---
title: "Argentina Data Protection & Privacy Regulation | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/argentina/
source_html: /jurisdictions/argentina/index.html
description: "Argentina data protection and privacy regulation: 10 categories, 83 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border…"
generated_at: 2026-11-07T14:58:19Z
content_sha256: b102447ac860ec42103fb07daaaff2fd1c1b62df5e7512277fe7ed328ad03597
generator: "fe-fleet/md-twin@1.0"
---
# Argentina Data Protection & Privacy Regulation

schema gdpri-v2
trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/argentina/), [World Payments](https://payments.gi/jurisdictions/argentina/), artificial-intelligence

Last updated 2026-10-25 · 10 categories · 83
claims · 46 sources in the cumulative register

Download report (PDF) Expand all

Argentina's data-protection regulator, the Agencia de Acceso a la Información Pública, is the control authority charged with applying Ley 25.326, the country's core data-protection statute, in force since 2000 to protect personal data recorded in files, registries or data banks, public or private, and to guarantee the right to honour, privacy and access to information.

Data collected 2026-10-25 · Data published 2026-10-25

AI-assembled from cited sources

Not fully checked this cycle: Regulator & Framework, Cross-Border & Adequacy (3 open gaps).

Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

[Open in Co-Pilot ↗](/reports/?type=copilot&j=ARGENTINA)[Build Report](/reports/?j=ARGENTINA)[Compare](/compare/?j=ARGENTINA)

Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified

Lead supervisory authority Agencia de Acceso a la Información Pública (AAIP) Primary statutory & supervisory perimeter

Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record

Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain

10 Categories

1 Red categories 57 Sub-modules

83 Claims

6 Tier-1 sources

Traffic-light mix 4 green 5 amber 1 red
(sums to 10 rendered categories; click to filter)

1 category flagged red

## Jurisdiction brief

Jurisdiction lead brief 864 Full executive summary 287

###### Latest update · 25 October 2026

#### Lead Signal

Argentina's data-protection framework rests on Ley 25.326, a statute now over two decades old, and the principal development this period is a reform bill drafted by the Agencia de Acceso a la Información Pública itself. Expediente 3397-D-2026, filed on 16 July 2026 by diputado Agustín Rossi, proposes a 72-article, 13-title replacement for Ley 25.326 and Ley 26.343. Among its provisions, Article 4 would extend the regime's territorial scope to controllers not established in Argentina who process data of persons located there, offer goods or services to them, or profile them, a test that goes beyond what has been independently verified of the current statute's own extraterritorial reach. The AAIP's own authorship of the bill is notable: the regulator that currently administers Ley 25.326 is itself the drafting hand behind its proposed successor, suggesting the reform responds to gaps the regulator has identified through its own administration of the existing law.

#### Other Developments

The Agencia de Acceso a la Información Pública remains the application authority for Ley 25.326. The AAIP was created under Ley 27.275 of 2016 and designated as the governing authority for Argentina's data-protection statute. This standing institutional position is unchanged this period; what is in motion is the substantive content of the law the AAIP administers, not the identity of the administering body itself.

#### Cross-Monitor Connections

A separate development reported this period, a Buenos Aires provincial bill that would mandate real-time facial biometric verification for online-betting accounts, touches identity-verification and biometric-processing questions that would ordinarily interest a national data-protection view, but that development is sectoral gambling legislation at the provincial level, is understood to have been assessed from the gambling-regulatory monitor's perspective, and is not treated here as a national data-protection-framework development.

#### Outlook

Expediente 3397-D-2026 has not reached floor debate and no timeline for Chamber of Deputies consideration is confirmed from the available evidence; the AAIP-drafted reform's progress through the legislature is the central marker to watch, since its 72-article scope and extraterritorial provision in Article 4 would, if enacted, represent the first substantial modernisation of Argentina's data-protection statute since Ley 25.326's original enactment. The pace of further reform bills also pending in the Chamber, alongside Expediente 3397-D-2026, is a further variable bearing on which text, if any, ultimately proceeds.

2 earlier updates not shown here.

###### Standing brief · as of 17 August 2026

Written before the update above. Where they differ, the update is the more recent position.

