Argentina Data Protection Law 25.326: Compliance Guide

Any person or entity, public or private, that processes personal data in databases (archivos, registros, bancos de datos) located in Argentina or used for providing reports. The concept is database-centric, a 2000-era design, but the AAIP applies it functionally to modern processing. Foreign companies processing Argentines' data through local operations, subsidiaries, or databases in Argentina are covered; purely offshore processing sits in a gray zone the modernization bill would close with GDPR-style extraterritoriality.

Controllers must register their databases containing personal data with the AAIP's National Registry of Databases: identifying the controller, data categories, purposes, security measures, and transfers. Registration is done online and renewed as required by AAIP resolutions. It is the compliance item foreign practitioners most often miss because GDPR abolished its equivalent in 2018; in Argentina, an unregistered database processing personal data is itself an infraction and an aggravating factor in any other proceeding.

Consent is the default lawful basis: free, express, informed, and in writing or by an equivalent means, with prior information about purpose, recipients, the registry, and rights. Exceptions cover data from public sources, state functions, basic contact data (name, ID, tax ID, occupation, birth date, address, phone), contractual necessity, and financial-system operations. Sensitive data (racial/ethnic origin, political opinions, religious or moral beliefs, union membership, health, sex life) gets stronger protection: no one can be compelled to disclose it, and processing generally requires a public-interest law or statistical/scientific purposes with dissociation.

Access: any person can demand information about their data from a registry, answered within 10 calendar days, free of charge at intervals of six months or less unless a legitimate interest justifies more. Rectification, update, deletion, or confidentiality: within 5 business days of the request. Non-response opens the constitutional habeas data action in court, a fast-track remedy that predates the statute itself. These deadlines are shorter than GDPR's month and are enforced through both the AAIP and the courts.

A full replacement bill (GDPR-aligned: extraterritorial scope, lawful bases beyond consent, breach notification, DPOs, fines scaled to revenue, no database registration) was submitted to Congress in 2023 and has not been enacted; earlier attempts (2017, 2018) also lapsed. Argentina remains party to Convention 108+ (ratified 2023), and the AAIP fills gaps by resolution, including guidance on biometrics and AI. Companies should comply with the current law's mechanics, registration, consent, habeas data clocks, while building toward GDPR-grade practices the reform would demand and the EU adequacy review already rewards.