Paraguay Senate debates critical infrastructure law

Update September 17, 2026: This coverage adds the link between the critical infrastructure bill and Law No. 7593/2025 on personal data protection, which was enacted and published on Nov. 27, 2025, and will take general effect on Nov. 27, 2027. It also notes that the law is the country’s first comprehensive data protection statute, creates a National Agency with oversight and sanctioning powers, and applies to any public or private organization that handles customer, supplier, and employee data.

Paraguay’s Senate is set to consider a critical infrastructure bill during its regular session on Wednesday, Sept. 16, 2026. The measure is designed to protect essential services such as electricity, drinking water, hospitals, telecommunications, banks and government digital services. It defines which assets fall into that category, requires public and private operators to have security and response plans for failures or attacks, and directs the state to coordinate actions to avoid cascading effects across sectors.

What does the bill include?

The text calls for a national registry of categorized critical infrastructures and requires those facilities to have intrusion detection and prevention systems, known as IDS/IPS, as well as security protocols for operational technology and internet of things devices, or IoT.

The bill was originally introduced by opposition Senator José Oviedo on Dec. 4, 2024 and, after revisions, reaches September 2026 consideration with 17 articles. According to Última Hora, one of its goals is to identify public agencies in order to improve their cybersecurity levels. The bill also draws on the 2004 Budapest Convention on Cybercrime.

What new body does it create?

The proposal would create a National Cybersecurity Council, which has not yet been established, tasked with designing a national strategy for protecting critical infrastructure.

Alongside that council, the bill sets up a group of critical infrastructure operators, public and private, that must report incidents within up to 12 hours of the event. It also includes provisions for the state to encourage private-sector participation and investment in security technologies tied to the protection of those infrastructures.

What changes with the personal data law?

Law No. 7593/2025 on personal data protection complements Law No. 6534/2020 on credit data and establishes a general data protection regime in Paraguay. According to El Nacional and Última Hora, it was enacted and published on Nov. 27, 2025, will take general effect on Nov. 27, 2027, and applies to all public or private organizations that process personal data, including data from customers, suppliers and employees.

The law also creates a National Agency with oversight and sanctioning powers, and it предусматри due fines that can reach as high as 10,000 minimum daily wages at the top end, according to Última Hora. During the legislative process, credit bureau representatives and financial and credit industry groups took part in public hearings before Congress, according to El Nacional.

Why do both debates overlap?

The common thread between the two initiatives is that Paraguay is moving at the same time on rules to protect essential services and on a general law to regulate personal data processing. While the critical infrastructure bill focuses on operational continuity in sensitive sectors, Law No. 7593/2025 sets obligations for companies and public bodies that handle people’s information.

In the case of critical infrastructure, the proposal requires IDS/IPS systems, protocols for OT and IoT, the creation of a National Cybersecurity Council, and incident reporting within a maximum of 12 hours. It also calls for the state to promote private investment in security technologies for those services.

At the same time, the data protection law has already been approved and published, but its general entry into force will not come until November 2027, giving companies and public agencies a period to adapt. According to Última Hora, it is the country’s first comprehensive data protection law and sets a standard that will coexist with the critical infrastructure debate.