#### Lead Signal

Argentina's data-protection regulator, the Agencia de Acceso a la Información Pública, is the control authority charged with applying Ley 25.326, the country's core data-protection statute, in force since 2000 to protect personal data recorded in files, registries or data banks, public or private, and to guarantee the right to honour, privacy and access to information. Resolución AAIP 126/2024 modernised the agency's sanctions regime, indexing fines to a semi-annually updated 'unidad móvil' initially set at AR$100,000, in force from 1 June 2024, replacing the historically fixed statutory fine range. Separately, two pending reform bills — referred to as the Carro and Doñate proposals — propose introducing a data-portability right and a right to object to automated decisions that produce legal or significantly adverse effects; neither right currently exists under the statute, and neither bill has been enacted. Read together, an enforcement mechanism that has already been modernised sits alongside a substantive statute that remains, on these points, unchanged since 2000.

#### Other Developments

Commentary reviewing the current framework continues to note that Argentina's data-protection law lacks a mandatory Data Protection Impact Assessment requirement and contains no codified data-breach notification obligation to the regulator or to affected data subjects — standing gaps that the pending reform bills and the sanctions-regime update do not, on their own, close. On enforcement activity, the AAIP has previously sanctioned Rappi Arg S.A.S. for failing to respond in time to a data-subject deletion request; no fresh 2026-dated quantified sanction has been located this cycle. Ley 25.326 continues to prohibit the transfer of personal data to countries or international bodies that do not provide adequate levels of protection. Separately, Resolución AAIP 161/2023 continues to stand as the regulator's non-binding guidance on the use of artificial intelligence in the public and private sectors, operating within the existing data-protection framework rather than as separate binding law.

#### Cross-Monitor Connections

Argentina's cross-border transfer rules and the AAIP's AI guidance touch on data flows that may be of interest beyond this monitor. Readers tracking financial-sector compliance may want to follow how Argentina's cross-border transfer regime bears on financial data flows, a topic better developed on financial-integrity. Readers tracking digital-asset markets may want to follow how the same cross-border rules and AI guidance bear on exchange-related data processing, a topic better developed on crypto.

#### Outlook

The clearest near-term signal to watch is whether the pending reform bills move toward enactment; both remain pending and unenacted as of this cycle. Separately, watch for any fresh sanction decision under the newly indexed fine mechanism now in force. Until then, Argentina's operating environment combines a recently modernised enforcement mechanism with a substantive statute that remains, on data-portability, automated-decision rights, Data Protection Impact Assessment and breach-notification requirements, as it was in 2000.

Read full brief · 864 words

Standing brief, as of 17 August 2026.

#### Regulatory Status

Argentina's data-protection regime centres on Ley 25.326, administered by the Agencia de Acceso a la Información Pública as control authority. The statute protects personal data recorded in files, registries or data banks, public or private, to guarantee the right to honour, privacy and access to information, and has been in force since 2000. It continues to prohibit the transfer of personal data to countries or international bodies that do not provide adequate levels of protection. This cycle's material developments sit in enforcement and proposed reform: Resolución AAIP 126/2024 modernised the sanctions regime by indexing fines to a semi-annually updated 'unidad móvil' initially set at AR$100,000, in force from 1 June 2024, and two pending bills — the Carro and Doñate proposals — would introduce a data-portability right and a right to object to automated decisions producing legal or significantly adverse effects, neither of which currently exists in the statute. Structural gaps persist alongside these developments: the law lacks a mandatory Data Protection Impact Assessment requirement and contains no codified data-breach notification obligation to the regulator or to affected data subjects. Resolución AAIP 161/2023 remains the regulator's standing non-binding guidance on AI use in the public and private sectors. The AAIP has previously sanctioned Rappi Arg S.A.S. for failing to respond in time to a data-subject deletion request.

#### Outlook

Argentina's near-term trajectory combines a newly modernised enforcement mechanism with pending legislative proposals that would expand data-subject rights, while the Data Protection Impact Assessment and breach-notification gaps remain unaddressed in the current statute. Whether the Carro and Doñate bills advance, and whether the AAIP applies the new indexed-fine mechanism in a fresh sanction, are the two clearest signals to watch.

Read full brief · 287 words

Key regulatory facts for Argentina Regulatory Dimension Argentina Standing Position

Jurisdiction Argentina (AR)

Regulatory Scope Data Protection & Privacy Regulation (10 modules, 83 sourced findings)

Regulator & Framework Comprehensive, EU-adequacy-holding statute with an active, resourced supervisory authority; amber-tending risk only from the unsettled multi-bill reform pipeline.

Lawful Processing & Special Data Core lawful-basis and sensitive-data concepts exist but are narrower/less granular than GDPR-aligned peers, with material change only at proposal stage.

