Do I need to register my databases with the AAIP?

Last verified: 27 Oct 2026 · Status: Changing

Short answer. Yes, if your business keeps any personal database beyond purely personal use, such as customers, users, employees or leads. Each one must be registered with the AAIP's Registro Nacional de Bases de Datos, online through TAD and free. Not registering is a minor infraction, fined ARS 1,000 to 80,000 per infraction (about US$ 0.64 to 51.15).

As of 26 Oct 2026. Rules in force at that date.

Key rules

Who must register. Every public database and every private database "intended to provide reports" must be registered (Law 25.326, art. 21.1). Private databases not for exclusively personal use must register (art. 24). The regulation covers any database that exceeds exclusively personal use or is meant to transfer data (Decree 1558/2001, Annex I, arts. 1 and 21). The AAIP adds that internal use counts too: the "report" does not have to go to a third party (AAIP, "¿Qué es una base de datos personales destinada a dar informes?"). Its only named exception is personal use, such as friends' addresses on a home computer (AAIP, Responsables).

Why it matters. A database is lawful only when "duly registered" (Law 25.326, art. 3). The AAIP replaced the old DNPDP as authority (Decree 899/2017, art. 2, noted in the Infoleg text of Decree 1558/2001).

What you declare. Controller, purpose, data types, collection, recipients, security measures, retention and how data subjects exercise rights (Law 25.326, art. 21.2). You may not hold other kinds of data (art. 21.3).

How. Filing is exclusively through the Trámites a Distancia (TAD) platform or GDE, in two steps: first register the controller, then each database (AAIP Res. 132/2018, art. 1). It is free (art. 4). Keep it updated (art. 7). The AAIP pages ask for Clave Fiscal level 2 or a TAD proxy and the company bylaws, and say registration does not expire (AAIP, Inscribir un responsable; Registrar bases privadas). Those pages still say "AFIP"; the tax login is now issued by ARCA.

The penalty. Processing data without being registered is a minor infraction (Annex I, 1.a). Failing to register after the AAIP requires you to is serious (2.a). So is declaring false data (2.b) (AAIP Res. 126/2024, in force since 1 June 2024, art. 7). Minor infractions carry up to 2 warnings and/or ARS 1,000 to 80,000. Serious ones carry up to 4 warnings, 1 to 30 days' suspension and/or ARS 80,001 to 90,000 (Annex II, points 1 and 2).

What changes the answer

You are a foreign controller with no Argentine entity. The AAIP says controllers not established in Argentina that process data of people in Argentina "must register", and it gives them a web form (AAIP, Trámites; form). Law 25.326 has no express extraterritorial clause. This is the AAIP's position, not a rule found in the law or the decree (unconfirmed).
You only process data for clients. A SaaS acting purely as a service provider must stick to the client's purpose (Law 25.326, art. 25). Res. 132/2018 puts the registration duty on the "responsables". Whether a pure processor must register its clients' data is not addressed in the sources reviewed (unconfirmed). Your own staff and billing data still count.
You do telemarketing. To query the No Llame list you must be registered and have declared the database used for phone campaigns (Res. 126/2024, Annex V, point 2.a).
You registered before October 2018. Private controllers had to re-register under the TAD procedure by 31 October 2019 (Res. 132/2018, art. 5). Treatment of unrefiled entries is not stated (unconfirmed); file again.

Worked examples

A US founder's SaaS runs through an Argentine SAS with three databases: users, employees and leads. Rates: dolar MEP ARS 1,563.90 per US$ on 23 Oct 2026, figure supplied in dólar MEP selling rate (dolarapi.com) (unconfirmed) (live rate).

Step or item	Time	Cost ARS	Cost USD
1. Clave Fiscal level 2 for the SAS, or a TAD proxy	Not published (unconfirmed)	0 at the AAIP; ARCA side not reviewed (unconfirmed)	0
2. TAD: register the SAS as controller, attach bylaws	Not published (unconfirmed)	0	0
3. TAD: register 3 databases (users, employees, leads)	Not published (unconfirmed)	0	0
4. Download the QR certificate, keep entries updated	Ongoing	0	0
Risk A: never registered, 3 minor infractions at the top of the band	n/a	240,000	153.46
Risk B: still unregistered after an AAIP requirement, 3 serious infractions at the top	n/a	270,000	172.65
Risk B paid within 20 business days (50% off)	20 business days	135,000	86.32

Step by step:

Minor band top: ARS 80,000 × 3 = ARS 240,000; 240,000 ÷ 1,563.90 = US$ 153.46.
Serious band top: ARS 90,000 × 3 = ARS 270,000; 270,000 ÷ 1,563.90 = US$ 172.65.
Voluntary payment within 20 business days of notice halves the fine (Res. 126/2024, Annex II, point 9): 270,000 × 50% = ARS 135,000 = US$ 86.32.
Ceiling for identical conduct in one act: top of the band × 500 (point 7). For minor infractions that is ARS 40,000,000 (US$ 25,577.08). How point 7 applies to several unregistered databases is not stated, and no AAIP decision on it was reviewed (unconfirmed).

An ecommerce store registers customers, subscribers, employees and any CCTV footage, which the AAIP says must be registered (AAIP, Responsables, "¿Por qué hay que registrar bases de datos de videovigilancia?") (unconfirmed).

Cost to do it: ARS 0 in fees (Res. 132/2018, art. 4), no capital. Official processing time is not published (unconfirmed).

Practical traps

Treating "minor" as harmless. An unregistered database is unlawful (art. 3), and ignoring an AAIP requirement makes it "serious" (Annex I, 2.a).
Registering once and forgetting. Not reporting changes or deregistration is its own minor infraction (Annex I, 1.b). A new data category, a new recipient or a new transfer abroad means updating the entry (art. 21.3; Res. 132/2018, art. 7).
Assuming registration covers everything. It does not authorise transfers abroad, replace consent or meet security duties; those breaches are mostly serious or very serious (Res. 126/2024, Annex I).

FAQ

Does registration cost anything? No. AAIP registration is free (Res. 132/2018, art. 4).

Does it expire or need renewing? No, according to the AAIP procedure pages. You must update it when the declared data change.

Can I file on paper? No. Private controllers file only through TAD or GDE (Res. 132/2018, art. 1). Foreign controllers use the AAIP web form.

Do I register each database separately? Yes. You register the controller once, then each database (Res. 132/2018, art. 1, points 1 and 2).

Published 27 Oct 2026 from our research draft. Points marked (unconfirmed) have not yet been checked against the official text; rely on the primary sources linked below.