Argentina's personal data law (Law 25.326), explained for non-lawyers

Argentina put a privacy remedy into its constitution before it had a data protection law. The 1994 constitutional reform added a third paragraph to article 43 that lets any person go to court to learn what data about them sits in public registers or databanks, or in private ones meant to supply reports, and what that data is used for. If it is false or discriminatory, the same paragraph lets the person demand that it be deleted, corrected, kept confidential or updated. The action is called hábeas data (a court action to see and correct data held about you), and it shapes everything that came after.

Six years later Congress passed Law 25.326, the Personal Data Protection Law. It was sanctioned on October 4, 2000 and published in the Boletín Oficial (the official gazette) on November 2, 2000, and Decree 1558/2001 regulated it at the end of 2001. Two attempts to replace it have stalled, so it is still the law in force as I write this. The full text is on the government's legal portal, in Spanish. This is general information, not legal advice, and the section on going to court says when to bring in a lawyer.

What the law protects, and whose data

Article 1 sets the aim as the full protection of personal data held in files, registers, databanks or other technical means, public ones and private ones "intended to supply reports," so as to guarantee people's honor and privacy and their access to what is recorded about them. That phrase about reports is wider than it sounds: Decree 1558/2001 reads it as any database that goes beyond purely personal use, or that exists to pass data on, whether or not anyone pays. Two details in that article surprise readers from other countries. The law applies, where relevant, to data about legal entities as well as people, so a company has some of the same rights over information about it. And it expressly leaves journalistic databases and sources alone.

Article 2 defines personal data as information of any kind about identified or identifiable persons. It sets apart datos sensibles (sensitive data): racial and ethnic origin, political opinions, religious, philosophical or moral convictions, union membership, and information about health or sexual life.

The general principles sit in articles 4 to 10. Data must be accurate, adequate and relevant to the purpose it was collected for. It cannot be gathered by unfair means or used for an incompatible purpose, and it must be destroyed once it is no longer needed. Whoever holds it must keep it secure (article 9) and confidential (article 10). Article 7 adds two strong rules: nobody can be forced to provide sensitive data, and records of criminal or misdemeanor history may be processed only by the competent public authorities.

Consent, and the exceptions that matter in practice

Article 5 opens with a firm rule: processing personal data is unlawful without the person's free, express and informed consent, in writing or an equivalent form. Article 6 adds that whoever collects data must first tell you the purpose, who may receive it, who holds it, whether answering is mandatory, and what your rights of access and correction are.

Then article 5 lists five situations where consent is not needed:

1. The data comes from sources open to the public without restriction.
2. It is collected for the state's own functions or under a legal obligation.
3. It is a list limited to name, national identity document number, tax or social security identification, occupation, date of birth and address.
4. It arises from a contractual, scientific or professional relationship with the person and is needed to carry that relationship out.
5. It concerns operations of financial institutions and information they receive from customers under article 39 of Law 21.526, the financial institutions law.

The third exception explains a lot of what circulates in Argentina. A list with your name, your DNI (Documento Nacional de Identidad, the national ID number), your CUIT or CUIL (tax and labor identification numbers), your occupation, your date of birth and your address can be processed without asking you. That does not make those numbers harmless, and it does not lift the holder's other duties: the data still has to be accurate, used for a legitimate purpose, and open to your requests. Our page on what a CUIT is explains why a person's tax number is personal data and why we never publish anyone's.

Article 11 applies the same logic to cesión (passing data to a third party). It needs your consent, which you can withdraw, except in the same situations and a few others. Article 12 bars international transfers to countries or bodies that do not offer adequate protection, with exceptions such as judicial cooperation and bank transfers.

Your rights, with the clocks that run on them

A few points the table cannot hold.

The access deadline in article 14 is diez días corridos, ten calendar days, and it runs from when the holder has been formally notified in a way you can prove. That proof matters. The AAIP, the enforcement agency described below, recommends sending requests in writing, by post with proof of receipt or delivered in person, so you have evidence of the date. Our data request letter builder gives you a starting structure; for Argentina, cite article 14 for access or article 16 for correction and deletion, and file the proof of delivery with a copy of the letter.

The answer has to be usable: article 15 requires plain language, no codes, and the whole record about you, not only the part you asked about.

The correction deadline in article 16 is cinco días hábiles, five business days. While the holder checks your claim, it must either block the record or flag that it is under review whenever it supplies information from it. If it had passed the data to someone else, it must tell that recipient about the correction or deletion within five business days.

Deletion has limits. Article 16 says it does not apply where it would harm the legitimate rights or interests of third parties, or where there is a legal duty to keep the data. A lender cannot be made to forget a loan it is legally required to document.

