CiberLATAMbywhalemate

Paraguay’s Law 7593/2025 on data

Paraguay published its data protection law in November 2025. Full enforcement is still set for late November 2027.

Whalemate Labs · AI-assisted researchPublished:Updated 4 min read

Paraguay’s Law No. 7,593/2025 on Personal Data Protection was published in Official Gazette No. 287 on Nov. 27, 2025, and includes a 24-month vacatio legis, so full enforcement is still scheduled for late November 2027. In the meantime, companies, platforms and media outlets are already using it as a reference point for privacy policies and debates over data use and artificial intelligence.

Update Oct. 10, 2026: the law was published in Official Gazette No. 287 on Nov. 27, 2025, and its vacatio legis was set at 24 months. Fine caps are also being calculated using the minimum daily wage in effect since July 1, 2026.

Paraguay’s Law No. 7,593/2025 on Personal Data Protection was published in Official Gazette No. 287 on Nov. 27, 2025, and is scheduled to take full effect in late November 2027, after a 24-month vacatio legis, according to Avanzia Legal and VLex Paraguay. At the same time, private-sector actors such as MiSimple already acknowledge that the law has been enacted and are adjusting their privacy policies to the new legal framework, while Paraguayan media outlets are using it as a reference point in debates over artificial intelligence, conversations and other personal data.

What does the transition period mark?

The transition period is the span between the law’s publication and its full force in November 2027, according to Avanzia Legal and Lawwwing. During that window, companies and digital services are beginning to adjust notices and data processing practices so they align with the requirements that will apply once the law is fully in force.

MiSimple, for example, states in its privacy policy that Law No. 7,593/2025 has been enacted and is still moving toward full enforcement. That private-sector acknowledgement shows that the new framework is already driving concrete changes in the legal documentation displayed by platforms that collect personal information.

How are companies reacting?

Some compliance guides are already treating the law as a factor in corporate digital presence in Paraguay. Flexora Systems recommends adding or updating privacy notices on websites that collect personal data and aligning those policies with the requirements that will apply once the new law takes effect.

The recommendation includes transparency about purposes and legal bases for processing, two points that appear to be part of the future adaptation to the new framework. In practice, that is pushing companies to review forms, legal text and data collection flows before full enforcement begins.

What role is it playing in the AI debate?

Paraguayan media outlets such as La Tribuna are already using Law No. 7,593/2025 as the main framework for discussing artificial intelligence and the processing of personal data. In a report on systems that could record conversations, the outlet noted that the law requires consent and recognizes each person’s right to decide how their data is collected, used and shared.

That journalistic use of the law shows that Paraguay’s AI debate is no longer limited to the technology itself, but also to how conversations are captured, how data is processed and what can be done with that information. The law is being cited even in cases involving automated processing.

What penalties does the new framework mention?

Legal notes on the law cite fines ranging from 20 to 2,500 minimum daily wages for general violations, up to 5,000 minimum daily wages if sensitive data is involved, and up to 10,000 minimum daily wages if sensitive data belonging to children or adolescents is affected, according to Avanzia Legal. Deloitte adds that as of July 1, 2026, the current minimum daily wage is Gs. 117,077, the figure used for those calculations.

At that value, the 2,500-wage cap equals Gs. 292,700,000, the 5,000-wage cap for sensitive data equals Gs. 585,400,000, and the 10,000-wage cap reaches Gs. 1,170,800,000, according to Avanzia Legal. That scale is increasing pressure on companies and digital services to review their policies before full enforcement begins.

What comes next?

What appears likely through late November 2027 is a gradual adjustment period, with companies revising internal and external policies and the law becoming a reference point for discussions of privacy and automation. The material available here does not spell out how the National Personal Data Protection Agency works, or the full sanctions regime, but it does show that the framework is already being incorporated by media outlets, platforms and compliance guides.

The combination of official publication, legal transition, corporate adjustment and public debate over AI has put Law No. 7,593/2025 at the center of Paraguay’s digital conversation as full enforcement approaches.

Sources

View all