Personal data protection in Argentina: Law 25.326 compliance for businesses

Key rules

1. Legal architecture

1.1 The core norms

1.2 AAIP and DNPDP resolutions that matter to businesses

Note on the commonly cited pointers. some secondary summaries listed "Disp. 7/2005 updated" as the sanctions rule. That disposition was updated by Disp. 9/2015 and then by AAIP Res. 240/2022 (BO 5 December 2022), but AAIP Res. 126/2024 art. 8 repealed Disp. 7/2005 and Res. 240/2022 with effect from 1 June 2024. Res. 126/2024 is now the sanctions rule. Res. 4/2019 is confirmed, but it is an interpretive criteria resolution, not a transfer rule. Res. 47/2018 is confirmed as the security measures resolution. Law 27.483 and Law 27.699 are confirmed as the approvals of Convention 108 and of the amending Protocol.

1.3 Related rules outside the data protection statute

2. Scope: who and what is covered

2.1 Personal data and who is protected

"Personal data" is information of any kind referring to natural persons or legal entities that are identified or identifiable (art. 2). Argentina is unusual in protecting companies as data subjects: the law applies "as far as relevant" to data about legal persons (art. 1, second paragraph). A data subject (titular de los datos) is any natural person, or any legal entity with a legal domicile, branch or delegation in Argentina, whose data are processed (art. 2).

"Processing" (tratamiento) covers systematic operations, electronic or not, from collection and storage to evaluation, blocking, destruction and communication to third parties (art. 2). Paper files are covered.

Data are not personal if they have been anonymised ("disociación", art. 2). AAIP Res. 4/2019 Criterion 3 adds that a person is not "identifiable" if identification would require disproportionate or unviable measures or time.

2.2 Which databases

The law applies to public databases and to private databases "intended to provide reports" (art. 1). Decree 1558/2001 Annex I art. 1 reads that phrase broadly: it covers any database that exceeds exclusively personal use, and any database whose purpose is to assign or transfer personal data, whether for payment or free. In practice almost every business database (customers, employees, suppliers, leads, CCTV) is in scope. The AAIP website gives "addresses of friends on a personal computer" and "personal diaries" as examples of excluded personal use.

Chapters I to IV of the law and art. 32 are of public order and apply throughout the country. Federal jurisdiction applies to databases interconnected in interjurisdictional, national or international networks (art. 44).

Foreign controllers. The law has no express extraterritorial clause like GDPR art. 3. The AAIP registration page says that persons who process data of people in Argentina but are not established in the country "must register" and offers a form for them (AAIP website, Trámites ante el Registro Nacional de Bases de Datos Personales). This is an administrative position on the AAIP website, not a rule found in the statute or decree (unconfirmed).

2.3 Exclusions

• Journalistic databases and sources (art. 1, third paragraph).
• Opinion polls, statistics under Law 17.622, market research and scientific or medical research, as long as data cannot be attributed to an identified or identifiable person (art. 28.1). If anonymity is not possible, a dissociation technique must be used (art. 28.2).
• Purely personal use (Decree 1558/2001 Annex I art. 1).

3. Key principles and rules with article cites

3.1 Principles

3.2 Consent and its exceptions

Processing is unlawful unless the data subject has given free, express and informed consent, in writing or by a medium that can be treated as equivalent according to the circumstances (art. 5.1). When consent is given together with other declarations, it must appear expressly and prominently (art. 5.1). Informed consent means the data subject received the article 6 information in a form adapted to their social and cultural level (Decree 1558/2001 Annex I art. 5). Consent can be revoked at any time, without retroactive effect (same article). Whatever form of consent is used, the controller must be able to prove that the person who consented was really the data subject, so it needs effective identity validation (AAIP Res. 4/2019 Criterion 5).

Consent is not needed when the data (art. 5.2):

Practical meaning. Processing customer data to deliver a contracted service relies on art. 5.2.d. Marketing, profiling beyond the contract, sharing with third parties for their own purposes and most analytics need consent or another specific basis. Marketing has its own regime (section 8).

Minors. Under the principle of progressive autonomy in CCyC arts. 26 and 639, a minor may consent according to their maturity. If the minor lacks capacity, a parent or guardian consents and the controller must make reasonable efforts to verify this (AAIP Res. 4/2019 Criterion 5).

3.3 Information to be given at collection (privacy notice)

Before collecting data, the controller must tell the data subject, expressly and clearly (art. 6):

a) the purpose and the recipients or classes of recipients; b) the existence of the database and the identity and address of the controller; c) whether answers are mandatory or optional, especially for sensitive data; d) the consequences of providing data, refusing, or giving inaccurate data; e) the right of access, rectification and deletion.

AAIP Res. 14/2018 art. 2 requires this information to be displayed clearly in a visible place before collection, with special mention of how to exercise rights. Art. 3 requires the following sentence (in Spanish) in addition: "LA AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales."

Failure to give art. 6 information is a serious infraction (Res. 126/2024 Annex I 2.d). Failing to disclose the controller's legal domicile and identity when processing data on the internet, both to the register and in the privacy policy, is very serious if it hampers rights or supervision (Annex I 3.a).