Data Subject Rights Core access/rectification/erasure rights are binding and judicially enforceable today; portability/ADM-objection rights remain at proposal stage only.

Controller/Processor Duties Foundational accountability tools exist mostly as non-binding guidance rather than statutory duties; binding DPIA/DPO/breach-notification obligations are pending, not yet in force.

Primary Instruments Cited IAPP, DataGuidance, IAPP, IAPP, IAPP

Last Confirmed / Updated 2026-10-25 (46 sources in cumulative register)

10 of 10 categories

Signal
Red
Amber
Green

Density
Comfortable
Compact

Expand all sources
Reset all

Selections OR within a group, AND across groups. Press / to search.

### Argentina: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Comprehensive, EU-adequacy-holding statute with an active, resourced supervisory authority; amber-tending risk only from the unsettled multi-bill reform pipeline.

Primary framework Ley 25.326 (Personal Data Protection Act) and Decreto 1558/2001

Supervisory authority [Agencia de Acceso a la Información Pública (AAIP)](https://www.argentina.gob.ar/aaip)

Traffic-light rationale — Green Comprehensive, EU-adequacy-holding statute with an active, resourced supervisory authority; amber-tending risk only from the unsettled multi-bill reform pipeline.

#### Sub-modules (5)

#### Regulator And AuthorityGreen

AAIP, an autarchic body with functional autonomy under the Jefatura de Gabinete de Ministros, is the applicable authority for Ley 25.326, the Access to Public Information Law 27.275, and the Do-Not-Call Registry Law 26.951.

Claims (5):

- The Agencia de Acceso a la Información Pública (AAIP) is the supervisory authority for the Personal Data Protection Act No. 25.326 in Argentina.
- Agencia de Acceso a la Información Pública (AAIP) — AAIP is the control authority and Autoridad de Aplicación of Ley 25.326.
- Agencia de Acceso a la Información Pública (AAIP) — Under Decreto 899/17 Art. 2, every regulatory reference to the former Dirección Nacional de Protección de Datos Personales must be understood as referring to the AAIP.
- AAIP is the application authority for Ley 25.326.
- AAIP is the statutory control and enforcement authority for Ley 25.326.

#### Act And InstrumentsGreen

Primary instruments are Ley 25.326 and Decreto 1558/2001 (amended by Decreto 1160/10), supplemented by numerous AAIP resolutions.

Claims (4):

- Ley 25.326 of 2000 together with Decreto 1558/2001 (amended by Decreto 1160/10) form the primary legal instruments governing data protection in Argentina.
- Bill 3397-D-2026 proposes a new DP regime replacing Ley 25.326.
- Ley N° 25.326 — Protects personal data recorded in files, registries or data banks, public or private, to guarantee the right to honour, privacy and access to information.
- AAIP Resolución 126/2024 grades Ley 25.326 infractions into three severity bands with corresponding fine ranges.

#### Material ScopeGreen

The Act and Decrees apply to both public and private-sector processing of personal data.

Claims (1):

- The Act and its implementing Decrees apply to both public and private organizations and to processing activities carried out in the territory of Argentina.

#### Territorial ScopeAmber

Current law applies to processing carried out within Argentine territory; pending reform bills would add express extraterritorial application to controllers/processors located abroad but targeting Argentine data subjects.

Claims (3):

- The Act and its implementing Decrees apply to both public and private organizations and to processing activities carried out in the territory of Argentina.
- A pending Congressional reform bill would expressly extend extraterritorial application of the data protection law to controllers/processors located outside Argentina where their processing targets Argentine data subjects.
- Pending bill Art. 4 would extend territorial scope extraterritorially.

#### Regulator Registration And FilingAmber

Under the current regime, controllers must register databases with AAIP (over 2,000 databases registered in 2022 alone); pending reform bills would eliminate this registration duty entirely.

Claims (4):

- Under the current regime, data controllers are required to register their databases with AAIP; 2,035 databases were registered in 2022 alone.
- Pending reform bills (Carro/Doñate, inspired by the AAIP anteproyecto) would eliminate the currently-in-force duty to register databases with the supervisory authority.
- Database registration with AAIP is a standing obligation.
- Ley 25.326 art. 21 requires registration of report-furnishing databases with AAIP's national registry.

