Argentina Law 25.326 (Personal Data Protection Law)

Argentina

20 domains

34 controls

Argentina Personal Data Protection Law (Law 25.326) together with its implementing regulation Decree 1558/2001, the AAIP oversight provisions, and the 2020 amendment (Law 27.401) that added data breach notification requirements.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (20)

Confidentiality

1 controls

Controls in the Confidentiality domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-ART9-CONFIDENTIALITY	Confidentiality Duty	The controller and all persons involved in any phase of personal data processing are bound by professional secrecy. This...

Cross-border transfers

3 controls

Controls in the Cross-border transfers domain of Argentina Law 25.326 (Personal Data Protection Law) — 3 controls
Code	Title	Description
AR-25326-ART12-ADEQUACY	AAIP Adequacy List Reliance	AAIP maintains a list of countries deemed to provide adequate protection. EU member states and EEA countries are recogni...
AR-25326-ART12-XBORDER	Cross-Border Transfer Restrictions	Transfer of personal data to countries or international entities that do not provide adequate levels of protection is pr...
AR-25326-EU-ADEQUACY	EU Adequacy Status Maintenance	Argentina has held EU adequacy status since Commission Decision 2003/490/EC. Maintenance of adequacy depends on continue...

Data subject rights

6 controls

Controls in the Data subject rights domain of Argentina Law 25.326 (Personal Data Protection Law) — 6 controls
Code	Title	Description
AR-25326-ART14-ACCESS	Right of Access	The data subject has the right to request and obtain information about their personal data included in public databases...
AR-25326-ART15-CONTENT	Content of Access Response	Information provided must be in clear language, exempt from codifications, and accompanied by an explanation of the tech...
AR-25326-ART16-RECTIFICATION	Right of Rectification, Update, Suppression and Confidentiality	Every person has the right to rectification, updating, and when applicable suppression or confidentiality of their perso...
AR-25326-ART17-OPPOSITION	Right of Opposition and Refusal Exceptions	Controllers may refuse suppression in defined cases including legal duty to retain, contractual obligations, or where su...
AR-25326-ART20-ADM	Automated Decisions	Judicial decisions or administrative acts that imply assessment of human behavior may not have as their sole basis the r...
AR-25326-HABEAS-DATA	Habeas Data Judicial Remedy	Articles 33 to 46 establish the habeas data action, a constitutional remedy by which data subjects may judicially demand...

Disclosure

1 controls

Controls in the Disclosure domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-ART11-DISCLOSURE	Disclosure to Third Parties	Personal data may only be disclosed for purposes directly related to the legitimate interest of the controller and the r...

Governance

2 controls

Controls in the Governance domain of Argentina Law 25.326 (Personal Data Protection Law) — 2 controls
Code	Title	Description
AR-25326-AAIP-DPIA	Data Protection Impact Assessment Recommendation	AAIP Resolution 47/2018 recommends a Privacy Impact Assessment for high risk processing, including large scale sensitive...
AR-25326-AAIP-DPO	Data Protection Officer (DPO) Recommendation	AAIP Resolution 47/2018 recommends appointment of a Data Protection Officer for organizations processing large volumes o...

Incident response

1 controls

Controls in the Incident response domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-AAIP-BREACH	Personal Data Breach Notification	AAIP Resolution 47/2018 recommends notification of personal data breaches to AAIP and affected data subjects when the br...

Lawful basis

2 controls

Controls in the Lawful basis domain of Argentina Law 25.326 (Personal Data Protection Law) — 2 controls
Code	Title	Description
AR-25326-ART5-CONSENT	Consent as Default Lawful Basis	Processing requires the free, express, and informed consent of the data subject, given in writing or by equivalent means...
AR-25326-ART5-EXCEPTIONS	Consent Exceptions	Consent is not required when data comes from public sources, is collected for state functions, consists of limited ident...

Marketing

1 controls

Controls in the Marketing domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-ART27-MARKETING	Direct Marketing and Opt-Out	Personal data with direct marketing purpose may be processed when it is from public sources or provided by the data subj...

Oversight

1 controls

Controls in the Oversight domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-ART29-AAIP	AAIP Authority and Powers	AAIP is the supervisory authority responsible for ensuring compliance with the law, conducting investigations, imposing...

