Introduction
Argentina’s Personal Data Protection Law (Ley No. 25.326), enacted on October 4, 2000, establishes a robust framework to regulate the processing of personal data and sensitive personal data by legal entities, encompassing data controllers and processors. Its primary objective is safeguarding personal data against unauthorized use, ensuring respect for individuals’ honor, intimacy, and access to information as enshrined in Article 43 of the Argentine Constitution.
The PDPL mandates that all data processing activities, from data collection and storage to transfer and deletion, must comply with the principles of legality, purpose limitation, and proportionality. This regime applies equally to automated and manual processing in the public and private sectors and extends to international data transfers.
Key Concepts and Definitions
Personal data under the PDPL encompasses any information related to an identified or identifiable natural person, including names, social security identification numbers, and online identifiers such as IP addresses. The law distinguishes sensitive personal data, including racial or ethnic origin, political opinions, health data, biometric data, and religious beliefs, which enjoys enhanced protection and may only be processed under specific lawful bases or for statistical or scientific purposes with adequate anonymization.
Data processing refers to any operation or set of operations performed on personal data, such as collection, recording, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, blocking, erasure, or destruction. Data subjects are the individuals whose personal data is processed, and they enjoy rights to access, rectify, delete, or object to the processing of their personal data.
Scope of Application
The PDPL applies to all legal entities, public bodies, private companies, and non-profit organizations, with a domicile in Argentina that process personal data, as well as to foreign entities that process Argentine data through international data transfers. This includes processing for commercial, administrative, or research purposes, whether conducted via personal databases, data banks, or other technical means.
Importantly, the law covers both data controllers, who determine the purposes and means of data processing, and data processors, who handle data on behalf of controllers. Both must comply with data protection rules and implement organizational and security measures to safeguard personal data against unauthorized access, alteration, or breach.
Requirements for Data Processing
Consent is the primary legal basis for data processing under the PDPL. Data controllers must obtain data subjects’ consent, which must be free, informed, and express, prior to processing any personal data. For sensitive personal data, consent must be explicit and cannot be presumed.
In addition to consent, processing may be justified by legitimate interests or legal obligations, provided these bases are expressly recognized by law and balanced against data subjects’ rights. Before engaging in certain data processing activities, particularly those involving sensitive data, large-scale processing, or high risks, a data protection impact assessment (DPIA) must be conducted to identify and mitigate privacy risks.
Data Subject Rights
The PDPL grants data subjects a comprehensive suite of rights to ensure personal data protection:
- Access: Data subjects may request confirmation of whether their personal data is being processed and obtain a copy of the information held.
- Rectification: They can request the correction of inaccurate or incomplete data.
- Deletion: Also known as the “right to be forgotten,” data subjects may ask for the removal of data when processing is unlawful or no longer necessary.
Beyond these, data subjects have the right to:
- Object to processing based on legitimate interests or direct marketing.
- Data portability facilitates the transfer of personal data to another data controller in a structured, commonly utilized, and machine-readable format.
- File a complaint with the Argentine Data Protection Authority (ADPA)—the former National Directorate for Personal Data Protection—when their rights are infringed.
International Data Transfers
Argentina has been recognized by the European Commission as providing an adequate level of data protection since June 30, 2003, enabling the free flow of personal data from the EU to Argentina without additional safeguards. For transfers to countries lacking an adequacy decision, controllers and processors must implement standard contractual clauses or obtain binding corporate rules to ensure equivalent protections.
Additionally, any cross-border transfer must comply with the PDPL’s notification and approval procedures. Controllers must report intended transfers to the ADPA and, in cases of significant risk or large volumes, secure prior authorization. All security incidents or data breaches affecting transferred data must be promptly reported to both the ADPA and affected data subjects.
Comparison with Global Data Privacy Laws
The PDPL shares many features with the EU’s GDPR, such as definitions of personal and sensitive data, data subject rights, and obligations for data controllers and processors, reflecting its alignment with international standards. However, unlike the GDPR, the PDPL does not explicitly recognize legitimate interests as a standalone legal basis, and lacks provisions on automated decision-making and profiling.
Similarly, the PDPL exhibits parallels with the California Consumer Privacy Act (CCPA) through its emphasis on consumer rights and consent requirements. Yet, it differs in scope—while the CCPA applies to for-profit businesses meeting certain thresholds, the PDPL covers all entities processing personal data in Argentina without turnover conditions— and in enforcement mechanisms, which under the PDPL are administered by a dedicated national authority rather than state attorneys general.
