Argentina Data Protection Law Guide: Law 25,326, Security Measures and Transfers

Argentina's data protection law dates from 2000, yet it still governs every database of personal data in the country and underpins one of the few EU adequacy decisions in Latin America. Law 25,326 on the Protection of Personal Data, its implementing Decree 1558/2001 and a body of resolutions from the Agencia de Acceso a la Información Pública (AAIP) together set the rules on consent, security, processors, registration and international transfers. The detail that security teams need, such as recommended security measures and the sanctions scale, lives in those resolutions rather than in the statute. This guide is for security, privacy and engineering teams processing personal data in Argentina or receiving it from there. It covers scope, obligations, current status (including Convention 108+ and reform bills), enforcement, the identity angle, and a practical compliance path.

Key takeaways

• One law, layered rules. Law 25,326 sets principles; Decree 1558/2001 regulates it; AAIP resolutions such as Res. 47/2018 (security measures) and Res. 240/2022 and 244/2022 (infractions and sanctions) supply the operational detail.
• Security is technical and organisational. Art. 9 requires both, and Res. 47/2018 lists recommended measures across collection, access control, change control, backup, vulnerability management, destruction, incidents and development environments.
• No general breach notification clock in the statute. The law and decree read for this guide set no deadline to notify the AAIP or data subjects, but incident handling is a recommended measure and post-incident cooperation reduces sanctions.
• Transfers need adequacy or an exception. Art. 12 prohibits transfers to countries without adequate protection; Decree 1558/2001 allows adequacy to come from contractual clauses or self-regulation, and express consent is an exception.
• Status is stable but under review. The EU reconfirmed Argentina's adequacy in January 2024, Argentina ratified Convention 108+ in April 2023, and a replacement bill sent to Congress in 2023 has not, to our knowledge, been enacted.

Scope: who and what is covered

Law 25,326 protects personal data held in files, registers, databases and data banks, public or private, and applies to data of legal persons where relevant (Art. 1). It also implements the constitutional habeas data action, regulated in Art. 33 onwards.

The control body is the AAIP. Decree 899/2017 replaced Art. 29 of Decree 1558/2001 so that references to the former Dirección Nacional de Protección de Datos Personales (DNPDP) are read as references to the AAIP, created by Law 27,275 and given these powers by Decree 746/2017.

Key obligations

Lawfulness, consent and quality

• Consent (Art. 5): free, express and informed, with exceptions such as data from public access sources and data needed for a contractual relationship. Decree 1558/2001 requires the explanation to suit the person's social and cultural level and allows revocation at any time without retroactive effect.
• Quality (Art. 4): data must be accurate, relevant and not excessive, not used for incompatible purposes, and deleted when no longer needed.
• Disclosure to third parties (Art. 11): cession requires prior, revocable consent, with listed exceptions.
• Registration (Art. 21): databases must be registered with the control body; failure to register is sanctionable.

Security and confidentiality

Art. 9 requires controllers and users to adopt the technical and organisational measures needed to guarantee the security and confidentiality of personal data and prevent alteration, loss, unauthorised consultation or processing. Art. 10 binds everyone involved to professional secrecy, which survives the end of their relationship. AAIP Res. 47/2018 (signed 23 July 2018, Boletín Oficial 25 July 2018) replaced the older DNPDP Disposiciones 11/2006 and 9/2008 with a set of recommended, referential measures.

Annex II covers non-computerised records: collection, access control, conservation (physical conditions), destruction and incidents. The resolution text describes the measures as recommendations to facilitate compliance with the law, but a regulator assessing whether Art. 9 "necessary" measures were in place will naturally compare you against them.

Rights and processors

• Access (Art. 14): answer within 10 calendar days of a formal request; access is free at intervals of six months unless a legitimate interest is shown. Decree 1558/2001 allows requests in any form that verifies identity, including electronically.
• Rectification, update and deletion (Art. 16): within five business days, with notice to any assignee; disputed data must be blocked or flagged while under review.
• Processors (Art. 25 and decree Art. 25): contracts must state the security levels required by the law, decree and AAIP rules and the confidentiality duties; processors act only on instructions and Art. 9 applies to them directly.
• Credit information (Art. 26): specific retention limits of five years, or two years once the debt is settled.

International transfers

• Rule (Art. 12): transfers of any kind to countries or international organisations without adequate protection are prohibited, subject to listed exceptions.
• Express consent: under Decree 1558/2001 the restriction does not apply where the data subject expressly consents.
• Adequacy: the control body assesses adequacy on its own initiative or on request, considering the nature, purpose and duration of processing, destination, laws, codes and security measures. Adequate protection can derive from the legal system, self-regulation or contractual clauses.
• In practice: most organisations rely on contractual clauses with the recipient. The AAIP has published a list of adequate jurisdictions and model clauses; check the current versions on argentina.gob.ar before relying on them.

For how Argentina's mechanism compares with GDPR and other regimes, see the International Data Transfers Map.

Timeline and current status

Reform: the 2023 bill would have replaced Law 25,326 with a modern, GDPR-influenced framework, and the European Commission recommended moving protections now found in sub-legislative rules into statute. As of October 2026 the consolidated text on Infoleg remains Law 25,326; we have not confirmed the parliamentary status of the 2023 bill or later proposals, so treat any reform as pending until it appears in the Boletín Oficial. Convention 108+ itself was described by the Council of Europe in 2023 as still needing further ratifications to enter into force.