Argentina's data-protection regime is anchored in Ley 25.326 (Personal Data Protection Act, 2000) and its implementing Decreto 1558/2001 (as amended by Decreto 1160/10). The Agencia de Acceso a la Información Pública (AAIP) is the supervisory authority, having absorbed the functions of the former Dirección Nacional de Protección de Datos Personales. The Act applies to public and private data processing carried out in Argentine territory and underpins the EU's 2003 adequacy finding. Two parallel legislative tracks (Carro/Doñate bills inspired by the AAIP's own anteproyecto, and the independently filed Yeza bill 1751-D-2026) are pending before Congress to replace the 25-year-old Act wholesale, including express extraterritorial scope and removal of the current database-registration duty.

Periodic update · new data 2026-10-25

#### Regulator & Framework

Argentina's data-protection framework is anchored in Ley 25.326, administered by the Agencia de Acceso a la Información Pública, which was created under Ley 27.275 in 2016 and designated as the application authority for the data-protection statute. This institutional architecture is unchanged this period. What has moved is the substantive reform agenda sitting above that architecture: Expediente 3397-D-2026, filed on 16 July 2026 by diputado Agustín Rossi, proposes a 72-article, 13-title replacement for both Ley 25.326 and Ley 26.343. The bill was drafted by the AAIP itself, which is a notable structural point, since it means the regulator administering the current statute is also the author of its proposed successor, implying the reform reflects gaps or limitations the AAIP has identified through its own enforcement and administration experience rather than an externally imposed legislative initiative.

Among the bill's provisions, Article 4 would extend the regime's territorial scope to controllers not established in Argentina who process the data of persons located there, who offer goods or services to those persons, or who profile them. This extraterritorial test, if enacted, would be a material expansion relative to the current statute, though the current statute's own extraterritorial reach has not been independently verified this period, so the degree of actual expansion cannot be precisely quantified. The bill is one of at least three pending reform proposals; it has been filed but has not reached floor debate in the Chamber of Deputies, and no enactment timeline is confirmed.

The broader significance for an operator or counsel tracking Argentina's regulatory trajectory is that this is now a live, regulator-authored reform process rather than a purely academic or civil-society-driven proposal, which may carry different legislative momentum than externally drafted bills have historically had in this area.

#### Outlook

The central marker to watch is whether Expediente 3397-D-2026 advances to committee consideration or floor debate in the Chamber of Deputies, and whether its extraterritorial Article 4 provision, along with the bill's broader 72-article scope, survives legislative process intact. Given the bill's AAIP authorship, its progress may also signal the regulator's own enforcement priorities for the remainder of the current statutory regime while reform is pending.

1 earlier distinct update(s) Periodic update · new data 2026-10-05

#### Regulator & Framework

Argentina's data-protection supervisory authority remains the Agencia de Acceso a la Informacion Publica (AAIP), which holds this competence under Ley 25.326 alongside a separate access-to-information mandate. The law also requires every person or entity that processes third-party personal data to register their databases with the AAIP's national registry as a condition of lawfulness, though compliance with that registration duty is reported to be widely incomplete among obliged entities.

This period's material development is the filing, on 16 July 2026, of expediente 3397-D-2026 by Diputado Rossi, a bill that would repeal both Ley 25.326 and Ley 26.343 and replace them with a new statutory framework. What sets this bill apart from other pending reform proposals is that it was elaborated by the AAIP itself, arising out of a public-consultation process the agency opened under Resolucion AAIP No. 119/22. The Rossi bill is not alone: it now sits alongside at least two other competing proposals before Congress, the Yeza bill (Proyecto 1751-D-2026) and a bill attributed to Carro and Donate, each addressing different gaps in the current regime. As of this period, none of the three bills has established committee traction, and none has been enacted. Until one does, the AAIP's supervisory role and the registration obligation under the existing Ley 25.326 continue to apply unchanged.