3.4 Sensitive data

Sensitive data are data revealing racial and ethnic origin, political opinions, religious, philosophical or moral convictions, union membership, and information about health or sexual life (art. 2). The rules are strict (art. 7):

• No one can be forced to provide sensitive data (art. 7.1).
• Sensitive data may be collected and processed only for reasons of general interest authorised by law, or for statistical or scientific purposes when data subjects cannot be identified (art. 7.2).
• Databases that directly or indirectly reveal sensitive data are prohibited, except membership registers of the Catholic Church, religious associations, and political and union organisations (art. 7.3).
• Criminal records may be processed only by competent public authorities (art. 7.4).
• Health establishments and health professionals may process patients' health data under professional secrecy (art. 8).

How strict is this in practice? Read literally, art. 7.2 does not list consent as a basis for processing sensitive data. The AAIP's own sanctions rule, however, treats as very serious "collecting and processing sensitive data without the consent of the data subject, reasons of general interest authorised by law, or for statistical or scientific purposes without proper anonymisation" (Res. 126/2024 Annex I 3.i). The sanctions rule therefore implies that consent is an accepted basis. This tension between the statute and the AAIP's reading is unresolved in the sources reviewed. A cautious business should rely on a specific legal authorisation where one exists (for example, employer health obligations under labour and occupational risk laws (unconfirmed)) and obtain express, separate, informed consent otherwise.

Biometrics. Biometric data are data from specific technical processing of physical, physiological or behavioural characteristics that allow or confirm unique identification. They are sensitive only when they can reveal additional data whose use may be discriminatory, for example ethnic origin or health (AAIP Res. 4/2019 Criterion 4). A fingerprint clock in the workplace is therefore not automatically sensitive data, but it is still personal data subject to consent or a contractual basis.

Genetic data. Genetic data are sensitive when they uniquely identify a person and reveal health or physiological information or could be used to discriminate; higher security is required (AAIP Res. 255/2022 art. 2).

Health data in marketing. Health data may be used for offers of goods and services only if obtained lawfully, without discrimination, within a relationship between consumer and health provider or non profit entity, and may not be transferred to third parties without prior, express and informed consent after a clear warning that the data are sensitive (Decree 1558/2001 Annex I art. 27).

3.5 Disclosure to third parties (cesión)

Personal data may be disclosed to a third party only for purposes directly related to the legitimate interest of both parties and with the data subject's prior consent, after informing them of the purpose and the identity of the recipient (art. 11.1). Consent is revocable (art. 11.2). It is not needed where a law provides, where an art. 5.2 exception applies, between state bodies, for health data in public health emergencies with dissociation, or where data are anonymised (art. 11.3). The recipient takes on the same obligations as the disclosing party, and both are jointly and severally liable before the AAIP and the data subject (art. 11.4). The recipient may be released if it proves it cannot be blamed for the harmful fact (Decree 1558/2001 Annex I art. 11).

Disclosure is distinct from outsourcing to a service provider, which is governed by art. 25 (section 7).

3.6 Automated decisions and profiling

Judicial decisions and administrative acts that assess human behaviour cannot be based solely on automated processing that defines a person's profile; such acts are null (art. 20). This applies to state acts. For private controllers, AAIP Res. 4/2019 Criterion 2 gives a data subject the right to request an explanation of the logic applied when a decision based solely on automated processing produces harmful legal effects or significantly affects them negatively. This rests on art. 15.1 (information in clear language). There is no general right to object to automated decisions in the sources reviewed.

4. Data subject rights and response deadlines

4.1 The rights

No portability, no general objection right. Law 25.326 does not provide a right to data portability or a general right to object as in GDPR. Convention 108+ art. 9 (as replaced by Law 27.699 art. 11) contains rights including objection and not being subject to purely automated decisions; how far those are directly enforceable in Argentina depends on the Protocol's entry into force and on whether the provisions are self executing (unconfirmed).

4.2 What happens if you miss a deadline

When the deadline expires without an answer, or the answer is insufficient, the data subject may bring a habeas data action (art. 14.2 and art. 16.3) and file a complaint with the AAIP (Decree 1558/2001 Annex I art. 14). To complain to the AAIP about access or rectification, the data subject must prove prior steps taken with the controller (Decree 1558/2001 Annex I art. 31.3.c). Not answering in time is a serious infraction (Res. 126/2024 Annex I 2.e). Acting to prevent or obstruct the exercise of rights is very serious (Annex I 3.e).

4.3 Habeas data in court: key procedural deadlines

4.4 CCTV access requests

For footage, the data subject must show their DNI and give an approximate date and time. The controller must explain when and where the person was recorded, the purpose, any disclosures and whether the database is registered. A copy of the image is given only exceptionally, if the data subject gives reasons and pays the cost. Third parties in the image must be obscured. The answer must tell the data subject they can complain to the AAIP or bring habeas data (AAIP Res. 4/2019 Criterion 1).

5. Registration with the AAIP

5.1 Who must register

Every public database and every private database intended to provide reports must be registered (art. 21.1). Private persons who form databases that are not for exclusively personal use must register (art. 24). Decree 1558/2001 Annex I arts. 1 and 21 confirm the broad reading. Registered information must include at least (art. 21.2):

a) name and address of the controller; b) characteristics and purpose of the database; c) nature of the data; d) how data are collected and updated; e) destination of the data and recipients; f) how information is interrelated; g) security measures, with the categories of persons with access; h) retention period; i) how data subjects can access and correct their data.

A user may not hold data of a different nature from what was declared (art. 21.3).

