Data Protection Monitor
Global Privacy & Data Protection Intelligence

Argentina Data Protection & Privacy Regulation

AR schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: Sentinel (AML/CFT), World Payments, artificial-intelligence

Last updated · 10 categories · 83 claims · 46 sources in the cumulative register

Argentina's data-protection regulator, the Agencia de Acceso a la Información Pública, is the control authority charged with applying Ley 25.326, the country's core data-protection statute, in force since 2000 to protect personal data recorded in files, registries or data banks, public or private, and to guarantee the right to honour, privacy and access to information.

Data collected Data published

AI-assembled from cited sources

Not fully checked this cycle: Regulator & Framework, Cross-Border & Adequacy (3 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureRegulated (omnibus)10 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityAgencia de Acceso a la Información Pública (AAIP)Primary statutory & supervisory perimeter
Next milestone (> 2026-10-26)None scheduledNo dated future statutory milestone on record
Module coverage & confidence10 / 10 modules assessed0 Confirmed · 10 Probable · 0 Uncertain

Jurisdiction brief

Latest update · 25 October 2026

Lead Signal

Argentina's data-protection framework rests on Ley 25.326, a statute now over two decades old, and the principal development this period is a reform bill drafted by the Agencia de Acceso a la Información Pública itself. Expediente 3397-D-2026, filed on 16 July 2026 by diputado Agustín Rossi, proposes a 72-article, 13-title replacement for Ley 25.326 and Ley 26.343. Among its provisions, Article 4 would extend the regime's territorial scope to controllers not established in Argentina who process data of persons located there, offer goods or services to them, or profile them, a test that goes beyond what has been independently verified of the current statute's own extraterritorial reach. The AAIP's own authorship of the bill is notable: the regulator that currently administers Ley 25.326 is itself the drafting hand behind its proposed successor, suggesting the reform responds to gaps the regulator has identified through its own administration of the existing law.

Key regulatory facts for Argentina
Regulatory DimensionArgentina Standing Position
JurisdictionArgentina (AR)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 83 sourced findings)
Regulator & FrameworkComprehensive, EU-adequacy-holding statute with an active, resourced supervisory authority; amber-tending risk only from the unsettled multi-bill reform pipeline.
Lawful Processing & Special DataCore lawful-basis and sensitive-data concepts exist but are narrower/less granular than GDPR-aligned peers, with material change only at proposal stage.
Data Subject RightsCore access/rectification/erasure rights are binding and judicially enforceable today; portability/ADM-objection rights remain at proposal stage only.
Controller/Processor DutiesFoundational accountability tools exist mostly as non-binding guidance rather than statutory duties; binding DPIA/DPO/breach-notification obligations are pending, not yet in force.
Primary Instruments CitedIAPP, DataGuidance, IAPP, IAPP, IAPP
Last Confirmed / Updated2026-10-25 (46 sources in cumulative register)

#

Comprehensive, EU-adequacy-holding statute with an active, resourced supervisory authority; amber-tending risk only from the unsettled multi-bill reform pipeline.

Primary frameworkLey 25.326 (Personal Data Protection Act) and Decreto 1558/2001
Supervisory authorityAgencia de Acceso a la Información Pública (AAIP)
Traffic-light rationale — GreenComprehensive, EU-adequacy-holding statute with an active, resourced supervisory authority; amber-tending risk only from the unsettled multi-bill reform pipeline.

Sub-modules (5)

Regulator And AuthorityGreen

AAIP, an autarchic body with functional autonomy under the Jefatura de Gabinete de Ministros, is the applicable authority for Ley 25.326, the Access to Public Information Law 27.275, and the Do-Not-Call Registry Law 26.951.

Claims (5):

  • The Agencia de Acceso a la Información Pública (AAIP) is the supervisory authority for the Personal Data Protection Act No. 25.326 in Argentina.
  • Agencia de Acceso a la Información Pública (AAIP) — AAIP is the control authority and Autoridad de Aplicación of Ley 25.326.
  • Agencia de Acceso a la Información Pública (AAIP) — Under Decreto 899/17 Art. 2, every regulatory reference to the former Dirección Nacional de Protección de Datos Personales must be understood as referring to the AAIP.
  • AAIP is the application authority for Ley 25.326.
  • AAIP is the statutory control and enforcement authority for Ley 25.326.

