• Data Protection in Paraguay
  • November 25, 2009 | Authors: Rodrigo Aguirre; Maria Antonia Gwynn
  • Law Firm: Berkemeyer Attorneys and Counselors - Asunción Office

    In Paraguay, the Legal Framework for Data Protection comprehends the following:

    - National Constitution

    - Law Nº 1682/01

    - Law Nº 1969/02

    - Anti-Money Laundering Law N° 1015/96


    Pursuant to the legislation in force, companies processing personal data in Paraguay do not need to notify the data protection authority. Article 5 of Law No. 1969/2002 establishes that persons or companies data can be published when they describe or provide a prospect on a pecuniary situation, economical solvency or compliance of commercial and financial obligations.


    Moreover, law 1969/2002 establishes that financial information may be released provided that (1) written consent has been obtained to collect financial information concerning obligations that have not been claimed in a court of law; (2) the information is of the type that the government or private entities may release to comply with legal requirements; and (3) the information is available from public sources.


    Accordingly, financial information may be released (1) three years after an overdue obligation has not been claimed in court; (2) three years after a collection has been paid or legally extinguished; and (3) five year after a creditors’ meeting has been admitted in court. 


    On the other hand, there is also special regulation regarding banks and financial entities who must notify the Paraguayan Central Bank the identification of their customers when financial operations exceeding US$ 10.000 take place for anti- money laundering purposes.


    As mentioned above, there is no obligation to notify but companies may publish first names, last names, place and date of birth, address, ID number etc. whenever is requested by the individual or a judicial/ legislative authority.[1] Additionally, there is no deadline for updating notifications. The law states that personal data must be updated permanently.  rticle 135 of the Paraguayan Constitution




    It is worth mentioning that the interested party holds a Constitutional guarantee action to request immediate update of personal data, called “Habeas Data”   A on Habeas Data states “Everyone may have access to information and data available on himself or assets in official or private registries of a public nature.  He is also entitled to know how the information is being used and for what purpose. He may request a competent judge to order the updating, rectification, or destruction of these entries if they are wrong or if they are illegitimately affecting his rights.”


    Likewise we must signal out that there are no special requirements for disclosure of personal data between corporate affiliates where both the disclosing and the receiving entity are based in Paraguay, Public Registries should be sufficient for this purpose.  General disclosure requirements of accurate and truthful information are expressed in Article 28 of the Constitution that sets forth regarding the Right to Obtain Information, the following:

    (1) The people's right to receive true, responsible, and equitable information is hereby recognized.
    (2) Everyone has free access to public sources of information.  The laws will regulate the corresponding procedures, deadlines and sanctions, in order to turn this right effective.
    (3) Anyone affected by the dissemination of false, distorted, or ambiguous information has the right to demand that the offending media organization rectify or clarify the report under the same conditions in which it was originally conveyed, without any other compensatory rights being affected.


    Law 1682/01 provides that data explicitly classified as sensitive may not be published or disseminated.  Sensitive data includes race, ethnicity, political preferences, health, religious or philosophical beliefs, sexual intimacy, and data that may foster discrimination or affect the dignity, household privacy, and the private images of persons or families. 


    As aforementioned, non-sensitive data, such as a name, identity number, domicile, age, date, and place of birth, marriage status, occupation, workplace, workplace telephone number, and information that is requested to be published by the individual may be disclosed. There are no additional procedures governing the accumulation, retention, and release of customer information.



    Furthermore it is important to understand that the legal framework on Mergers and Acquisitions in Paraguay is in the Civil Code. The Civil Code, in Article 1189 establishes that the merger must be published for five days.  A document identifying the new and past shareholders must also be recorded.  Law No. 1034/83 also mentions the requirement of publication of the acquisition of a company with the statement of the identification of the vendor and buyer.




    Finally, in cases of Share Purchases, pursuant to the Paraguayan Tax Law there is a requirement to inform the amount of the transaction to the Treasury Ministry for fiscal purposes, but the only consequence of not complying with this requirement is that payment of the value added tax will be due.