Marketing databases: chambers and associations with an AAIP approved code of conduct register on behalf of members who must adhere; others register under art. 21 (Decree 1558/2001 Annex I art. 27). The AAIP website explains that CCTV databases must also be registered (unconfirmed).

5.2 How to register (step by step)

Processing time is not stated in the sources reviewed (unconfirmed). Older registrations had to be refiled under the TAD procedure by 31 October 2019 (Res. 132/2018 art. 5). If your company registered before 2018 and never refiled, assume you are not validly registered and file again (unconfirmed).

5.3 Consequences of not registering

Processing data without being registered is a minor infraction (Res. 126/2024 Annex I 1.a). Not registering after being required to by the DNPDP is serious (Annex I 2.a). Declaring false or inaccurate data on registration is serious (Annex I 2.b). Sanctions apply whether or not the database is registered (Decree 1558/2001 Annex I art. 31.1; Res. 126/2024 Annex II point 5). Under art. 3 of the law a database is lawful only when registered, so lack of registration also weakens your position in any civil dispute.

6. Cross border transfers

6.1 The rule

Transfers of personal data of any kind to countries or international bodies that do not provide adequate protection are prohibited (art. 12.1). The prohibition does not apply to (art. 12.2):

a) international judicial cooperation; b) exchange of medical data needed for treatment or epidemiological research with dissociation; c) bank or stock exchange transfers, as to the relevant transactions; d) transfers agreed under treaties to which Argentina is party; e) international intelligence cooperation against organised crime, terrorism and drug trafficking.

Decree 1558/2001 Annex I art. 12 adds two more routes:

• Express consent of the data subject to the transfer.
• No consent is needed for transfers from a public register legally set up to inform the public.

It also says a country or body provides adequate protection when protection derives from its legal system, from self regulation, or from contractual clauses that provide for data protection. This is the legal basis for model clauses and binding corporate rules.

A transfer to a non adequate country without a valid route is a very serious infraction (Res. 126/2024 Annex I 3.g).

6.2 Adequate countries

Disp. 60/2016 recitals say that being off the list does not mean a country is deemed inadequate. In practice, however, without a positive listing you must use another route. The United States, Brazil, Chile, Mexico, India, Japan and Singapore are not on the list as it stands in the sources reviewed.

In the other direction, the AAIP website states that in January 2024 the European Commission confirmed Argentina's adequacy status, first granted by Commission Decision 2003/490/EC. EU exporters can therefore send data to Argentina without additional safeguards (AAIP website, Transferencias internacionales) (unconfirmed).

6.3 Model clauses (Disp. DNPDP 60/2016)

Disp. 60/2016 art. 1 approves two model contracts:

• Annex I: transfer to another controller (cesión).
• Annex II: transfer to a service provider (processor) under art. 25 of the law.

The AAIP website also says that by Res. 198/2023 the AAIP adopted the RIPD model clauses (controller to controller and controller to processor) and an implementation guide.

Filing duty. Controllers that use contracts different from the models, or that lack their principles, guarantees and content, must submit them for approval within 30 calendar days of signing (Disp. 60/2016 art. 2). If you use the model unchanged, no filing is needed. The AAIP website describes the filing: a note explaining where the contract differs from the model and why it complies, plus a copy of the contract, sent by email to the DNPDP or filed at its office. The website also refers to the 30 day period as running "from the transfer" in one place and "from signing" in another; the norm says from signing (Disp. 60/2016 art. 2).

Key content of the Annex II service provider model (clause numbers from Annex II):

Practical issue with US cloud providers. Large providers usually offer their own global data processing terms. If those terms do not reproduce the Disp. 60/2016 or RIPD clauses, the exporter must file them with the AAIP within 30 days. Clause 5(j) (suspend if a foreign authority's request lacks guarantees) and clause 7 (Argentine law and courts) are often not accepted by large providers. Whether the AAIP accepts EU standard contractual clauses as substantially equivalent is not settled in any source reviewed (unconfirmed).

6.4 Binding corporate rules

Groups can rely on BCRs that follow the AAIP guidelines in Res. 159/2018 Annex I. BCRs that differ from the guidelines must be submitted for approval within 30 days after the transfer (Res. 159/2018 art. 2). BCRs that follow the guidelines do not need formal approval (AAIP website).

6.5 Express consent as a route

Consent under Decree 1558/2001 Annex I art. 12 must meet the general consent standard: free, express, informed, written or equivalent, prominent if bundled (Law art. 5.1). It is revocable (Decree art. 5). Consent is fragile for systematic transfers: if a customer revokes it, the transfer of that customer's data loses its basis. Use consent as a backup, not the main route, for SaaS hosting.

7. Cloud, outsourcing and service providers

When a third party provides data processing services on behalf of a controller (art. 25 and Decree 1558/2001 Annex I art. 25):

• The provider may not use the data for any purpose other than the contract, or disclose them to others, even for storage (art. 25.1).
• When the service ends, the data must be destroyed, unless the controller expressly authorises storage because further assignments are reasonably expected. In that case data may be kept securely for up to two years (art. 25.2).
• The contract must include the security levels required by the law, the decree and AAIP rules, plus the provider's confidentiality obligations (Decree art. 25).
• The contract must state in particular that (a) the processor acts only on the controller's instructions and (b) the art. 9 security obligations also bind the processor (Decree art. 25).

