Paraguay enacts data law, creates ANPDP

Paraguay enacted Law No. 7,593 on Personal Data Protection on Nov. 27, 2025, creating a broad framework that applies to any organization handling the data of individuals in the country. The law sets a 24-month transition period and will take full effect in November 2027. It also creates the National Personal Data Protection Agency, which will operate within MITIC and have oversight, inspection and sanctioning powers.

What changes for organizations in Paraguay?

The law requires personal data processing to have a lawful basis and, where applicable, prior, free and informed consent. It also requires clear privacy notices and records of processing activities, according to local analyses published by InfoNegocios Paraguay.

That package of obligations puts companies and other organizations on a formal compliance timeline, with two years to adjust internal processes, documentation and controls before the law becomes fully effective in November 2027. Local coverage also presents it as inspired by international frameworks such as the GDPR and Brazil's LGPD.

What agency will enforce the new law?

The National Personal Data Protection Agency, created by Law 7,593, will operate within the Ministry of Information and Communication Technologies and will have oversight, inspection and sanctioning functions.

Última Hora says the law includes financial penalties for violations and that, in serious cases involving sensitive data, including cases involving children's data, the maximum bracket can reach up to 10,000 minimum wages. Under this structure, enforcement has been concentrated in a specific authority with power to act on compliance with the regime.

How does it intersect with Brazil's LGPD?

The comparison with Brazil is central to the debate because the LGPD also covers processing with extraterritorial effect when the purpose is to offer goods or services to people located in Brazil, or when the data was collected there, regardless of where the controller is based.

For Paraguayan companies operating in the Brazilian market, the risk does not end in Asunción. Brazil's federal ANPD can impose fines of up to 2% of a group’s revenue in Brazil, capped at 50 million reais per violation, and it also regulates, guides and monitors LGPD compliance, receives incident reports and applies the sanctions set out in the law.

The reference to the LGPD and ANPD leaves Paraguayan companies facing a dual compliance standard when they handle data tied to Brazil. In one case, Paraguay's new regime sets its own obligations and penalties. In the other, Brazilian rules already provide a supervisory and fine structure with meaningful reach for regional operators.