#### Outlook

The principal question going forward is which, if any, of the three competing reform bills gains committee momentum. The Rossi bill's direct lineage from an AAIP-led consultation process gives it a degree of institutional standing the other two proposals lack, but institutional origin alone does not determine legislative priority, and no committee assignment or hearing schedule has been established from sources reached this period. A resolution of this three-way contest, in either direction, would be the clearest signal of whether Argentina is moving toward a materially modernised data-protection statute or whether Ley 25.326 continues as the operative framework for the foreseeable future.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (16)
- [IAPP](https://iapp.org/news/a/nueva-autoridad-de-aplicacion-de-la-ley-de-proteccion-de-datos-personales-en-argentina) — The Agencia de Acceso a la Información Pública (AAIP) is the supervisory authority for the Personal Data Protection Act No. 25.326 in Argentina.
- [DataGuidance](https://www.dataguidance.com/jurisdiction/argentina) — Ley 25.326 of 2000 together with Decreto 1558/2001 (amended by Decreto 1160/10) form the primary legal instruments governing data protection in Argentina.
- [DataGuidance](https://www.dataguidance.com/jurisdiction/argentina) — The Act and its implementing Decrees apply to both public and private organizations and to processing activities carried out in the territory of Argentina.
- [IAPP](https://iapp.org/news/a/se-presento-ante-el-congreso-nacional-argentino-un-nuevo-proyecto-de-ley-para-reemplazar-la-actual-ley-de-proteccion-de-datos-personales) — A pending Congressional reform bill would expressly extend extraterritorial application of the data protection law to controllers/processors located outside Argentina where their processing targets Argentine data subjects.
- [IAPP](https://iapp.org/news/a/la-autoridad-de-proteccion-de-datos-de-argentina-publica-su-informe-anual-2022) — Under the current regime, data controllers are required to register their databases with AAIP; 2,035 databases were registered in 2022 alone.
- [IAPP](https://iapp.org/news/a/novedades-legislativas-en-argentina-sobre-protecci-n-de-datos-personales-e-inteligencia-artificial) — Pending reform bills (Carro/Doñate, inspired by the AAIP anteproyecto) would eliminate the currently-in-force duty to register databases with the supervisory authority.
- [Beccar Varela](https://beccarvarela.com/novedades/nuevo-proyecto-de-ley-de-proteccion-de-datos-personales/) — Bill 3397-D-2026 proposes a new DP regime replacing Ley 25.326.
- [Boletín Oficial de la República Argentina](https://www.boletinoficial.gob.ar/detalleAviso/primera/308122/20240524) — Agencia de Acceso a la Información Pública (AAIP) — AAIP is the control authority and Autoridad de Aplicación of Ley 25.326.
- [Argentina.gob.ar](https://www.argentina.gob.ar/normativa/nacional/ley-25326-64790/actualizacion) — Ley N° 25.326 — Protects personal data recorded in files, registries or data banks, public or private, to guarantee the right to honour, privacy and access to information.
- [Boletín Oficial de la República Argentina](https://www.boletinoficial.gob.ar/detalleAviso/primera/308122/20240524) — Agencia de Acceso a la Información Pública (AAIP) — Under Decreto 899/17 Art. 2, every regulatory reference to the former Dirección Nacional de Protección de Datos Personales must be understood as referring to the AAIP.
- [Wikipedia](https://en.wikipedia.org/wiki/National_Directorate_for_Personal_Data_Protection) — AAIP is the application authority for Ley 25.326.
- [Beccar Varela](https://beccarvarela.com/novedades/nuevo-proyecto-de-ley-de-proteccion-de-datos-personales/) — Pending bill Art. 4 would extend territorial scope extraterritorially.
- [https://foro.ar/articles/proteccion-datos-ley-25326](https://foro.ar/articles/proteccion-datos-ley-25326) — Database registration with AAIP is a standing obligation.
- [Argentina.gob.ar](https://www.argentina.gob.ar/normativa/nacional/ley-25326-64790/actualizacion) — AAIP is the statutory control and enforcement authority for Ley 25.326.
- [IAPP](https://iapp.org/news/a/se-impulsa-un-nuevo-proyecto-de-reforma-del-r-gimen-de-protecci-n-de-datos-en-argentina) — AAIP Resolución 126/2024 grades Ley 25.326 infractions into three severity bands with corresponding fine ranges.
- [Argentina.gob.ar / AAIP](https://www.argentina.gob.ar/aaip/datospersonales) — Ley 25.326 art. 21 requires registration of report-furnishing databases with AAIP's national registry.

### Argentina: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Core lawful-basis and sensitive-data concepts exist but are narrower/less granular than GDPR-aligned peers, with material change only at proposal stage.

Primary framework Ley 25.326, Arts. 5–7; Decreto 1558/2001

Supervisory authority [Agencia de Acceso a la Información Pública (AAIP)](https://www.argentina.gob.ar/aaip)

Traffic-light rationale — Amber Core lawful-basis and sensitive-data concepts exist but are narrower/less granular than GDPR-aligned peers, with material change only at proposal stage.

D2 · Lawful Processing — Full Module Record 4 sub-modules · 91 words · 4 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Argentina: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Core access/rectification/erasure rights are binding and judicially enforceable today; portability/ADM-objection rights remain at proposal stage only.