If the provider is abroad in a non adequate country, the transfer rules in section 6 apply on top. If it is in an adequate country, the art. 25 contract is still required.

8. Marketing: data protection, Do Not Call and consumer law

8.1 Data protection rules for advertising

8.2 The "No Llame" register (Law 26.951)

Any person or company that is the holder or authorised user of a phone line may register it on the national Do Not Call register, free (Law 26.951 arts. 5 and 6). The register covers fixed, mobile, voice over IP and similar services (art. 4).

Who is bound. Anyone who advertises, offers, sells or gives away goods or services by phone is a database controller or user under Law 25.326 (art. 7). They may not call registered numbers and must check the register at least every 30 calendar days (art. 7; Res. 126/2024 Annex V point 1). The campaign's contracting party or direct beneficiary is liable together with the call centre, and campaigns run from abroad must comply (Decree 2501/2014 Annex I art. 7). Calls must show a caller ID (same article). Callers must also respect individual blocking requests under Law 25.326 art. 27.3 and keep a record of them (same article).

Exceptions (Law 26.951 art. 8): public interest campaigns (not if used to sell indirectly, Decree 2501/2014 art. 8); emergency calls; electoral campaigns; calls to people with a current contract, if about the strict object of the contract and at reasonable hours; and calls expressly permitted by the registered person. For the last exception, consent must be free, express and informed, in writing or equivalent, and in a separate document if there is a contract (Decree 2501/2014 art. 8).

Reasonable hours: conflicting rules. Decree 2501/2014 Annex I art. 8 says weekdays 9:00 to 21:00 and Saturdays 9:00 to 13:00. AAIP Res. 126/2024 Annex IV point 3 says weekdays 9:00 to 13:00 and 16:00 to 21:00, and Saturdays 9:00 to 13:00. A resolution cannot override a decree in principle, but the AAIP will apply its own rule in enforcement. The safe practice is to follow the narrower AAIP window.

Getting access to the list. To use the automated consultation system, a company must (Res. 126/2024 Annex V point 2):

1. be registered in the national register of databases and have declared the database it will use for phone campaigns;
2. file form FC.01 ("Formulario de habilitación para la consulta de altas y bajas en el Registro Nacional No Llame") with supporting documents;
3. receive credentials by email after review;
4. keep data updated; each email address used for downloads can belong to only one company, brand, dealer or agent.

Calling without being authorised to download the list is a serious infraction, as is calling registered numbers and failing to ensure compliance by contracted call centres in Argentina or abroad (Res. 126/2024 Annex I 2.l, 2.m and 2.n).

Enforcement mechanics. Individuals complain at nollame.aaip.gob.ar. A complaint is admissible only after 30 calendar days from registering the line. The AAIP opens proceedings against a company once it accumulates 100 complaints, and one file can contain up to 500 complaints. Companies below 100 receive an annual warning letter, and complaints are not dismissed (Res. 126/2024 Annex IV points 1.b and 2.a). The company's evidence of outgoing calls must be a.txt or.csv file with two columns: a 10 digit number and a date in YYYY-MM-DD format. Links to file sharing services are rejected (Annex IV point 2.c). Sanctions are those of Law 25.326 (Law 26.951 art. 11).

8.3 Consumer protection overlay

Marketing to consumers is also governed by the Consumer Protection Law 24.240:

• Distance sales (post, telecoms, electronic means) are regulated sales (art. 33). Consumers may revoke acceptance within 10 calendar days of delivery or contract, whichever is later, and must be told so in writing (art. 34).
• Unsolicited offers that generate an automatic charge unless the consumer says no are prohibited (art. 35).
• Providers must treat consumers with dignity and must not use intimidating practices, including debt collection that looks like a court claim (art. 8 bis).
• Administrative fines run from 0.5 to 2,100 "canastas básicas totales" for household type 3 published by INDEC (art. 47.b). The peso value of that unit changes monthly and was not available in the sources reviewed (unconfirmed).
• Punitive damages may be awarded by a court to the consumer, capped at the art. 47.b maximum (art. 52 bis).

A data driven marketing practice can therefore breach Law 25.326 (AAIP) and Law 24.240 (consumer authority) at the same time. The two regimes run in parallel.

9. Security measures and security incidents

9.1 The security duty

The controller or user must adopt the technical and organisational measures needed to ensure security and confidentiality and to prevent alteration, loss, unauthorised consultation or processing, and to detect deviations (art. 9.1). Recording data in databases without technical integrity and security conditions is prohibited (art. 9.2). Everyone involved owes professional secrecy (art. 10).

AAIP Res. 47/2018 sets out "recommended" measures, in Annex I for computerised data and Annex II for paper. Annex I has eight areas:

Annex II (paper) covers collection, access control, physical conservation, destruction and incidents.

Are the measures mandatory? Res. 47/2018 calls them "recommended" and says they are given "by way of reference". Yet keeping databases "without the security conditions that the rules determine" is a serious infraction, and breaching confidentiality or security of sensitive data is very serious (Res. 126/2024 Annex I 2.g, 2.h and 3.k). In a breach investigation, the AAIP is likely to measure your conduct against Res. 47/2018. Treat the measures as the minimum standard. Res. 47/2018 repealed the older, more prescriptive Disp. 11/2006 and the model "security document" of Disp. 9/2008, so there is no longer a mandatory security document format.