Data Protection Laws and Regulations
Law 25.326 is the cornerstone of Argentina’s data protection regime, complemented by Decree 1558/2001, which provides regulatory detail on procedures, DPIAs, and international transfers. Subsequent resolutions, such as Resolution 47/2018, updating consent formats and transparency requirements, further refine obligations for legal entities.
Argentina’s Constitution (Article 43) and various international treaties (e.g., Convention 108+) also underpin the PDPL. Organizations must monitor these instruments and guidelines issued by the ADPA to stay abreast of evolving data protection laws, ensuring ongoing compliance with both domestic and transnational requirements.
Enforcement and Penalties
The Argentine Data Protection Authority (Agencia de Acceso a la Información Pública, formerly NDPDP) is the national data protection authority tasked with overseeing, registering data banks, and enforcing the PDPL. It conducts audits, investigates complaints, and may impose corrective measures, ranging from warnings and mandatory audits to suspension of data processing activities.
Fines for non-compliance vary based on severity and can reach up to 1,000 times the minimum wage. Additionally, organizations face reputational damage and potential civil liability claims from data subjects. The ADPA also retains the power to order the deletion of unlawful databases and to require the implementation of adequate security measures and organizational measures to prevent future breaches.
Impact on Consumers
By codifying rights to consent, access, rectification, deletion, objection, and portability, the PDPL empowers individuals to protect personal data and maintain data privacy. This expanded scope of data subject rights ensures transparency in data processing activities and holds organizations accountable for the misuse of personal data.
In practice, consumers benefit from greater control over their data, enhanced recourse through Habeas Data actions, and the ability to lodge complaints with a dedicated authority. These mechanisms help safeguard against unauthorized profiling, unsolicited marketing, and potential harm from security incidents or data breaches.
Impact on Businesses
The PDPL compels businesses to integrate data protection into corporate governance. Companies must obtain explicit data subjects’ consent, establish internal policies, conduct DPIAs for high-risk processing, and implement technical and security measures to mitigate threats.
Many organizations appoint a data protection officer (or data protection delegate) to oversee compliance, coordinate responses to data requests, and liaise with the ADPA. Compliance efforts may also include staff training, updating contracts (including binding corporate rules), and adopting standard contractual clauses for international transfers.
Compliance and Preparation
To prepare for compliance, entities should map their data bank inventories, document data processing activities, and assess legal bases—consent, contractual necessity, legal obligation, or public interest—for each processing operation. Conducting DPIAs not only fulfills regulatory requirements but also identifies gaps in data security and informs the design of organizational measures.
Organizations must establish clear procedures for handling data subject requests, reporting security incidents, and updating privacy notices. Regular audits and staff training ensure that evolving data privacy regulations are integrated into business processes, fostering a culture of privacy by design and default.
Role of the Data Protection Authority
The ADPA provides guidance on regulatory developments, issues binding resolutions, and maintains the National Databases Register—a centralized repository of all data banks operating in Argentina. It also supports organizations through advisory services and publishes best practices on personal data protection law.
Through public consultations and international cooperation, the ADPA monitors global trends, such as amendments to the GDPR or shifts in data privacy laws, and proposes legislative updates to enhance Argentina’s regulatory framework. Its proactive stance helps maintain Argentina’s adequacy status and ensures ongoing alignment with emerging standards.
Data Privacy and Security
In an era of rising cyber threats, data privacy and security measures—encryption, access controls, incident response plans, and regular vulnerability assessments—are paramount to safeguarding personal data. A data breach under the PDPL triggers immediate notification to the ADPA and affected data subjects, along with remedial actions to mitigate harm.
By embedding privacy into system design and adopting a risk-based approach to security, organizations can reduce the likelihood of security incidents and demonstrate their commitment to data protection, enhancing trust among consumers and business partners alike.
Conclusion
Argentina’s PDPL represents a mature, comprehensive personal data protection law that balances the needs of data subjects with the operational realities of data controllers and processors. It facilitates cross-border data flows while safeguarding individual rights by aligning closely with international norms, such as the GDPR and CCPA.
For organizations, the PDPL underscores the necessity of ongoing vigilance: mapping data processing, securing consent, conducting DPIAs, and embedding privacy into corporate culture. For data subjects, it provides robust tools to control their personal data, ensuring accountability and transparency. As global data privacy standards evolve, Argentina’s regulatory framework—supported by an active Data Protection Authority—remains well-positioned to adapt and uphold the highest levels of data security and protection.
