Law: Personal Data Protection Act, Act No. 25.326 of 2000 (only available in Spanish here) (the Act) and Decree No. 1558/2001 Regulating Law No. 25.326 (only available in Spanish here) (the Decree), amended by Decree No. 1160/10 (only available in Spanish here)

Regulator: Argentinian data protection authority (AAIP)

Summary: The Personal Data Protection Act, Act No. 24,326 of 2000 (only available in Spanish here) (the Act) governs data protection in Argentina. The Act is accompanied by Decree No. 1558/2001 Regulating Law No. 25.326 (only available in Spanish here) (the Decree), amended by Decree No. 1160/10 (only available in Spanish here) which provides the implementation rules of the Act. On June 30, 2003, Argentina was recognized by the European Commission as providing an adequate level of protection for personal data.

The Act and the Decrees apply to both public and private organizations and apply to the processing activities in the territory of Argentina. The Act provides for legal bases for processing, including consent and contracts with data subjects, but does not recognize legitimate interests or public interest as legal bases. Additionally, the Act provides for controller and processor obligations, including breach notification obligations and the requirement to register databases with the National Registry of Personal Databases maintained by the Argentinian data protection authority (AAIP).

The AAIP is the supervisory authority under the Act and is fairly active. It regularly issues resolutions that interpret the Act and guide compliance. These resolutions have defined 'security measures' and provided guidance on Binding Corporate Rules (BCRs) for international data transfers. Notably, on October 18, 2023, the AAIP adopted Standard Contractual Clauses (SCCs) for international data transfers.

On June 29, 2023, the Personal Data Protection Bill (only available in Spanish here) was sent to the National Congress of Argentina. The proposed bill aims to update the Act and foster a framework that balances technological innovation, economic growth, and the protection of personal data and informational self-determination.

On the international front, Argentina is a party to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) and has ratified the Protocol amending Convention 108 (Convention 108+).