9.2 Is there a breach notification duty?

Short answer: not under Law 25.326, Decree 1558/2001 or any AAIP resolution reviewed. None of those texts requires notifying the AAIP or data subjects within a set time after a breach. We do not hide gaps, so here is the full picture:

Even without a duty to notify, a breach usually involves an underlying infraction (security failure) that the AAIP can sanction, and individuals can sue for damages under CCyC arts. 52 and 1770 and, for consumers, Law 24.240 art. 52 bis. Example 2 shows the numbers.

10. Employer monitoring and HR data

Employee data are personal data. The main rules:

• Legal basis. Data needed to perform the employment contract can be processed without consent (art. 5.2.d). Data required by labour, tax and social security rules fall under a legal obligation (art. 5.2.b).
• Personal controls. Controls to protect the employer's property must respect the worker's dignity, be discreet, and use automatic selection methods applied to all staff (LCT art. 70). Controls, including those on the worker's activity, must be known by the worker (LCT art. 71, as replaced by Law 27.322). The labour authority can check that controls do not affect dignity in a manifest and discriminatory way (LCT art. 72). Monitoring of email, devices or location should therefore be disclosed in a written policy delivered to the employee.
• No ideological profiling. The employer may not survey or investigate political, religious, union, cultural or sexual preferences of the worker at hiring, during or at the end of employment (LCT art. 73). This dovetails with the sensitive data rules in Law 25.326 art. 7.
• CCTV. Collection of images by security cameras requires prior informed consent under arts. 5 and 6, which can be satisfied by clear signs indicating that cameras exist, the purpose, and the controller's identity, address and contact. Consent is not needed for cameras covering the controller's own premises and perimeter, provided public spaces are not invaded except where unavoidable (Disp. 10/2015 Annex I art. 1.c). Images may not be used for incompatible purposes (art. 2), must be relevant and not excessive, may not be taken in inappropriate places, and must be deleted after a defined retention period (art. 3). A model sign was approved by AAIP Res. 38/2024 (Disp. 10/2015 art. 2 as replaced). Processing images by video cameras without complying with these conditions is a serious infraction (Res. 126/2024 Annex I 2.q).
• Biometric attendance. Fingerprint or face recognition clocks process biometric data. They are sensitive only where they can reveal additional discriminatory information (Res. 4/2019 Criterion 4). They still need a basis, information under art. 6, proportionality under art. 4.1 and security.
• Health data. Medical certificates and occupational health data are sensitive (art. 2). Processing by health professionals is allowed under art. 8. HR staff should receive only what is necessary to justify absence (unconfirmed).
• HR data sent to a foreign parent. Sending payroll or performance data to a parent in a non adequate country is an international transfer and needs one of the routes in section 6. Intra group BCRs (Res. 159/2018) or Disp. 60/2016 Annex I (controller to controller) are the usual tools.

11. Sanctions

11.1 Administrative sanctions: the scale

Law 25.326 art. 31.1 allows warnings, suspension, fines of ARS 1,000 to ARS 100,000, closure or cancellation of the database. The peso amounts have never been updated by law. AAIP Res. 126/2024 Annex II grades them:

After six warnings, no further warning can be given (point 4). Sanctions apply whether or not the database is registered (point 5).

11.2 Accumulation, cap, recidivism and payment

How the cap works is not fully clear. Point 7 does not say whether "identical conduct" affecting many people counts as one infraction or as one infraction per affected person. Res. 240/2022, now repealed, said that with "plurality of affected subjects" the existing maximum caps applied. Res. 126/2024 replaced that with the "× 500" cap, which only makes sense if one conduct can generate many fines. Assume the AAIP can multiply fines by affected person or by complaint up to the cap. This is how No Llame cases, grouped by 100 to 500 complaints, are designed. No published AAIP decision applying point 7 was reviewed (unconfirmed).

11.3 Grading factors

Fines are graded considering (Res. 126/2024 Annex II point 6; Decree 1558/2001 Annex I art. 31.1): nature and size of the harm or danger; economic benefit; recidivism; obstruction; non compliance with orders; acknowledgement before sanction; the infringer's economic condition; demonstrated corrective measures; proportionality; whether data of children are affected; volume of data; category of data; intent; harm caused; and, for security incidents, collaboration with the authority and demonstrated preventive and corrective measures as a mitigating factor.

11.4 Classification of key infractions (Res. 126/2024 Annex I)

11.5 AAIP procedure: deadlines

11.6 Civil and criminal exposure

• Civil damages. Art. 31.1 preserves liability for damages. CCyC art. 52 lets a person injured in privacy, honour, image or identity claim prevention and compensation; art. 1770 orders arbitrary intrusions into private life to cease and be compensated. Recipients of disclosed data are jointly liable with the discloser (Law art. 11.4).
• Consumer punitive damages. Up to the art. 47.b maximum (Law 24.240 art. 52 bis) (unconfirmed).
• Criminal offences. Knowingly inserting false data in a personal data file: 1 month to 2 years in prison (Criminal Code art. 117 bis 1°). Knowingly giving a third party false information from such a file: 6 months to 3 years (art. 117 bis 2°). Knowingly and illegitimately accessing a personal database, or breaching confidentiality and security systems to do so, and revealing information one must keep secret: 1 month to 2 years (art. 157 bis, as added by Law 25.326 art. 32.2) (unconfirmed). The AAIP may join criminal cases as complainant (Law art. 29.1.g).