Enforcement and penalties

• Administrative sanctions (Art. 31): warning, suspension, fines, closure or cancellation of the database. The statutory fine range of ARS 1,000 to 100,000 has been superseded in practice by AAIP resolutions.
• Classification (Res. 240/2022): infractions are graded leve, grave and muy grave; processing sensitive data without consent or a valid basis is muy grave. Cooperation with the AAIP and demonstrated corrective measures and internal procedures that minimise harm after a security incident are mitigating factors.
• Caps (Res. 244/2022): maximum accumulated sanctions of ARS 3 million, 10 million and 15 million for leve, grave and muy grave infractions respectively.
• Procedure (Decree 1558/2001, Art. 31): investigations start ex officio or on complaint; the controller has 10 business days to respond, extendable by 10; a record of findings is drawn up and the alleged infringer has 10 business days to present a defence. Repeat offences within three years count as recidivism, and sanctions are recorded in a register of infringers and published.
• Criminal law (Art. 32): Penal Code Art. 117 bis (false data, one month to two years, or six months to three years for supplying false information to third parties) and Art. 157 bis (unlawful access to or disclosure of personal databases, one month to two years).
• Habeas data (Art. 33): individuals can go to court to access, correct, delete or keep confidential their data.

What it means for AI agents and non-human identities

• Access control covers machine accounts: Res. 47/2018 area B is about who can reach personal data; service accounts, API keys and agent tokens are the least reviewed part of that population. See the Secrets Management Guide.
• Development environments: area H matters for AI pipelines that copy production data into notebooks, fine-tuning sets or test stacks. Mask or dissociate before copying.
• Processor duties reach your vendors' agents: an AI service receiving personal data is a processor under Art. 25 and, if abroad, a transfer under Art. 12. Contract for instructions, security levels and deletion.
• Confidentiality survives (Art. 10): integrations created by departed staff or vendors must be decommissioned. See the NHI Offboarding and Decommissioning Guide.
• Quality and purpose (Art. 4): agents with broad read scopes collect more than needed. Scope them to purpose. See the AI Agent Authorisation Guide.

Compliance steps

1. Inventory and register. List every database with personal data, its purpose, legal basis, sensitive data, processors and transfers, and confirm AAIP registration (Art. 21). See the Data Classification Guide.
2. Gap assess against Res. 47/2018. Score each Annex I and II area per database; prioritise sensitive data and credit data.
3. Close identity gaps first. Access control and vulnerability management usually carry the most risk; include non-human identities in access reviews.
4. Write the incident procedure. Even without a statutory deadline, define assessment, containment, who decides on informing data subjects and the AAIP, and how corrective measures are documented, since these mitigate sanctions under Res. 240/2022. Test it with a pilot tabletop, then roll out to all business units.
5. Fix contracts. Processor contracts with security levels and confidentiality; transfer contracts with clauses that establish adequate protection, or documented express consent.
6. Operationalise rights. Track 10 calendar day access and five business day rectification deadlines; support blocking of disputed data.
7. Watch reform. Monitor the Boletín Oficial and AAIP for a new law or resolutions; a GDPR-style reform could add breach notification and accountability duties, so design processes that can absorb them.

Choosing a transfer route

Measuring it

• Registration coverage: share of databases registered with the AAIP.
• Res. 47/2018 conformance: share of databases meeting all Annex I areas.
• Rights timeliness: percentage of access requests answered within 10 calendar days.
• Machine credential hygiene: share of non-human identities with access to personal data that are owned, scoped and rotated.
• Transfer coverage: share of foreign recipients with a documented adequacy basis.

Framework mapping

Common failure patterns

• Unregistered databases. New SaaS and analytics stores are never registered, a straightforward sanctionable gap.
• Assuming "recommended" means optional. Res. 47/2018 is the benchmark the AAIP will use to judge Art. 9.
• Production data in test. Development and AI experimentation environments hold full copies of customer data.
• Transfers by default. Cloud and AI services abroad receive data with no clause or consent behind them.
• No incident record. Without documented containment and corrective action, the main mitigating factor in Res. 240/2022 is lost.

Practitioner checklist

• Inventory every personal data database and confirm AAIP registration.
• Assess each database against all Res. 47/2018 Annex I and II areas.
• Include service accounts, API keys and agent tokens in access reviews.
• Keep real personal data out of development, test and AI experimentation, or protect it equally.
• Maintain a documented incident procedure and incident register.
• Put security levels and confidentiality in every processor contract.
• Document an adequacy basis or express consent for every foreign transfer.
• Meet 10 calendar day access and five business day rectification deadlines.
• Track the reform bill and new AAIP resolutions.

Standards and references

• Infoleg: Ley 25.326 de Protección de los Datos Personales
• Infoleg: Decreto 1558/2001
• Argentina.gob.ar: AAIP Resolución 47/2018
• European Commission: Report on the first review of the functioning of the adequacy decisions
• Council of Europe: Argentina ratifies Convention 108+
• CERLATAM: AAIP Resoluciones 240 y 244 de 2022
• Marval O'Farrell Mairal: Argentina aprueba el Convenio 108+
• Diario Judicial: Proyecto de Ley de Protección de Datos Personales

This guide summarises Argentina's Law 25,326, Decree 1558/2001 and related AAIP resolutions as published by official sources at the date shown, and is not legal advice. Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Brazil LGPD Guide · Mexico Data Protection Law Guide · Breach Notification Laws by Country Guide