Privacy and public records in Paraguay: the cédula, credit data and the new data protection law

For a long time Paraguay was the odd one out in South America. It wrote habeas data into its constitution in 1992, among the first countries in the region to do so, yet it had no general personal data law. People relied on a constitutional action before a judge and, for credit files, on a specific law. That changed in November 2025, when Law 7593 was promulgated. Most of its rules are still in a transition period, so today's picture is a mix of old tools and new ones.

What follows is general information, not legal advice. For a specific dispute, a Paraguayan lawyer is the right next step.

Two numbers: the cédula and the RUC

The cédula de identidad (identity card) is issued by the Departamento de Identificaciones (identification department) of the Policía Nacional, the national police. Its number is the main personal identifier in Paraguay, asked for at banks, clinics and government offices.

The RUC (Registro Único del Contribuyente, single taxpayer registry) is the tax number. Since 2023 it has been managed by the DNIT (Dirección Nacional de Ingresos Tributarios, national tax revenue directorate), created by Law 7143 of 2023 by merging the SET (Subsecretaría de Estado de Tributación, the former tax undersecretariat) with the customs directorate. Older forms, receipts and websites still say SET, and both names refer to the same tax registry.

For an individual, the RUC is normally the cédula number followed by a check digit. Companies get a number of their own. That design has a privacy side effect: a sole trader's RUC reveals their ID number, and the DNIT publishes downloadable lists that pair RUC numbers with taxpayer names. The link between a self-employed person's name and their cédula number is, in effect, public.

So the number is not much of a secret. The card is what deserves protection. A photo of both sides of a cédula, together with a selfie, is exactly what an identity thief would want for opening accounts in someone else's name.

Habeas data: article 135 of the constitution

Article 135 of the 1992 constitution gives every person the right to access the information and data about themselves, or about their property, held in official records or in private records of a public nature, and to know how that information is used and for what purpose. It also lets them ask a competent judge to update, correct or destroy the data if it is wrong or unlawfully affects their rights.

Two features matter in practice:

• It is a court action. You file before a judge, usually with a lawyer, rather than with an agency.
• It covers private databases that serve the public, such as credit reporting files, not only government records.

The clause had a famous first test. On December 22, 1992, a habeas data request by human rights activist Martín Almada, acted on by judge José Agustín Fernández, led to a police building in Lambaré, near Asunción, where the security police files of the Stroessner dictatorship were found. That collection, known as the Archivo del Terror (Archives of Terror), is now kept at the Museo de la Justicia in the Palace of Justice, and UNESCO added it to its Memory of the World register in 2009.

Privacy kit

• NordPassCreates and stores a unique password for every account.Start with NordPass

Chosen from specifications, policies and published reviews; we have not tested these ourselves. More in the Privacy kit

Credit data: Law 6534 of 2020

Law 6534 de protección de datos personales crediticios (on the protection of personal credit data) was enacted in October 2020. It replaced the 2001 law on private information (Law 1682, amended twice), which had mainly governed credit reporting.

Under the 2020 law, companies that collect and sell credit information had to become licensed burós de información crediticia (credit information bureaus), supervised by the Banco Central del Paraguay (BCP, the central bank). The BCP set out the detailed rules in a 2023 regulation. The points that matter to an individual:

• You can see what a bureau holds about you, and the bureau rules say that access to your own file is free.
• You can ask for wrong or incomplete data to be corrected, and for data with no basis to be deleted.
• Negative information cannot stay in your file forever: the law sets a maximum of five years.

If a loan application is turned down, ask the lender which bureau it consulted, request your file from that bureau and dispute any error in writing. If the bureau does not fix it, complaints can go to the BCP and to SEDECO (Secretaría de Defensa del Consumidor y el Usuario, the consumer protection secretariat).

Law 7593 of 2025: the first general data protection law

Law 7593 de protección de datos personales (on personal data protection) was approved by the Chamber of Deputies in October 2025 and by the Senate in November, and promulgated in late November 2025. It applies to the public and private sectors alike.

• Rights. Access, rectification, objection, deletion and portability, plus the right to withdraw consent at any time. You also gain the right to know what data an organization holds, what it is used for, who receives it and how long it will be kept.
• Sensitive data. Biometric and genetic data, children's data, religious beliefs, political affiliation and sexual orientation get stronger protection.
• A regulator. The law creates the Agencia Nacional de Protección de Datos Personales (national personal data protection agency), a decentralized body within MITIC (Ministerio de Tecnologías de la Información y Comunicación, the information technology ministry), with functional autonomy and the power to inspect and sanction.
• Timing. Most obligations come with a two-year transition, so full application is expected around late November 2027. Until then, habeas data and the credit data law remain the main tools, and the details of how to file a complaint with the new agency are still to come.

The new law does not reduce government transparency. Law 5282 of 2014 on free access to public information and Law 5189 of 2014, which requires public bodies to publish what they pay their staff, still apply. If you work for the state in Paraguay, your name, position and salary are public by design.

Privacy kit

• NordPassCreates and stores a unique password for every account.Start with NordPass
• NordVPNEncrypts your connection on public Wi-Fi and hides your IP address from sites you visit.Start with NordVPN

Chosen from specifications, policies and published reviews; we have not tested these ourselves. More in the Privacy kit

Checking a Paraguayan company

The company side is more open than the personal side. A short routine:

1. Start with the RUC. The DNIT's free Cédula Tributaria, Constancia de RUC service shows the registered name and status and lets you download the certificate, with no login needed. Make sure the name matches the one on the invoice.
2. Know what paperwork to expect. A sociedad anónima (S.A., corporation) or sociedad de responsabilidad limitada (S.R.L., limited liability company) is formed by public deed, registered with the Dirección General de los Registros Públicos (public registries office, part of the judiciary) and must publish notice in newspapers. An Empresa por Acciones Simplificadas (EAS, simplified share company) is formed online through the SUACE (Sistema Unificado de Apertura y Cierre de Empresas, the one-stop system for opening and closing companies run by the Ministry of Industry and Commerce under Law 4986 of 2013), and needs neither a newspaper notice nor an entry in the Registro Público de Comercio (commercial registry). Do not hold a missing newspaper notice against an EAS.
3. Ask for documents. The bylaws, a recent registry certificate and proof of who can sign. For a large contract, a local escribano (notary) or lawyer can pull the registry records for you.
4. Match the money. The bank account holder should be the company on the contract, under the same RUC.

If you know Argentina, the RUC will feel familiar: it plays the role the CUIT plays there, which I explain in what a CUIT is. For Mexico, Chile and Colombia, see researching a company in Mexico, Chile and Colombia, and for Chile's own data rules, privacy and public records in Chile.

What to do with your own data, today

• Keep photos of your cédula off messaging apps, and send copies only to regulated institutions through their official channels.
• Check your credit file at the bureau a lender used, and dispute errors in writing. Keep the bureau's answer.
• For any other database, write to the holder first, naming the data and what you want done. Our request letter builder gives you a structure to translate into Spanish.
• If the holder refuses or ignores you, habeas data before a judge is the route, and a lawyer's help is worth it.
• Watch for the new agency's procedures as the transition ends in late 2027, because that is when complaints will have an administrative path.

Your next three steps

1. Write to the company with the request letter builder; it drafts a Spanish letter for Argentina.
2. Give tax and bank portals their own passwords; a manager such as NordPass keeps them apart.
3. Keep the reply and the date you sent the request.