Step by step

Worked examples

All peso figures are converted at the commonly cited dolar MEP rate of ARS 1,563.90 per US$ on 23 October 2026 (unconfirmed). Results are rounded to the cent.

Example 1: SaaS company transferring customer data to US servers

Facts. An Argentine SRL sells a project management SaaS to 2,000 business customers in Argentina. It holds names, work emails, phone numbers and DNI numbers of about 12,000 user contacts, plus billing data. Its application and database are hosted with a US cloud provider. It uses a US email marketing platform. It has never registered with the AAIP. It wants to comply before a large customer's audit.

Step 1. Is there a transfer abroad? Yes. Hosting in the US means the data flow from Argentina to the US. The AAIP's own explanatory example on its transfers page is exactly this case: an Argentine controller using a US cloud provider as processor.

Step 2. Is the US adequate? No. The US is not on the list in Disp. 60/2016 art. 3 as replaced by Res. 34/2019. The transfer is prohibited unless a route applies (Law art. 12.1).

Step 3. Choose the route.

Step 4. Paperwork and deadlines. Suppose the SRL signs Disp. 60/2016 Annex II unchanged with the US hosting provider and the email platform. No filing is required (Disp. 60/2016 art. 2). Suppose instead that the US provider insists on its own global terms, accepted online on Tuesday 3 November 2026. The 30 calendar day period in Disp. 60/2016 art. 2 ends on Thursday 3 December 2026. The SRL must email the DNPDP a note explaining how the terms differ from Annex II and why they protect data equivalently, attaching the terms. Points to address: third party beneficiary rights (Annex II clause 3), sub processor consent (clause 10), notice of government requests and breaches (clause 5(i)), Argentine law and jurisdiction (clause 7).

Step 5. Inform data subjects. The privacy notice must say the data are hosted in the US and may be transferred to a country with lower protection (Annex II clause 4(e)), and must include the art. 6 items and the Res. 14/2018 sentence.

Step 6. Register. Register the SRL as controller and register the customer database and the marketing database on TAD (Res. 132/2018 art. 1). Declare the US destination under art. 21.2.e.

Step 7. Security and rights. Apply Res. 47/2018. Put a rights request process in place with 10 calendar day and 5 business day deadlines.

Cost to do it.

Exposure if the SRL does nothing. Unregistered processing is minor (up to ARS 80,000, US$ 51.15). An unprotected transfer to a non adequate country is very serious (ARS 90,001 to 100,000, US$ 57.55 to 63.94 per infraction, and up to ARS 50,000,000, US$ 31,971.35, if multiplied for identical conduct under point 7). The very serious category also allows suspension of 31 to 365 days or closure of the database (Res. 126/2024 Annex II point 3), which for a SaaS business is a far bigger risk than the fine.

Example 2: data breach of 50,000 records

Facts. An online retailer (SA) suffers an intrusion on Monday 2 November 2026. The attacker exfiltrates 50,000 customer records: name, email, phone, delivery address, DNI and purchase history. No card data and no health data are involved. The SA is registered with the AAIP. The investigation shows that the database was exposed through an unpatched server and that administrator accounts had no strong authentication. The SA also failed to answer three access requests in time last year.

Step 1. Contain and assess (first 72 hours, good practice). Res. 47/2018 area G expects detection, evaluation, containment, response and escalation. There is no statutory clock, but act at once.

Step 2. Notify the AAIP? No provision of Law 25.326, Decree 1558/2001 or the AAIP resolutions reviewed requires it (section 9.2). Recommendation: notify voluntarily, without delay, by email to the DNPDP. Reason: Res. 126/2024 Annex II point 6.o makes collaboration with the authority and demonstrated corrective measures a mitigating factor for incidents. Convention 108+ art. 7.2 also points to notification "without delay" to the authority (unconfirmed).

Step 3. Notify customers? No statutory duty in the sources. Good practice is to notify, given civil exposure under CCyC arts. 52 and 1770 and consumer claims under Law 24.240. Be careful not to admit facts beyond what is known.

Step 4. Check contracts. If a processor abroad was involved, clause 5(i) of Disp. 60/2016 Annex II required it to notify the SA without delay.

Step 5. Estimate the administrative fine. The likely charges are:

• Charge A: breaching security duties, Res. 126/2024 Annex I 2.g or 2.h, serious, ARS 80,001 to 90,000 per infraction.
• Charge B: late answers to three access requests, Annex I 2.e, serious, ARS 80,001 to 90,000 each.

Reading 1: one infraction per conduct.

Reading 2: one infraction per affected person, with the point 7 cap.

Check of the US$ figures: 45,270,000 ÷ 1,563.90 = 28,946.86; 22,635,000 ÷ 1,563.90 = 14,473.43.

Variation: health or other sensitive data in the breach. The security charge becomes very serious (Annex I 3.k), ARS 90,001 to 100,000 per infraction, with a cap of 100,000 × 500 = ARS 50,000,000 (US$ 31,971.35) for that conduct, and the AAIP may also order suspension of 31 to 365 days or closure of the database (Annex II point 3).

Which reading will the AAIP use? The rule is designed to allow multiplication (section 11.2), and the grading factors include "volume of data" (point 6.k). Plan for Reading 2. Factors that push towards the lower end: prompt voluntary notification, cooperation, documented corrective measures, the SA's economic condition and acknowledgement before the decision (point 6, items f, g, h and o).