Primary framework Ley 25.326, Arts. 14–16; Constitución Nacional Art. 43 (habeas data)

Supervisory authority [Agencia de Acceso a la Información Pública (AAIP)](https://www.argentina.gob.ar/aaip)

Traffic-light rationale — Green Core access/rectification/erasure rights are binding and judicially enforceable today; portability/ADM-objection rights remain at proposal stage only.

#### Sub-modules (5)

#### Access RightGreen

Access is enforceable via habeas data, a constitutionally-entrenched simplified judicial procedure.

Claims (3):

- The Argentine Constitution provides a special, simplified and rapid judicial remedy known as 'habeas data' to protect personal data, elevating data protection to the status of a fundamental right.
- Habeas data is constitutionally anchored and judicially applied.
- Ley 25.326 art. 14 — free access to personal data once every six months

#### Rectification And ErasureGreen

Rectification/erasure rights are actively enforced; AAIP sanctioned Rappi for failing to act on an erasure request in time.

Claims (2):

- AAIP sanctioned Rappi Arg S.A.S. for failing to respond in due time and form to a data subject's request for erasure of personal data.
- A separate 2022 bill proposes a standalone 'right to be forgotten' requiring search-engine providers to implement an accessible electronic form for erasure requests, with a 10-business-day compliance window and judicial recourse for denial or inaccuracy.

#### Restriction And ObjectionAmber

Reform bills add an objection right against automated decisions producing legal or adverse effects; no current binding restriction/objection right beyond consent withdrawal identified.

Claims (1):

- Pending reform bills introduce new data-subject rights not present in the current Act, including data portability and objection to automated decisions producing legal effects or materially adversely affecting the data subject.

#### Data PortabilityRed

Portability is not part of the current Act; it is proposed in pending reform bills.

Claims (3):

- Pending reform bills introduce new data-subject rights not present in the current Act, including data portability and objection to automated decisions producing legal effects or materially adversely affecting the data subject.
- Carro / Doñate reform bills — The 2026 Carro and Doñate reform bills propose introducing a data-portability right and a right to object to automated decisions producing legal or significantly adverse effects.
- Pending reform bills (3397-D-2026, 1751-D-2026) — Data portability and a right to object to automated decisions with legal or significantly adverse effects, rights not currently codified in Ley 25.326.

#### Deadlines And Response WindowsAmber

Reform bills propose a non-extendable 10-business-day deadline to satisfy data-subject requests, criticized by commentators as impractical.

Claims (2):

- Pending reform bills propose a non-extendable 10-business-day deadline for controllers to satisfy data-subject rights requests, a timeframe criticized by commentators as difficult for the private sector to meet.
- A 5-day response window is reported but unverified against the statute.

Data subjects currently hold rights of information, access, rectification, updating, erasure and consent-withdrawal, enforceable through the constitutionally-entrenched 'habeas data' judicial remedy. Enforcement practice confirms erasure rights are actively policed (AAIP sanctioned Rappi for failing to honor a deletion request). Pending reform bills would add portability and a right to object to automated decisions with legal or materially adverse effect, alongside a proposed (contested) 10-business-day non-extendable response deadline; a separate 2022 bill would create a standalone 'right to be forgotten' against search engines.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (10)
- [EUR-Lex](https://eur-lex.europa.eu/legal-content/ES/TXT/HTML/?uri=CELEX%3A32003D0490&from=PT) — The Argentine Constitution provides a special, simplified and rapid judicial remedy known as 'habeas data' to protect personal data, elevating data protection to the status of a fundamental right.
- [IAPP](https://iapp.org/news/a/se-sanciona-a-una-empresa-por-no-atender-el-derecho-a-la-supresion-de-los-datos-personales) — AAIP sanctioned Rappi Arg S.A.S. for failing to respond in due time and form to a data subject's request for erasure of personal data.
- [IAPP](https://iapp.org/news/a/novedades-legislativas-en-argentina-sobre-protecci-n-de-datos-personales-e-inteligencia-artificial) — Pending reform bills introduce new data-subject rights not present in the current Act, including data portability and objection to automated decisions producing legal effects or materially adversely affecting the data subject.
- [IAPP](https://iapp.org/news/a/novedades-legislativas-en-argentina-sobre-protecci-n-de-datos-personales-e-inteligencia-artificial) — Pending reform bills propose a non-extendable 10-business-day deadline for controllers to satisfy data-subject rights requests, a timeframe criticized by commentators as difficult for the private sector to meet.
- [IAPP](https://iapp.org/news/a/se-presenta-un-nuevo-proyecto-de-ley-sobre-el-derecho-al-olvido-en-el-congreso-nacional-de-argentina) — A separate 2022 bill proposes a standalone 'right to be forgotten' requiring search-engine providers to implement an accessible electronic form for erasure requests, with a 10-business-day compliance window and judicial recourse for denial or inaccuracy.
- [IAPP](https://iapp.org/news/a/novedades-legislativas-en-argentina-sobre-protecci-n-de-datos-personales-e-inteligencia-artificial) — Carro / Doñate reform bills — The 2026 Carro and Doñate reform bills propose introducing a data-portability right and a right to object to automated decisions producing legal or significantly adverse effects.
- [IAPP](https://iapp.org/news/a/novedades-legislativas-en-argentina-sobre-protecci-n-de-datos-personales-e-inteligencia-artificial) — Pending reform bills (3397-D-2026, 1751-D-2026) — Data portability and a right to object to automated decisions with legal or significantly adverse effects, rights not currently codified in Ley 25.326.
- [BossBot](https://bossbot.uk/blog/chatfuel-alternativa-ar) — Habeas data is constitutionally anchored and judicially applied.
- [BossBot](https://bossbot.uk/blog/chatfuel-alternativa-ar) — Ley 25.326 art. 14 — free access to personal data once every six months
- [oficioia.app](https://oficioia.app/guias/proteccion-datos-personales-latam) — A 5-day response window is reported but unverified against the statute.

