The framework
Law No. 7593/2025 on Personal Data Protection is on the books in Paraguay without yet being fully enforceable, a gap between enactment and operation that defines the current compliance picture.
That puts Paraguay in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Law No. 7593/2025 on Personal Data Protection
Paraguay promulgated its first comprehensive data protection law, Law No. 7593/2025, on 27 November 2025. It enters into force 24 months after publication, in late November 2027, and creates a national agency under the ICT ministry; until then the operative rules remain the 2020 credit-data law.
Marketing and advertising
GDPR-influenced consent and legal bases under the new law; until it applies, only the 2020 credit-data law (Law 6534/2020) is operative. That single sentence decides most channel plans here.
Cross-border transfers
The new law brings adequacy and safeguard mechanisms for transfers abroad when it applies in late 2027.
Enforcement and penalties
The new law provides for administrative fines once it applies in late 2027.