← Global Privacy Laws Research Library
25,326
Ley de Protección de los Datos Personales
Personal Data Protection Act No. 25,326: Argentina
Prepared by Shubhank Suman · Last reviewed
Current and operative
- Legal character
- National statute
- Region
- Latin America
- Adopted
- 4 October 2000
- Promulgated
- 30 October 2000
What it covers
Law 25,326 is Argentina's foundational general personal-data protection statute. Its stated purpose is the comprehensive protection of personal data contained in files, records, databases and other technical means of processing, whether public or private databases intended to provide information. It protects the rights of individuals concerning their personal information and expressly connects the regime to the constitutional right of habeas data under Article 43 of the Argentine Constitution. (Infoleg)
The law covers both automated and non-automated processing and defines personal data broadly. It also defines sensitive data, including racial/ethnic origin, political opinions, religious/philosophical convictions, trade-union affiliation, and health or sexual-life information. (Infoleg)
The statute is structured around:
- general principles
- conditions for data collection and use
- sensitive data
- information and consent
- access, correction and deletion
- database registration
- duties of database users/controllers
- supervisory powers
- sanctions
- judicial protection through habeas data.
The law is supplemented by Decree 1558/2001, its implementing regulation. The official Argentine legal database continues to identify the regulation as the framework implementing Law 25,326. (Infoleg)
Why it matters
Although enacted in 2000, it remains the foundational Argentine privacy instrument. Its structure is important for understanding Argentina's approach to:
- purpose limitation
- data quality
- sensitive information
- transparency
- individual access
- correction/deletion
- security
- international transfers
- database governance.
It is also particularly important because Argentina's regime is not limited to consent. Law 25,326 contains broader principles regulating the entire lifecycle of personal data. The statute's Article 4, for example, requires collected data to be certain, adequate, relevant and not excessive in relation to the purpose for which it was obtained. (Infoleg)
Refer to it when
Use this law when researching:
- whether collection of personal data is permissible
- sensitive-data processing
- data-quality requirements
- information/notice duties
- access rights
- correction and deletion
- database-registration obligations
- direct marketing
- security of databases
- transfers of data outside Argentina
- judicial habeas-data remedies
- controller/database-user responsibilities.
AI, privacy and cybersecurity relevance
- AI: Moderate
- Privacy: Very High
- Cyber: High
AI
Moderate / indirect.
The law contains no dedicated AI chapter because it predates modern AI.
Its relevance arises whenever AI systems:
- train on Argentine personal data
- generate profiles
- infer information about individuals
- process sensitive data
- make data-driven decisions
- transfer datasets to third parties.
The key AI issue is therefore whether the AI processing satisfies the underlying personal-data requirements, rather than whether the system is itself classified as "AI."
Cybersecurity
High.
Article 9 is the critical provision. Security is treated as a statutory obligation concerning confidentiality, integrity and protection against unauthorised processing. (Infoleg)
Applicability
The law applies to the covered public and private databases and personal-data processing within its scope.
It also has dedicated rules concerning international transfers and database users/controllers.
Current validity
CURRENT AND OPERATIVE.
The official Argentine legal database continues to maintain an updated version of Law 25,326 and its implementing framework. (Infoleg)
Read first
Article 1 → Article 2 → Article 4 → Articles 5–9 → Articles 13–16 → Articles 21–27 → Articles 31–32 → habeas data provisions.
Provisions / sections covered
Article 1: Object
Establishes the comprehensive protection of personal data and the rights of individuals concerning information recorded about them. (Infoleg)
Article 2: Definitions
Defines:
- personal data
- sensitive data
- database
- processing
- database controller/user.
The definition of processing is broad and includes collection, conservation, ordering, storage, modification, evaluation, blocking, destruction, communication and transfer. (Infoleg)
Article 4: Data quality
Requires personal data to be:
- accurate
- appropriate
- relevant
- not excessive
- connected to the purpose for which collected.
This is the statute's principal data-quality/purpose-limitation provision. (Infoleg)
Article 5: Consent
Establishes the general consent requirement subject to statutory exceptions.
Article 6: Information
Requires information concerning the purpose of collection, existence of the database, identity of the responsible party, whether responses are mandatory or optional, consequences of providing/not providing data, and availability of access/correction/deletion rights. (Infoleg)
Article 7: Sensitive data
Provides special restrictions concerning sensitive information. It states that persons cannot generally be compelled to provide sensitive data and restricts its collection/processing except under specified legal or statistical/scientific circumstances. (Infoleg)
Article 9: Security
Requires technical and organisational measures to protect data against:
- alteration
- loss
- unauthorised consultation
- unauthorised processing
- other deviations, intentional or accidental.
Argentina's regulator subsequently issued recommended security measures with Article 9 as the statutory basis. (Infoleg)
Articles 13–16: Data-subject rights
These provisions cover information/access and correction/deletion mechanisms. The implementing regulation describes access as including knowledge of the data held, sources, purposes, destination and registration status of the database. (Infoleg)
Articles 21–22: Database registration
Regulate registration and publicity of relevant databases.
Article 25: Processing by third parties
Important for outsourcing and service providers.
Articles 26–27: Credit and advertising
Important for credit-reporting and direct-marketing activities.
Articles 31–32: Sanctions
Establish the statutory sanction architecture.
Article 33 onwards: Habeas data
Provides the judicial protection mechanism for personal-data rights.
Subject-matter tags
- Lawful basis
- Consent
- Sensitive data
- Data subject rights
- Erasure and deletion
- Profiling
- Automated decision-making
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Direct marketing
- Enforcement and penalties
- Registration and notification
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.