### Argentina: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Foundational accountability tools exist mostly as non-binding guidance rather than statutory duties; binding DPIA/DPO/breach-notification obligations are pending, not yet in force.

Primary framework Ley 25.326; AAIP Resolución 47/2018 (recommended security measures); AAIP DPIA Guide

Supervisory authority [Agencia de Acceso a la Información Pública (AAIP)](https://www.argentina.gob.ar/aaip)

Traffic-light rationale — Amber Foundational accountability tools exist mostly as non-binding guidance rather than statutory duties; binding DPIA/DPO/breach-notification obligations are pending, not yet in force.

D4 · Controller & Processor — Full Module Record 7 sub-modules · 83 words · 13 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Argentina: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Adequacy-holding jurisdiction with an active, modernizing transfer-mechanism toolkit (BCRs, dual SCC regimes); no TIA or localisation mandate identified.

Primary framework Ley 25.326, Art. 12; AAIP Resolución 198/2023 (SCC RIPD); Resolución 159/2018 (BCR guidelines)

Supervisory authority [Agencia de Acceso a la Información Pública (AAIP)](https://www.argentina.gob.ar/aaip)

Traffic-light rationale — Green Adequacy-holding jurisdiction with an active, modernizing transfer-mechanism toolkit (BCRs, dual SCC regimes); no TIA or localisation mandate identified.

D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 79 words · 9 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Argentina: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Health and financial overlays are well-documented and active; employment, credit-scoring, education and insurance sub-modules carry no substantiated findings.

Primary framework Ley 25.326; Ley 26.529 (Patient Rights); Ley 27.553 (Telemedicine); Ley 26.951 (No Llame); BCRA cybersecurity regulations

Supervisory authority [Agencia de Acceso a la Información Pública (AAIP)](https://www.argentina.gob.ar/aaip)

Traffic-light rationale — Amber Health and financial overlays are well-documented and active; employment, credit-scoring, education and insurance sub-modules carry no substantiated findings.

D6 · Sectoral Watch — Full Module Record 7 sub-modules · 70 words · 3 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Argentina: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾

Only direct marketing (telemarketing) is substantiated; five of six sub-modules carry no evidenced Argentine-specific regime.

Primary framework Ley 26.951 (Registro Nacional No Llame); Ley 25.326

Supervisory authority [Agencia de Acceso a la Información Pública (AAIP)](https://www.argentina.gob.ar/aaip)

Traffic-light rationale — Red Only direct marketing (telemarketing) is substantiated; five of six sub-modules carry no evidenced Argentine-specific regime.

D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 56 words · 1 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Argentina: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Existing binding guidance (Resolución 4/2019) covers automated processing/video surveillance; the more comprehensive ADM-objection right and facial-recognition-specific regime remain at bill stage.