Penalties

2 controls

Controls in the Penalties domain of Argentina Law 25.326 (Personal Data Protection Law) — 2 controls
Code	Title	Description
AR-25326-ART31-ADM-SANCTIONS	Administrative Sanctions	AAIP may impose warnings, suspensions, fines from ARS 1,000 to ARS 100,000, and closure or cancellation of databases for...
AR-25326-ART32-CRIMINAL	Criminal Penalties	Article 32 amends the Penal Code to criminalize insertion of false data, unlawful access to databases, and disclosure of...

Principles

3 controls

Controls in the Principles domain of Argentina Law 25.326 (Personal Data Protection Law) — 3 controls
Code	Title	Description
AR-25326-ART4-PURPOSE	Lawful Purpose and Purpose Limitation	Collection must be for determined, explicit, and lawful purposes. Data cannot be used for purposes incompatible with tho...
AR-25326-ART4-QUALITY	Data Quality Principle	Personal data must be true, adequate, pertinent, and not excessive relative to purposes. Data must be accurate and updat...
AR-25326-ART4-RETENTION	Retention Limitation	Data must be destroyed when no longer necessary or pertinent for the purposes for which it was collected.

Public sector

1 controls

Controls in the Public sector domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-ART22-PUBLIC-DB	Public Database Operation	Public databases must be created by law or administrative act and must publish their existence, purpose, and access cond...

Reform

1 controls

Controls in the Reform domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-MODERNIZATION	Pending Modernization Bill 2023	Executive submitted a draft new Personal Data Protection Law to Congress in June 2023 to align with GDPR. The bill intro...

Registration

1 controls

Controls in the Registration domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-ART21-REGISTRATION	Database Registration with AAIP	All public databases and private databases destined to provide reports must be registered in the National Database Regis...

Scope

1 controls

Controls in the Scope domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-ART2	Scope and Definitions	Law applies to personal data recorded in public or private databases that provide reports. Defines personal data, sensit...

Sectoral

1 controls

Controls in the Sectoral domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-ART26-CREDIT	Credit Information Database Rules	Credit information may be processed with data from public sources or provided by the data subject or with consent. Adver...

Security

1 controls

Controls in the Security domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-ART9-SECURITY	Security Measures Obligation	The data controller must adopt technical and organizational measures necessary to guarantee the security and confidentia...

Sensitive data

3 controls

Controls in the Sensitive data domain of Argentina Law 25.326 (Personal Data Protection Law) — 3 controls
Code	Title	Description
AR-25326-ART7-CRIMINAL	Criminal Records Restrictions	Data relating to criminal or contravention records may only be processed by competent public authorities within the fram...
AR-25326-ART7-SENSITIVE	Sensitive Data Restrictions	No person may be compelled to provide sensitive data. Sensitive data can only be collected and processed for reasons of...
AR-25326-ART8-HEALTH	Health Data Special Rules	Public and private health establishments and health professionals may collect and process data relating to physical or m...

Transparency

1 controls

Controls in the Transparency domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-ART6-NOTICE	Information Duty at Collection	When data is collected, the data subject must be informed of the purpose, recipients, existence of the database, control...

Vendors

1 controls

Controls in the Vendors domain of Argentina Law 25.326 (Personal Data Protection Law) — 1 controls
Code	Title	Description
AR-25326-PROCESSOR	Processor Agreements (Art 25)	When personal data is processed by a third party on behalf of the controller, the relationship must be governed by a con...

Frequently Asked Questions

What is Argentina Law 25.326 (Personal Data Protection Law)?

Argentina Law 25.326 (Personal Data Protection Law) is a compliance framework from Argentina with 20 domains and 34 controls. Argentina Personal Data Protection Law (Law 25.326) together with its implementing regulation Decree 1558/2001, the AAIP oversight provisions, and the 2020 amendment (Law 27.401) that added data breach notification requirements. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Argentina Law 25.326 (Personal Data Protection Law) have?

Argentina Law 25.326 (Personal Data Protection Law) has 34 controls organised across 20 domains. The largest domains are Data subject rights (6 controls), Cross-border transfers (3 controls), Principles (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Argentina Law 25.326 (Personal Data Protection Law) map to?

Argentina Law 25.326 (Personal Data Protection Law) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I get started with Argentina Law 25.326 (Personal Data Protection Law) compliance?

Start your Argentina Law 25.326 (Personal Data Protection Law) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Argentina Law 25.326 (Personal Data Protection Law) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 34 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 768 frameworks.

Get Started Free →

Free forever — no credit card required