Skip to content
AI Policy Generator

ESWhat applies

Argentina · Law

Personal Data Protection Law 25,326

In forceLaw 25,326

Summary

This is the general personal data law, from 2000. It requires informed consent, database registration and security measures and restricts transfers to countries without adequate protection. It bars court or administrative acts that assess behavior from relying solely on automated profiles. It has no AI-specific rules; the AAIP supplements it with resolutions and a guide.

Who it applies to

Public and private individuals and organizations that process personal data in Argentina.

Penalties

Warning, suspension, fine, closure or cancellation of the database (art. 31). AAIP Res. 126/2024 classifies violations, scales fines, allows a 50% discount for payment within 20 business days and can order mandatory training.

Official name
Ley 25.326 de Protección de los Datos Personales
Official reference
Boletín Oficial 2-nov-2000; reglamentada por el Decreto 1558/2001; régimen de infracciones y sanciones actualizado por la Res. AAIP 126/2024 (B.O. 24-may-2024)
Regulator
Agency for Access to Public Information (AAIP)
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Informed consent and prior noticeLey 25.326, arts. 5 y 6In forceAlready applicableIf you process personal data in Argentina, including in AI systems.Verified in the official source on November 2, 2026
Database registration with the AAIPLey 25.326, art. 21In forceAlready applicableIf you keep personal databases; the law requires it for public ones and private ones meant to provide reports, and the AAIP has read it broadly.Pending confirmation in the official source (last checked: November 4, 2026)
Security and confidentiality measuresLey 25.326, arts. 9 y 10In forceAlready applicableIf you process personal data.Verified in the official source on November 2, 2026
International data transfersLey 25.326, art. 12In forceAlready applicableIf you send personal data to vendors or companies outside Argentina, such as cloud AI services.Verified in the official source on November 2, 2026
Right of access within 10 calendar daysLey 25.326, arts. 14 a 16In forceAlready applicableIf you process personal data.Verified in the official source on November 2, 2026
Behavior assessments not based solely on automated profilesLey 25.326, art. 20In forceAlready applicableIf you are a public body or supply systems that support administrative acts assessing people's behavior.Verified in the official source on November 2, 2026

Informed consent and prior notice

Ley 25.326, arts. 5 y 6In force

Already applicable

When it relates
If you process personal data in Argentina, including in AI systems.
What the rule provides
  • Obtain free, express and informed consent, except under the exceptions in art. 5(2).
  • Before collecting data, disclose the purpose, recipients and how to exercise rights; include AI uses.
Typical evidence
  • Privacy policy and consent wording.
Verification
Verified in the official source on November 2, 2026Articles checked in the consolidated InfoLEG text (Law 25,326). The AAIP Res. 126/2024 regime (Official Bulletin May 24, 2024, in force June 1, 2024) was taken from secondary sources (Beccar Varela, Marval, Bruchou).

Database registration with the AAIP

Ley 25.326, art. 21In force

Already applicable

When it relates
If you keep personal databases; the law requires it for public ones and private ones meant to provide reports, and the AAIP has read it broadly.
What the rule provides
  • Register databases with controller, purpose, data types, recipients, security measures and retention periods.
  • Do not hold data other than what was declared; update the registration when an AI system adds data or purposes.
Typical evidence
  • Registration certificate.
  • Inventory of databases and purposes.
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Article 21 text checked in InfoLEG. How the AAIP applies registration to private databases that do not report to third parties is still unconfirmed in an official source: it depends on agency practice.

Security and confidentiality measures

Ley 25.326, arts. 9 y 10In force

Already applicable

When it relates
If you process personal data.
What the rule provides
  • Adopt technical and organizational measures to protect data, including data sent to AI tools.
  • Keep everyone handling the data bound by confidentiality.
Typical evidence
  • Security policy and incident log.
Related base documents
Supporting documents
Verification
Verified in the official source on November 2, 2026Articles checked in the consolidated InfoLEG text (Law 25,326). The AAIP Res. 126/2024 regime (Official Bulletin May 24, 2024, in force June 1, 2024) was taken from secondary sources (Beccar Varela, Marval, Bruchou).

International data transfers

Ley 25.326, art. 12In force

Already applicable

When it relates
If you send personal data to vendors or companies outside Argentina, such as cloud AI services.
What the rule provides
  • Transfer only to countries with adequate protection, or with contractual safeguards (AAIP-approved model clauses) or consent, except under art. 12 exceptions.
  • Document country, vendor and mechanism for each flow.
Typical evidence
  • Signed transfer agreements.
Verification
Verified in the official source on November 2, 2026Articles checked in the consolidated InfoLEG text (Law 25,326). The AAIP Res. 126/2024 regime (Official Bulletin May 24, 2024, in force June 1, 2024) was taken from secondary sources (Beccar Varela, Marval, Bruchou).

Right of access within 10 calendar days

Ley 25.326, arts. 14 a 16In force

Already applicable

When it relates
If you process personal data.
What the rule provides
  • Answer access requests within 10 calendar days and correction or deletion requests within the legal deadlines.
Typical evidence
  • Log of requests and responses.
Related base documents
Verification
Verified in the official source on November 2, 2026Articles checked in the consolidated InfoLEG text (Law 25,326). The AAIP Res. 126/2024 regime (Official Bulletin May 24, 2024, in force June 1, 2024) was taken from secondary sources (Beccar Varela, Marval, Bruchou).

Behavior assessments not based solely on automated profiles

Ley 25.326, art. 20In force

Already applicable

When it relates
If you are a public body or supply systems that support administrative acts assessing people's behavior.
What the rule provides
  • Do not base court decisions or administrative acts that assess human behavior solely on a profile produced by automated processing; such acts are void.
  • Ensure real, documented human involvement.
Typical evidence
  • Human oversight procedure.
Verification
Verified in the official source on November 2, 2026Articles checked in the consolidated InfoLEG text (Law 25,326). The AAIP Res. 126/2024 regime (Official Bulletin May 24, 2024, in force June 1, 2024) was taken from secondary sources (Beccar Varela, Marval, Bruchou).

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)