Step 6. Beyond the AAIP. Civil claims by customers (CCyC arts. 52, 1770; Law 25.326 art. 31.1) and consumer authority fines of up to 2,100 CBT hogar 3 (Law 24.240 art. 47.b) (unconfirmed) are separate and are not included above. Criminal liability rests with the attacker (Criminal Code art. 157 bis).

Step 7. Timeline the SA should follow (good practice, not legal deadlines).

Example 3: computing rights request deadlines

A customer sends a reliable written demand (for example a notarial letter or an email that leaves proof of receipt; Decree 1558/2001 Annex I art. 14) received on Monday 9 November 2026, asking for access to all their data and deletion of their marketing profile.

If the customer asks for access again in March 2027, the SA may charge for it because less than six months have passed, unless the customer shows a legitimate interest (art. 14.3). The amount that can be charged is not set in the sources (unconfirmed).

Example 4: No Llame enforcement exposure

A gym chain runs phone campaigns through a call centre. Between July and September 2026 the AAIP receives 120 admissible complaints from registered lines. That exceeds the 100 complaint threshold, so proceedings open (Res. 126/2024 Annex IV point 2.a).

The gym chain is liable as the beneficiary of the campaign even though the call centre made the calls (Decree 2501/2014 Annex I art. 7; Res. 126/2024 Annex I 2.n). To defend itself it must produce a.txt or.csv call list with 10 digit numbers and ISO dates (Annex IV point 2.c).

Practical traps

1. Thinking "private databases intended to provide reports" means only credit bureaus. Decree 1558/2001 Annex I art. 1 covers any database beyond personal use. Register.
2. Old registrations. Registrations made before Res. 132/2018 had to be refiled through TAD by 31 October 2019 (art. 5). Check that yours was.
3. Relying on GDPR "legitimate interest". It does not exist in Law 25.326. Use art. 5.2.d (contract) or consent.
4. Assuming the US is fine because EU SCCs are signed. The AAIP list and models are Argentine. Using a non Argentine model means filing within 30 calendar days (Disp. 60/2016 art. 2) (unconfirmed).
5. Forgetting to tell customers about the transfer. The model clauses require the exporter to warrant that data subjects were told that their data may go to a country with lower protection (Annex I clause 3(a); Annex II clause 4(e)).
6. Sensitive data by inference. Purchase history at a pharmacy or union dues deductions in payroll reveal sensitive data. Art. 7.3 prohibits databases that "directly or indirectly" reveal it.
7. Treating companies as outside the law. Data about legal entities are protected as far as relevant (art. 1).
8. No breach notification duty does not mean no consequence. The security failure itself is sanctionable, and collaboration reduces the fine (Res. 126/2024 Annex II point 6.o).
9. The "× 500" cap. The low statutory scale lulls businesses into ignoring the AAIP. Under Res. 126/2024 the realistic exposure for a mass incident or a phone campaign is tens of millions of pesos, plus suspension or closure for very serious infractions.
10. Paying late. The 50% reduction is lost after 20 business days, and filing an appeal does not stop that period (Res. 126/2024 Annex II point 9).
11. Call centre abroad. The Argentine company that commissions the campaign is responsible for compliance by a foreign call centre (Decree 2501/2014 Annex I art. 7; Res. 126/2024 Annex I 2.n).
12. Calling hours. Follow the AAIP window (weekdays 9 to 13 and 16 to 21; Saturdays 9 to 13) rather than the wider decree window.
13. Email subject line. Unsolicited marketing emails need the single word "publicidad" in the subject (Disp. 4/2009 art. 2).
14. CCTV without signs. Cameras need signs with the controller's identity and contact, and footage needs a defined retention period (Disp. 10/2015 Annex I arts. 1 and 3).
15. Employee monitoring without notice. LCT art. 71 requires that controls be known by the worker. Covert monitoring is risky in labour courts and before the AAIP.
16. Processor keeps data after the contract. Art. 25.2 requires destruction, or storage for up to 2 years only with express authorisation.
17. Joint liability on disclosure. If you sell or share a list, you remain jointly liable with the buyer (art. 11.4).

Recent changes

No change to Law 25.326 itself appears in the Infoleg list of modifying norms reviewed (the last legislative change is Law 26.343 of 2008).

Pending changes

FAQ

1. Does Law 25.326 apply to a foreign company with no Argentine entity? The law has no express extraterritorial clause. It protects data in databases and gives federal jurisdiction over databases interconnected in international networks (art. 44). The AAIP website asks non established controllers that process data of people in Argentina to register. Treat Argentine customers' data as covered if you target the Argentine market (unconfirmed).

2. Do we need a data protection officer? No. Neither Law 25.326 nor Decree 1558/2001 nor the AAIP resolutions reviewed require one. You do need a contact point to answer rights requests within the deadlines, and the importer under the model clauses must name a contact (Disp. 60/2016 Annex II clause 5(f)).

3. Is registration with the AAIP really mandatory for an ordinary company? Yes, for any database beyond exclusively personal use (Law arts. 21 and 24; Decree 1558/2001 Annex I art. 1). It is free and online (Res. 132/2018). Processing without registration is a minor infraction (Res. 126/2024 Annex I 1.a).

