between the public consultation of the Permanent Civic Registry administered by the TSJE and the internal membership rolls kept by each political party. That distinction could be relevant in defining the technical and legal scope of the future regulations on voter rolls and party affiliations.