Act And InstrumentsGreen

Primary instruments are Ley 25.326 and Decreto 1558/2001 (amended by Decreto 1160/10), supplemented by numerous AAIP resolutions.

Claims (4):

  • Ley 25.326 of 2000 together with Decreto 1558/2001 (amended by Decreto 1160/10) form the primary legal instruments governing data protection in Argentina.
  • Bill 3397-D-2026 proposes a new DP regime replacing Ley 25.326.
  • Ley N° 25.326 — Protects personal data recorded in files, registries or data banks, public or private, to guarantee the right to honour, privacy and access to information.
  • AAIP Resolución 126/2024 grades Ley 25.326 infractions into three severity bands with corresponding fine ranges.

Material ScopeGreen

The Act and Decrees apply to both public and private-sector processing of personal data.

Claims (1):

  • The Act and its implementing Decrees apply to both public and private organizations and to processing activities carried out in the territory of Argentina.

Territorial ScopeAmber

Current law applies to processing carried out within Argentine territory; pending reform bills would add express extraterritorial application to controllers/processors located abroad but targeting Argentine data subjects.

Claims (3):

  • The Act and its implementing Decrees apply to both public and private organizations and to processing activities carried out in the territory of Argentina.
  • A pending Congressional reform bill would expressly extend extraterritorial application of the data protection law to controllers/processors located outside Argentina where their processing targets Argentine data subjects.
  • Pending bill Art. 4 would extend territorial scope extraterritorially.

Regulator Registration And FilingAmber

Under the current regime, controllers must register databases with AAIP (over 2,000 databases registered in 2022 alone); pending reform bills would eliminate this registration duty entirely.

Claims (4):

  • Under the current regime, data controllers are required to register their databases with AAIP; 2,035 databases were registered in 2022 alone.
  • Pending reform bills (Carro/Doñate, inspired by the AAIP anteproyecto) would eliminate the currently-in-force duty to register databases with the supervisory authority.
  • Database registration with AAIP is a standing obligation.
  • Ley 25.326 art. 21 requires registration of report-furnishing databases with AAIP's national registry.
Category narrative 111 words

Argentina's data-protection regime is anchored in Ley 25.326 (Personal Data Protection Act, 2000) and its implementing Decreto 1558/2001 (as amended by Decreto 1160/10). The Agencia de Acceso a la Información Pública (AAIP) is the supervisory authority, having absorbed the functions of the former Dirección Nacional de Protección de Datos Personales. The Act applies to public and private data processing carried out in Argentine territory and underpins the EU's 2003 adequacy finding. Two parallel legislative tracks (Carro/Doñate bills inspired by the AAIP's own anteproyecto, and the independently filed Yeza bill 1751-D-2026) are pending before Congress to replace the 25-year-old Act wholesale, including express extraterritorial scope and removal of the current database-registration duty.

Periodic update · new data 2026-10-25

Regulator & Framework

Argentina's data-protection framework is anchored in Ley 25.326, administered by the Agencia de Acceso a la Información Pública, which was created under Ley 27.275 in 2016 and designated as the application authority for the data-protection statute. This institutional architecture is unchanged this period. What has moved is the substantive reform agenda sitting above that architecture: Expediente 3397-D-2026, filed on 16 July 2026 by diputado Agustín Rossi, proposes a 72-article, 13-title replacement for both Ley 25.326 and Ley 26.343. The bill was drafted by the AAIP itself, which is a notable structural point, since it means the regulator administering the current statute is also the author of its proposed successor, implying the reform reflects gaps or limitations the AAIP has identified through its own enforcement and administration experience rather than an externally imposed legislative initiative.

Among the bill's provisions, Article 4 would extend the regime's territorial scope to controllers not established in Argentina who process the data of persons located there, who offer goods or services to those persons, or who profile them. This extraterritorial test, if enacted, would be a material expansion relative to the current statute, though the current statute's own extraterritorial reach has not been independently verified this period, so the degree of actual expansion cannot be precisely quantified. The bill is one of at least three pending reform proposals; it has been filed but has not reached floor debate in the Chamber of Deputies, and no enactment timeline is confirmed.

The broader significance for an operator or counsel tracking Argentina's regulatory trajectory is that this is now a live, regulator-authored reform process rather than a purely academic or civil-society-driven proposal, which may carry different legislative momentum than externally drafted bills have historically had in this area.

Outlook

The central marker to watch is whether Expediente 3397-D-2026 advances to committee consideration or floor debate in the Chamber of Deputies, and whether its extraterritorial Article 4 provision, along with the bill's broader 72-article scope, survives legislative process intact. Given the bill's AAIP authorship, its progress may also signal the regulator's own enforcement priorities for the remainder of the current statutory regime while reform is pending.

1 earlier distinct update(s)
Periodic update · new data 2026-10-05

Regulator & Framework

Argentina's data-protection supervisory authority remains the Agencia de Acceso a la Informacion Publica (AAIP), which holds this competence under Ley 25.326 alongside a separate access-to-information mandate. The law also requires every person or entity that processes third-party personal data to register their databases with the AAIP's national registry as a condition of lawfulness, though compliance with that registration duty is reported to be widely incomplete among obliged entities.

This period's material development is the filing, on 16 July 2026, of expediente 3397-D-2026 by Diputado Rossi, a bill that would repeal both Ley 25.326 and Ley 26.343 and replace them with a new statutory framework. What sets this bill apart from other pending reform proposals is that it was elaborated by the AAIP itself, arising out of a public-consultation process the agency opened under Resolucion AAIP No. 119/22. The Rossi bill is not alone: it now sits alongside at least two other competing proposals before Congress, the Yeza bill (Proyecto 1751-D-2026) and a bill attributed to Carro and Donate, each addressing different gaps in the current regime. As of this period, none of the three bills has established committee traction, and none has been enacted. Until one does, the AAIP's supervisory role and the registration obligation under the existing Ley 25.326 continue to apply unchanged.

Outlook

The principal question going forward is which, if any, of the three competing reform bills gains committee momentum. The Rossi bill's direct lineage from an AAIP-led consultation process gives it a degree of institutional standing the other two proposals lack, but institutional origin alone does not determine legislative priority, and no committee assignment or hearing schedule has been established from sources reached this period. A resolution of this three-way contest, in either direction, would be the clearest signal of whether Argentina is moving toward a materially modernised data-protection statute or whether Ley 25.326 continues as the operative framework for the foreseeable future.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (16)
  1. Confirmed IAPP — The Agencia de Acceso a la Información Pública (AAIP) is the supervisory authority for the Personal Data Protection Act No. 25.326 in Argentina. observed
  2. Confirmed DataGuidance — Ley 25.326 of 2000 together with Decreto 1558/2001 (amended by Decreto 1160/10) form the primary legal instruments governing data protection in Argentina. observed
  3. Confirmed DataGuidance — The Act and its implementing Decrees apply to both public and private organizations and to processing activities carried out in the territory of Argentina. observed
  4. Probable IAPP — A pending Congressional reform bill would expressly extend extraterritorial application of the data protection law to controllers/processors located outside Argentina where their processing targets Argentine data subjects. observed
  5. Confirmed IAPP — Under the current regime, data controllers are required to register their databases with AAIP; 2,035 databases were registered in 2022 alone. observed
  6. Probable IAPP — Pending reform bills (Carro/Doñate, inspired by the AAIP anteproyecto) would eliminate the currently-in-force duty to register databases with the supervisory authority. observed
  7. Probable Beccar Varela — Bill 3397-D-2026 proposes a new DP regime replacing Ley 25.326. observed
  8. High Boletín Oficial de la República Argentina — Agencia de Acceso a la Información Pública (AAIP) — AAIP is the control authority and Autoridad de Aplicación of Ley 25.326. observed
  9. High Argentina.gob.ar — Ley N° 25.326 — Protects personal data recorded in files, registries or data banks, public or private, to guarantee the right to honour, privacy and access to information. observed
  10. Confirmed Boletín Oficial de la República Argentina — Agencia de Acceso a la Información Pública (AAIP) — Under Decreto 899/17 Art. 2, every regulatory reference to the former Dirección Nacional de Protección de Datos Personales must be understood as referring to the AAIP. observed
  11. Probable Wikipedia — AAIP is the application authority for Ley 25.326. observed
  12. Probable Beccar Varela — Pending bill Art. 4 would extend territorial scope extraterritorially. observed
  13. Uncertain https://foro.ar/articles/proteccion-datos-ley-25326 — Database registration with AAIP is a standing obligation.
  14. Probable Argentina.gob.ar — AAIP is the statutory control and enforcement authority for Ley 25.326. observed
  15. Probable IAPP — AAIP Resolución 126/2024 grades Ley 25.326 infractions into three severity bands with corresponding fine ranges. observed
  16. Probable Argentina.gob.ar / AAIP — Ley 25.326 art. 21 requires registration of report-furnishing databases with AAIP's national registry. observed

#

Core lawful-basis and sensitive-data concepts exist but are narrower/less granular than GDPR-aligned peers, with material change only at proposal stage.