4. Can we store Argentine customer data in the United States? Yes, if you use a valid route: express consent, the Disp. 60/2016 or RIPD model clauses, approved BCRs, or a custom contract filed with the AAIP within 30 calendar days of signing (Decree 1558/2001 Annex I art. 12; Disp. 60/2016 art. 2; Res. 159/2018). The US is not on the adequate list.

5. Can we send data to the EU, the UK or Uruguay without paperwork? For the transfer itself, yes; they are on the adequate list (Disp. 60/2016 art. 3 as replaced by Res. 34/2019). If the recipient is your processor, you still need an art. 25 processing contract.

6. How quickly must we answer a request for access? Within 10 calendar days of a reliable demand (art. 14.2). Rectification, update or deletion within 5 business days (art. 16.2). Access is free if the person has not asked in the last six months (art. 14.3).

7. Must we report a data breach to the AAIP? Not under the domestic rules reviewed. Convention 108+ art. 7.2 contemplates notification without delay, subject to its entry into force (unconfirmed). Voluntary notification and cooperation reduce fines (Res. 126/2024 Annex II point 6.o).

8. What is the maximum fine? ARS 100,000 per infraction (Law art. 31.1), about US$ 63.94. For identical conduct sanctioned many times, total fines are capped at the top of the scale × 500, up to ARS 50,000,000 (about US$ 31,971) for very serious conduct (Res. 126/2024 Annex II point 7). Very serious infractions can also lead to suspension of 31 to 365 days, closure or cancellation of the database (point 3).

9. Can we send marketing emails to customers? Yes, to people who provided their data or consented, or using generic profiles (Law art. 27.1; Decree art. 27). Each message must offer opt out prominently, and unsolicited emails must have "publicidad" in the subject (Disp. 4/2009). Honour opt outs; ignoring them is a serious infraction (Res. 126/2024 Annex I 2.k).

10. Can we call prospects by phone? Only after checking the No Llame register (at least every 30 days), from a visible number, and not calling registered lines unless an exception applies, such as a current contract within its strict scope and at reasonable hours (Law 26.951 arts. 7 and 8; Decree 2501/2014 arts. 7 and 8; Res. 126/2024 Annexes IV and V).

11. Can we monitor employees' email and laptops? Controls must respect dignity, be applied to all staff by automatic selection where relevant, and be known by the worker (LCT arts. 70 and 71). Put the policy in writing and deliver it. Do not collect data on political, religious, union, cultural or sexual preferences (LCT art. 73).

12. Do security cameras at our office need anything? Signs showing the cameras exist, the purpose and the controller's identity and contact, a defined retention period, and proportionate placement. Cameras covering your own premises do not need individual consent if they do not invade public space (Disp. 10/2015 Annex I arts. 1 to 3). Register the CCTV database (unconfirmed).

13. Are data about companies protected? Yes, as far as relevant (art. 1, second paragraph). Legal entities with domicile or branches in Argentina are data subjects (art. 2).

14. Is Argentina adequate for the EU? Yes. The EU recognised Argentina by Decision 2003/490/EC, and the AAIP website says the Commission confirmed this in January 2024 (unconfirmed).

Primary sources

• Law 25.326, updated text (Infoleg)
• Law 25.326, norms that modify or complement it (Infoleg)
• Law 25.326 BO date (Infoleg record)
• Decree 1558/2001, updated text
• Decree 1160/2010
• Law 26.343
• Law 26.951, updated text
• Decree 2501/2014
• Law 27.275, updated text
• Decree 746/2017
• Decree 899/2017
• Law 27.483 (Convention 108 and 2001 Additional Protocol), updated text
• Law 27.699 (Protocol amending Convention 108)
• Law 24.240 Consumer Protection, updated text
• Civil and Commercial Code, Law 26.994
• Employment Contract Law 20.744, updated text
• Disp. DNPDP 4/2009
• Disp. DNPDP 7/2005 (repealed)
• Disp. DNPDP 9/2015 (repealed)
• Disp. DNPDP 13/2015 (repealed)
• Disp. DNPDP 10/2015, updated text
• Disp. DNPDP 3/2015 (No Llame implementation)
• Disp. DNPDP 60/2016, updated text
• AAIP Res. 5/2018
• AAIP Res. 14/2018
• AAIP Res. 47/2018
• AAIP Res. 132/2018
• AAIP Res. 159/2018
• AAIP Res. 4/2019
• AAIP Res. 4/2019 Annex I
• AAIP Res. 34/2019
• AAIP Res. 243/2019 (repealed)
• AAIP Res. 240/2022 (repealed)
• AAIP Res. 255/2022
• AAIP Res. 161/2023
• AAIP Res. 170/2023 (TAD platform)
• AAIP Res. 126/2024, updated text
• AAIP Res. 179/2025
• Protección de datos personales (home)
• Proyecto de Ley de Protección de Datos Personales
• Responsables de bases de datos personales
• Obligaciones de los responsables
• Transferencias internacionales
• Trámites ante el Registro Nacional de Bases de Datos Personales
• Registro Nacional No Llame

Related pages

• Do I need to register my databases with the AAIP?
• AML and KYC in Argentina: UIF obligations for companies, banks and other reporting parties
• Corporate criminal liability and compliance programs in Argentina: Law 27.401
• Competition law and merger control in Argentina
• Consumer protection rules for companies selling in Argentina
• Intellectual property in Argentina: trademarks, patents, copyright, software, trade secrets and technology transfer
• How much does it cost to register a trademark in Argentina?