Paraguay debates cyber law

Paraguay’s Chamber of Deputies held a public hearing on the Cybersecurity Law, but several invited institutions declined to take part after preparing comments on an earlier version of the bill that did not match the text presented at the hearing. The proposal is broad in scope, covering everything from cybersecurity and cyberintelligence to the regulation of nanotechnology and artificial intelligence, while Congress is also still processing Personal Data Protection Law No. 7,593/2025.

What happened at the public hearing?

The public hearing called by Deputies ended with criticism of the working method and with several institutions stepping away from the table, according to ABC Color. The reason was straightforward, those entities had prepared input based on an earlier version of the bill, which did not match the text presented during the hearing.

The issue was not only procedural. ABC Color’s reporting describes an initiative with a very broad reach, with chapters that go beyond strict cybersecurity and extend into cyberintelligence, nanotechnology, and artificial intelligence. At the same time, La Red 106.1 reported that the Committee on Communications and Transportation added the proposal to its recent oversight agenda, alongside working meetings in which it also reviewed transit policy, suggesting the text is also being viewed through the lens of infrastructure and services.

What does bill 6347 propose?

Bill 6347 includes a chapter on cybercrime and defines conduct such as unauthorized access to systems, interception of information, data alteration, identity theft, device misuse, and computer fraud, with penalties and fines proposed in the text, according to La Hora.

That same coverage says the bill is still under discussion among committees in Paraguay’s Congress. Based on the available reports, the legislative review combines a criminal-law dimension with a broader debate over how the digital ecosystem should be regulated.

What is happening with the data protection law?

Personal Data Protection Law No. 7,593/2025 was already enacted and officially published on November 27, 2025, but it is still not fully in force. Its own effective-date clause sets full entry into force 24 months later, on November 27, 2027, and MITIC confirmed that schedule in April 2026.

Flexora Systems adds that the law creates the National Personal Data Protection Agency as the supervisory authority, although its organizational structure and effective operation still depend on later regulations. That means practical enforcement controls and sanctions remain tied to that regulatory work.

The same source also says the law will have extraterritorial reach, covering companies that offer goods or services to residents in Paraguay even if they are not based in the country. In that context, it recommends that e-commerce firms begin adapting before the law takes effect, rather than trying to do so in a rush once compliance becomes mandatory.

How does the regulatory map look?

Economía Virtual reported that Paraguay still does not have an enacted artificial intelligence law, even though Congress is reviewing two bills to regulate it. That gap sits alongside the cybersecurity debate and the data protection law, which has already been approved but is still in its transition period.