Primary framework AAIP Resolución 4/2019; pending Facial Recognition Bill (Yeza); pending LPDP reform bills

Supervisory authority [Agencia de Acceso a la Información Pública (AAIP)](https://www.argentina.gob.ar/aaip)

Traffic-light rationale — Amber Existing binding guidance (Resolución 4/2019) covers automated processing/video surveillance; the more comprehensive ADM-objection right and facial-recognition-specific regime remain at bill stage.

D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 99 words · 10 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Argentina: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Binding coverage of children's data exists only via soft-law guidance (Resolución 4/2019); dedicated statutory minor-protection provisions remain at proposal stage, and three of five sub-modules are unsubstantiated.

Primary framework AAIP Resolución 4/2019; pending LPDP reform bills

Supervisory authority [Agencia de Acceso a la Información Pública (AAIP)](https://www.argentina.gob.ar/aaip)

Traffic-light rationale — Amber Binding coverage of children's data exists only via soft-law guidance (Resolución 4/2019); dedicated statutory minor-protection provisions remain at proposal stage, and three of five sub-modules are unsubstantiated.

D9 · Children's Privacy — Full Module Record 5 sub-modules · 59 words · 3 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Argentina: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Regulator is demonstrably active with a documented inspection/sanction track record and a judicially-enforceable private remedy; amber-tending on funding/capacity and collective-redress sub-modules, which are unsubstantiated.

Primary framework Ley 25.326, Art. 31; AAIP Resolución 332/2020 (Guía de Fiscalización); Constitución Nacional Art. 43 (habeas data)

Supervisory authority [Agencia de Acceso a la Información Pública (AAIP)](https://www.argentina.gob.ar/aaip)

Traffic-light rationale — Green Regulator is demonstrably active with a documented inspection/sanction track record and a judicially-enforceable private remedy; amber-tending on funding/capacity and collective-redress sub-modules, which are unsubstantiated.

Periodic update · new data 2026-09-28

#### Enforcement & Redress

Argentina's legislative reform picture escalated this cycle with the introduction of a third distinct comprehensive data-protection reform bill. On 16 July 2026, Deputy Agustin Rossi introduced expediente 3397-D-2026 in the Chamber of Deputies. The bill proposes a new comprehensive data-protection regime and would repeal both Ley 25.326, the operative statute, and Ley 26.343. Notably, the bill substantially reproduces the text of a bill originally drafted by the AAIP itself and circulated in June 2023, suggesting continuity of substantive policy content across what is otherwise a change in legislative sponsor and vehicle.

This joins expediente 1751-D-2026, proposed by Deputy Martin Yeza and reported previously, which sets out an entirely fresh 72-article regime organised across 13 titles and would expressly repeal both the current statute and its implementing regulations. Between these two bills and the underlying June 2023 AAIP proposal that expediente 3397-D-2026 substantially reproduces, Argentina's Congress now has multiple, only partially overlapping, comprehensive reform vehicles under simultaneous consideration. Neither bill has advanced to enactment, and neither has been reported as having secured committee approval or a floor vote timeline.

Separately, on the existing enforcement infrastructure, the Agencia de Acceso a la Informacion Publica maintains a public Registro de Infractores de las leyes 25.326 y 26.951, together with a formal electronic voluntary-payment mechanism, described variously as VEP, QR, or Boleta de Pago, for the payment of assessed fines. This is a standing enforcement-transparency mechanism under the current regime and represents no change this cycle, but it underscores that the current AAIP enforcement apparatus, however dated the substantive statute it enforces may be considered by reform proponents, continues to operate with a functioning public transparency and payment-collection infrastructure.

The overall picture for enforcement and redress in Argentina this cycle is therefore one of legislative escalation layered on top of a stable, functioning, if dated, enforcement infrastructure: the AAIP continues to operate its existing enforcement tools under Ley 25.326 without interruption, while the legislative branch pursues, in parallel, at least two and arguably three distinct paths toward eventually replacing that statute altogether.

#### Outlook

With three broadly comprehensive reform proposals now in play, expediente 3397-D-2026, expediente 1751-D-2026, and the AAIP's own June 2023 text that the former substantially reproduces, the near-term question is not whether reform will eventually occur but which vehicle, if any, gains legislative traction first. Watch for committee assignment or hearing scheduling on either numbered expediente, or for any move to consolidate the competing texts into a single bill, as the clearest indicators of which reform path is gaining momentum.

D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 149 words · 14 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

## GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped).

Show article map GDPR article to category mapping Article Category Sub-module

Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases

Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds

Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories

Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability

Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency

Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements

Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements

Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures

Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification

Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification

Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted

Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs

Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs

Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions

Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties

Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties