Argentina

Argentina's data-protection regime is anchored in Ley 25.326 (Personal Data Protection Act, 2000) and its implementing Decreto 1558/2001 (as amended by Decreto 1160/10). The Agencia de Acceso a la Información Pública (AAIP) is the supervisory authority, having absorbed the functions of the former Dirección Nacional de Protección de Datos Personales. The Act applies to public and private data processing carried out in Argentine territory and underpins the EU's 2003 adequacy finding. Two parallel legislative tracks (Carro/Doñate bills inspired by the AAIP's own anteproyecto, and the independently filed Yeza bill 1751-D-2026) are pending before Congress to replace the 25-year-old Act wholesale, including express extraterritorial scope and removal of the current database-registration duty.

Consent is the near-exclusive lawful basis under the current Act, a point the pending Yeza reform bill explicitly seeks to broaden by introducing six alternative bases (consent, contract performance, legal obligation, vital interests, public interest, legitimate interest — the last expressly covering AI-model training subject to a balancing test). Special/sensitive data ('datos sensibles') are already regulated, with AAIP soft-law (Resolución 255/2022) addressing genetic data specifically; reform proposals would broaden the definition to expressly include gender identity, genetic and biometric data. Pseudonymisation/anonymisation are not substantively addressed in the current Act or Decree.

Data subjects currently hold rights of information, access, rectification, updating, erasure and consent-withdrawal, enforceable through the constitutionally-entrenched 'habeas data' judicial remedy. Enforcement practice confirms erasure rights are actively policed (AAIP sanctioned Rappi for failing to honor a deletion request). Pending reform bills would add portability and a right to object to automated decisions with legal or materially adverse effect, alongside a proposed (contested) 10-business-day non-extendable response deadline; a separate 2022 bill would create a standalone 'right to be forgotten' against search engines.

The current Act imposes no DPIA or DPO obligation, though AAIP soft-law (a non-binding DPIA Guide and Resolución 47/2018 recommended security measures) fills part of the gap. There is no general legal duty to notify data breaches today — reporting is 'best practice' only — but AAIP has fined controllers (e.g., Cencosud) for failing to take recommended breach-prevention/notification steps. Pending reform bills would introduce a mandatory DPO figure and a 72-hour breach-notification duty to both AAIP and affected data subjects, mirroring GDPR-style timelines.

Argentina received an EU Commission adequacy decision in 2003 — one of the earliest such findings — which remains in effect. The domestic Act prohibits transfers to jurisdictions lacking adequate protection unless the data subject consents or contractual/self-regulatory safeguards apply. AAIP has actively expanded transfer tooling: Binding Corporate Rules guidance (Resolución 159/2018) and, more recently, adoption of the Red Iberoamericana de Protección de Datos Standard Contractual Clauses (Resolución 198/2023), which coexist with Argentina's own earlier model clauses (Disposición 60-E/2016).

Sectoral overlays are most developed in health (telemedicine/digital prescriptions must comply with both the LPDP and the Patient Rights Law 26.529, with sensitive-data confidentiality duties for health professionals) and in the Central Bank's (BCRA) cybersecurity regulations for financial-sector data. Telemarketing/direct-communications are separately regulated under the Do-Not-Call Registry Law 26.951, recently updated via Resolución 126/2024. No sector-specific findings were substantiated for employment data, credit/scoring, education, or insurance within the sources reviewed.

Direct marketing is the only well-substantiated sub-module: the Do-Not-Call Registry (Ley 26.951) plus AAIP enforcement (fines against FCA Automobiles Argentina and Telefónica Móviles Argentina for unsolicited telemarketing) evidence an active suppression/consent regime for telephone marketing. No dedicated cookie/tracker consent law, dark-pattern prohibition, GPC-style opt-out-signal recognition, clean-room rules, or CPRA-style cross-context 'sale/share' framework were identified for Argentina.

AAIP's Resolución 4/2019 already provides mandatory guidelines covering video surveillance and automated data processing, and AAIP has stood up a dedicated Transparency and Protection of Personal Data Program addressing AI. The most granular near-term development is deputy Yeza's dedicated facial-recognition bill, which would require a prior impact assessment and AAIP authorization before deployment for public-security purposes, expressly ban mass surveillance/routine tracking of non-suspects, and mandate human oversight of automated identifications — explicitly modeled on EU AI Act standards. Separately, the broader LPDP reform bills would add a right to object to automated decisions with legal or materially adverse effect.

The current Act does not refer to children at all; AAIP's Resolución 4/2019 fills part of the gap by requiring consent for processing children's data. Pending reform bills would specifically regulate minors' personal data, generally treating consent given by persons aged 16 or older as valid. No substantiated findings were located for minor-profiling bans, education-settings-specific rules, or dependent-adult protections.

AAIP exercises active investigative and sanctioning powers under its Guía de Fiscalización (Resolución 332/2020), including planned and spontaneous inspections and the ability to seek judicial authorization when a subject fails to cooperate. Current sanctions are set under Article 31 of the LPDP; a pending reform (mirrored in both the AAIP-drafted bill and other Congressional projects) would substantially raise the ceiling — fines expressed in movable accounting units up to one million units, and in the AAIP version alternatively graduated at 2–4% of the infringer's global annual turnover. 2022 enforcement data show 491 complaint files opened (up 27% year-on-year) and 63 resolutions issued, 52 of them sanctionatory. The constitutionally-entrenched habeas data remedy affords a private right of action independent of AAIP's administrative process. Recent 180-day developments include the Carro and Doñate reform bills (Feb 2026) and the independently-filed Yeza bill 1751-D-2026 (June 2026), none of which have yet been enacted.