Primary frameworkLey 25.326, Arts. 5–7; Decreto 1558/2001
Supervisory authorityAgencia de Acceso a la Información Pública (AAIP)
Traffic-light rationale — AmberCore lawful-basis and sensitive-data concepts exist but are narrower/less granular than GDPR-aligned peers, with material change only at proposal stage.
D2 · Lawful Processing — Full Module Record4 sub-modules · 91 words · 4 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Core access/rectification/erasure rights are binding and judicially enforceable today; portability/ADM-objection rights remain at proposal stage only.

Primary frameworkLey 25.326, Arts. 14–16; Constitución Nacional Art. 43 (habeas data)
Supervisory authorityAgencia de Acceso a la Información Pública (AAIP)
Traffic-light rationale — GreenCore access/rectification/erasure rights are binding and judicially enforceable today; portability/ADM-objection rights remain at proposal stage only.

Sub-modules (5)

Access RightGreen

Access is enforceable via habeas data, a constitutionally-entrenched simplified judicial procedure.

Claims (3):

  • The Argentine Constitution provides a special, simplified and rapid judicial remedy known as 'habeas data' to protect personal data, elevating data protection to the status of a fundamental right.
  • Habeas data is constitutionally anchored and judicially applied.
  • Ley 25.326 art. 14 — free access to personal data once every six months

Rectification And ErasureGreen

Rectification/erasure rights are actively enforced; AAIP sanctioned Rappi for failing to act on an erasure request in time.

Claims (2):

  • AAIP sanctioned Rappi Arg S.A.S. for failing to respond in due time and form to a data subject's request for erasure of personal data.
  • A separate 2022 bill proposes a standalone 'right to be forgotten' requiring search-engine providers to implement an accessible electronic form for erasure requests, with a 10-business-day compliance window and judicial recourse for denial or inaccuracy.

Restriction And ObjectionAmber

Reform bills add an objection right against automated decisions producing legal or adverse effects; no current binding restriction/objection right beyond consent withdrawal identified.

Claims (1):

  • Pending reform bills introduce new data-subject rights not present in the current Act, including data portability and objection to automated decisions producing legal effects or materially adversely affecting the data subject.

Data PortabilityRed

Portability is not part of the current Act; it is proposed in pending reform bills.

Claims (3):

  • Pending reform bills introduce new data-subject rights not present in the current Act, including data portability and objection to automated decisions producing legal effects or materially adversely affecting the data subject.
  • Carro / Doñate reform bills — The 2026 Carro and Doñate reform bills propose introducing a data-portability right and a right to object to automated decisions producing legal or significantly adverse effects.
  • Pending reform bills (3397-D-2026, 1751-D-2026) — Data portability and a right to object to automated decisions with legal or significantly adverse effects, rights not currently codified in Ley 25.326.

Deadlines And Response WindowsAmber

Reform bills propose a non-extendable 10-business-day deadline to satisfy data-subject requests, criticized by commentators as impractical.

Claims (2):

  • Pending reform bills propose a non-extendable 10-business-day deadline for controllers to satisfy data-subject rights requests, a timeframe criticized by commentators as difficult for the private sector to meet.
  • A 5-day response window is reported but unverified against the statute.
Category narrative 82 words

Data subjects currently hold rights of information, access, rectification, updating, erasure and consent-withdrawal, enforceable through the constitutionally-entrenched 'habeas data' judicial remedy. Enforcement practice confirms erasure rights are actively policed (AAIP sanctioned Rappi for failing to honor a deletion request). Pending reform bills would add portability and a right to object to automated decisions with legal or materially adverse effect, alongside a proposed (contested) 10-business-day non-extendable response deadline; a separate 2022 bill would create a standalone 'right to be forgotten' against search engines.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (10)
  1. Confirmed EUR-Lex — The Argentine Constitution provides a special, simplified and rapid judicial remedy known as 'habeas data' to protect personal data, elevating data protection to the status of a fundamental right. observed
  2. Confirmed IAPP — AAIP sanctioned Rappi Arg S.A.S. for failing to respond in due time and form to a data subject's request for erasure of personal data. observed
  3. Probable IAPP — Pending reform bills introduce new data-subject rights not present in the current Act, including data portability and objection to automated decisions producing legal effects or materially adversely affecting the data subject. observed
  4. Probable IAPP — Pending reform bills propose a non-extendable 10-business-day deadline for controllers to satisfy data-subject rights requests, a timeframe criticized by commentators as difficult for the private sector to meet. observed
  5. Probable IAPP — A separate 2022 bill proposes a standalone 'right to be forgotten' requiring search-engine providers to implement an accessible electronic form for erasure requests, with a 10-business-day compliance window and judicial recourse for denial or inaccuracy. observed
  6. High IAPP — Carro / Doñate reform bills — The 2026 Carro and Doñate reform bills propose introducing a data-portability right and a right to object to automated decisions producing legal or significantly adverse effects. observed
  7. Uncertain IAPP — Pending reform bills (3397-D-2026, 1751-D-2026) — Data portability and a right to object to automated decisions with legal or significantly adverse effects, rights not currently codified in Ley 25.326. observed
  8. Probable BossBot — Habeas data is constitutionally anchored and judicially applied. observed
  9. Probable BossBot — Ley 25.326 art. 14 — free access to personal data once every six months observed
  10. Uncertain oficioia.app — A 5-day response window is reported but unverified against the statute. observed

#

Foundational accountability tools exist mostly as non-binding guidance rather than statutory duties; binding DPIA/DPO/breach-notification obligations are pending, not yet in force.

Primary frameworkLey 25.326; AAIP Resolución 47/2018 (recommended security measures); AAIP DPIA Guide
Supervisory authorityAgencia de Acceso a la Información Pública (AAIP)
Traffic-light rationale — AmberFoundational accountability tools exist mostly as non-binding guidance rather than statutory duties; binding DPIA/DPO/breach-notification obligations are pending, not yet in force.
D4 · Controller & Processor — Full Module Record7 sub-modules · 83 words · 13 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Adequacy-holding jurisdiction with an active, modernizing transfer-mechanism toolkit (BCRs, dual SCC regimes); no TIA or localisation mandate identified.

Primary frameworkLey 25.326, Art. 12; AAIP Resolución 198/2023 (SCC RIPD); Resolución 159/2018 (BCR guidelines)
Supervisory authorityAgencia de Acceso a la Información Pública (AAIP)
Traffic-light rationale — GreenAdequacy-holding jurisdiction with an active, modernizing transfer-mechanism toolkit (BCRs, dual SCC regimes); no TIA or localisation mandate identified.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 79 words · 9 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Health and financial overlays are well-documented and active; employment, credit-scoring, education and insurance sub-modules carry no substantiated findings.

Primary frameworkLey 25.326; Ley 26.529 (Patient Rights); Ley 27.553 (Telemedicine); Ley 26.951 (No Llame); BCRA cybersecurity regulations
Supervisory authorityAgencia de Acceso a la Información Pública (AAIP)
Traffic-light rationale — AmberHealth and financial overlays are well-documented and active; employment, credit-scoring, education and insurance sub-modules carry no substantiated findings.
D6 · Sectoral Watch — Full Module Record7 sub-modules · 70 words · 3 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Only direct marketing (telemarketing) is substantiated; five of six sub-modules carry no evidenced Argentine-specific regime.

Primary frameworkLey 26.951 (Registro Nacional No Llame); Ley 25.326
Supervisory authorityAgencia de Acceso a la Información Pública (AAIP)
Traffic-light rationale — RedOnly direct marketing (telemarketing) is substantiated; five of six sub-modules carry no evidenced Argentine-specific regime.
D7 · AdTech & Marketing — Full Module Record6 sub-modules · 56 words · 1 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Existing binding guidance (Resolución 4/2019) covers automated processing/video surveillance; the more comprehensive ADM-objection right and facial-recognition-specific regime remain at bill stage.

