Ley 25.326, enforcement, sanctions, and the habeas data action

Article 29.1 charges the control body (the AAIP's Dirección Nacional de Protección de Datos Personales) with assisting and advising people about their rights, issuing the rules the Act requires, keeping a census and permanent registry of databases, controlling compliance with data-integrity and security rules, with judicial authorization to inspect premises, equipment, or processing programs, requesting information and records from public and private entities, imposing the administrative sanctions the Act allows, acting as a private prosecutor in a criminal case the Act's violation brings, and controlling a private reporting database's registration requirements.

Article 30 lets an association or entity representing private-sector database controllers or users draft a professional code of conduct for personal-data processing, and requires the control body to register it, which it may refuse where the code does not conform to the applicable rules.

Article 31 lets the control body impose a warning, suspension, a fine of one thousand to one hundred thousand pesos, or closure of the file, without prejudice to any public-sector administrative liability, civil damages, or criminal sanction, graded to the violation's gravity and harm under due process; the enforcement authority's implementing regulation, Resolución AAIP 126/2024, grades these into three severity tiers and caps the aggregate fine for identical multiple sanctions in one proceeding at five hundred times the applicable tier's maximum.

Article 32 inserted articles 117 bis and 157 bis into the Código Penal; article 157 bis, since substituted by Ley 27.759 in 2024, punishes unauthorized access to, disclosure from, or illegitimate insertion into a personal database with one month to two years' imprisonment. The penalty rises to six months to four years, with a further two to five years' special disqualification from practising the profession, for conduct reaching a genetic-data databank or a DNA record, examination or sample.

Articles 33 to 43 arm an affected person, their guardian, or their universal successor with a habeas data judicial action against a public or private reporting database's controller or user, heard by the judge of the plaintiff's or defendant's domicile or of the place the act had effect, with federal jurisdiction over a national public database or one interconnected across jurisdictions, following the ordinary amparo procedure and, where the record's falsity or inaccuracy is manifest, letting the judge provisionally block the file pending the court's judgment, which must be reported to the control body's own registry.