Credit reporting has its own regime in article 26. Credit information services may use financial data from public sources, from you, or from creditors about whether you paid. They can keep data relevant to your solvency for five years, cut to two years once you pay or otherwise settle the debt, and at your request they must tell you what information and assessments about you they shared in the previous six months.

Who enforces it

Article 29 calls for an órgano de control (control body). Decree 1558/2001 created the National Directorate for Personal Data Protection, inside the Ministry of Justice, for that job. In 2017, Decree 746/2017 moved the role to the Agencia de Acceso a la Información Pública (AAIP, the Agency for Access to Public Information), which Law 27.275 on access to public information had created the year before. The AAIP is the authority you turn to today.

In practice the AAIP:

• takes denuncias (complaints) about breaches of the law, and the government's complaint page explains the steps;
• keeps the national registry of databases, because article 21 requires public databases, and private ones intended to supply reports, to register;
• runs the Registro Nacional No Llame, the national do-not-call registry created by Law 26.951 in 2014, whose violations carry the sanctions of Law 25.326;
• can impose the administrative sanctions in article 31, from a warning to fines, suspension and closure of a database.

The AAIP's rights page, in Spanish, explains each right in plain terms and offers request templates.

The law also reaches into the Penal Code. Article 32 added an article 117 bis that punishes knowingly inserting false data into a personal data file, with a heavier penalty for knowingly giving a third party false information from such a file.

Hábeas data in court, and when to bring in a lawyer

If the holder ignores you or answers badly, articles 33 to 43 set out the court action. It can be brought to learn what data a public databank, or a private one intended to supply reports, holds about you and why, and to demand correction, deletion, confidentiality or updating when that data is false, inaccurate, out of date, or of a kind the law prohibits. You can file it yourself or through a representative, guardians can file for those in their care, and close relatives can file after a death. The Defensor del Pueblo (the national ombudsman) may join the case.

The action follows the fast procedure of the amparo (a summary action to protect constitutional rights). A judge can order the disputed record provisionally blocked when it is plainly false or discriminatory, and a private databank cannot refuse to hand over information by claiming confidentiality, except to protect journalistic sources.

A complaint to the AAIP is an administrative route. A hábeas data action is a lawsuit: the written claim has to identify the database, explain why the data is false, inaccurate or discriminatory, and show that you already tried the request route. That is the point to talk to a lawyer or a legal aid service, especially when the data is costing you a job, a loan or a rental.

Why Europe calls Argentina "adequate"

On June 30, 2003, the European Commission adopted Decision 2003/490/EC, finding that Argentina provides an adequate level of protection for personal data sent from the European Union. The decision rests on the constitution, Law 25.326 and Decree 1558/2001, and it singles out hábeas data as a special, quick judicial remedy. In practical terms, European companies can send personal data to Argentina without the extra transfer safeguards they would need for most other countries.

In January 2024 the Commission published its first review of eleven older adequacy decisions and concluded that Argentina still provides adequate protection. The review pointed to the AAIP's independence as a supervisory authority and to Argentina's ratification of Convention 108+, the Council of Europe's modernized data protection treaty, which Congress approved in 2022 through Law 27.699. It also noted that the data protection bill before Congress could consolidate those developments.

The bills that would replace it

Law 25.326 predates social networks and smartphones as we know them, and governments have tried twice to replace it. In September 2018 the executive branch sent Congress a bill to repeal and replace it, adding features such as a right to data portability and data protection officers. It did not become law. In June 2023 the executive sent a new bill, drafted by the AAIP after a public consultation, to the Chamber of Deputies. As of this writing it has not been passed, so the 2000 law, its 2001 decree and the AAIP's rules still govern.

Questions readers ask

Is a list with my name, DNI and address legal?

Often, yes. Article 5 allows lists limited to name, national ID, tax or social security number, occupation, date of birth and address without consent. The holder still owes you access within ten calendar days and correction within five business days, and if the list is used for advertising, article 27 lets you demand removal or blocking at any time.

Can I make a company delete everything it has on me?

Not always. Article 16 lets the holder refuse where deletion would harm third parties' legitimate interests or where the law requires it to keep the data. It can never charge you for correcting or deleting inaccurate data (article 19).

How does this compare with the United States?

There is no single US equivalent. The closest federal law for reports about people is the Fair Credit Reporting Act, which applies only to reports used for decisions such as credit, jobs and housing; I explained where that line falls for people-search sites. Law 25.326 starts from the other end: consent is the rule, and almost any database beyond purely personal use owes you access and correction, whatever the data is used for.

The one thing to remember: put your request in writing, keep proof of the date, and count. Ten calendar days for access, five business days for a correction. When the clock runs out without a proper answer, the law opens two doors, a complaint to the AAIP or a hábeas data action in court.