Primary frameworkAAIP Resolución 4/2019; pending Facial Recognition Bill (Yeza); pending LPDP reform bills
Supervisory authorityAgencia de Acceso a la Información Pública (AAIP)
Traffic-light rationale — AmberExisting binding guidance (Resolución 4/2019) covers automated processing/video surveillance; the more comprehensive ADM-objection right and facial-recognition-specific regime remain at bill stage.
D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 99 words · 10 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Binding coverage of children's data exists only via soft-law guidance (Resolución 4/2019); dedicated statutory minor-protection provisions remain at proposal stage, and three of five sub-modules are unsubstantiated.

Primary frameworkAAIP Resolución 4/2019; pending LPDP reform bills
Supervisory authorityAgencia de Acceso a la Información Pública (AAIP)
Traffic-light rationale — AmberBinding coverage of children's data exists only via soft-law guidance (Resolución 4/2019); dedicated statutory minor-protection provisions remain at proposal stage, and three of five sub-modules are unsubstantiated.
D9 · Children's Privacy — Full Module Record5 sub-modules · 59 words · 3 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Regulator is demonstrably active with a documented inspection/sanction track record and a judicially-enforceable private remedy; amber-tending on funding/capacity and collective-redress sub-modules, which are unsubstantiated.

Primary frameworkLey 25.326, Art. 31; AAIP Resolución 332/2020 (Guía de Fiscalización); Constitución Nacional Art. 43 (habeas data)
Supervisory authorityAgencia de Acceso a la Información Pública (AAIP)
Traffic-light rationale — GreenRegulator is demonstrably active with a documented inspection/sanction track record and a judicially-enforceable private remedy; amber-tending on funding/capacity and collective-redress sub-modules, which are unsubstantiated.
Periodic update · new data 2026-09-28

Enforcement & Redress

Argentina's legislative reform picture escalated this cycle with the introduction of a third distinct comprehensive data-protection reform bill. On 16 July 2026, Deputy Agustin Rossi introduced expediente 3397-D-2026 in the Chamber of Deputies. The bill proposes a new comprehensive data-protection regime and would repeal both Ley 25.326, the operative statute, and Ley 26.343. Notably, the bill substantially reproduces the text of a bill originally drafted by the AAIP itself and circulated in June 2023, suggesting continuity of substantive policy content across what is otherwise a change in legislative sponsor and vehicle.

This joins expediente 1751-D-2026, proposed by Deputy Martin Yeza and reported previously, which sets out an entirely fresh 72-article regime organised across 13 titles and would expressly repeal both the current statute and its implementing regulations. Between these two bills and the underlying June 2023 AAIP proposal that expediente 3397-D-2026 substantially reproduces, Argentina's Congress now has multiple, only partially overlapping, comprehensive reform vehicles under simultaneous consideration. Neither bill has advanced to enactment, and neither has been reported as having secured committee approval or a floor vote timeline.

Separately, on the existing enforcement infrastructure, the Agencia de Acceso a la Informacion Publica maintains a public Registro de Infractores de las leyes 25.326 y 26.951, together with a formal electronic voluntary-payment mechanism, described variously as VEP, QR, or Boleta de Pago, for the payment of assessed fines. This is a standing enforcement-transparency mechanism under the current regime and represents no change this cycle, but it underscores that the current AAIP enforcement apparatus, however dated the substantive statute it enforces may be considered by reform proponents, continues to operate with a functioning public transparency and payment-collection infrastructure.

The overall picture for enforcement and redress in Argentina this cycle is therefore one of legislative escalation layered on top of a stable, functioning, if dated, enforcement infrastructure: the AAIP continues to operate its existing enforcement tools under Ley 25.326 without interruption, while the legislative branch pursues, in parallel, at least two and arguably three distinct paths toward eventually replacing that statute altogether.

Outlook

With three broadly comprehensive reform proposals now in play, expediente 3397-D-2026, expediente 1751-D-2026, and the AAIP's own June 2023 text that the former substantially reproduces, the near-term question is not whether reform will eventually occur but which vehicle, if any, gains legislative traction first. Watch for committee assignment or hearing scheduling on either numbered expediente, or for any move to consolidate the competing texts into a single bill, as the clearest indicators of which reform path is gaining momentum.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 149 words · 14 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 83 claim(s) (83 category placement(s)), 46 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 3 Nov 2026: not upheld (22 confirmed against the cited source; 2 contradicted by the cited source; 8 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsaccess right
Art. 14Data Subject Rightsaccess right
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrestriction and objection
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy granted
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacytransfer mechanisms
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 82Enforcement & Redressprivate right of action
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties