Ley N° 6534/2020, de Protección de Datos Personales Crediticios
Ley N° 6534, del año 2020, de Protección de Datos Personales Crediticios
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 27 October 2020.
A sensitive categories rule binding public and private bodies.
As of 5 September 2026.
What it requires
- This law remains in force for credit and financial data specifically; several of its provisions are repealed once Ley N° 7593/2025 enters into force on 27 November 2027, at which point its references to the Secretaría de Defensa del Consumidor y el Usuario become references to the new National Personal Data Protection Agency.
- Do not operate a credit-reporting or credit-information business, or otherwise collect, hold or disclose a person's credit data, without meeting this law's registration, disclosure and administrative obligations, on pain of a fine, a suspension, or a closure of the data-processing operation.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Who enforces it
Enforcement body
Banco Central del Paraguay y Secretaría de Defensa del Consumidor y el Usuario
What it reaches
Obligation class
Licensing, Disclosure, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 1 states the object of the law as guaranteeing the protection of a person's credit data and regulating the collection of, and access to, credit-information data, as well as the constitution, organization, operation, rights, obligations and dissolution of the legal persons dedicated to that activity; State agencies and pension-fund administrators count among the sources of credit-relevant information the law reaches.
The law's own definition of sensitive data mirrors the later comprehensive law's, reaching racial or ethnic origin, religious belief, union affiliation, political opinion, health, sexual orientation, genetic data and biometric data aimed at uniquely identifying a natural person. Article 21 assigns enforcement jointly to the Banco Central del Paraguay and the Secretaría de Defensa del Consumidor y el Usuario, each within its own competence, over the infractions the article lists.
Article 23 sets administrative sanctions rising from a warning to a fine of up to 15,000 minimum daily wages, doubled on repetition up to a ceiling of 50,000, to a suspension of data-processing operations of six months to five years or a permanent closure for sensitive-data infractions, none of which are stated as a fixed currency amount.
Article 30 repealed Ley N° 1682/2001, which had regulated privately held personal information generally, along with its amending laws, in the same act that created this credit-specific regime.
Ley N° 7593/2025 will, once it enters into force on 27 November 2027, treat this law's references to the Secretaría de Defensa del Consumidor y el Usuario as references to the new National Personal Data Protection Agency, and repeals article 4, subparagraphs a) and b) of article 3, subparagraph b) of article 20, and subparagraph x) of article 21 of this law in advance of that date.
When LexLint raises it
high_risk_decisionsprocesses_biometrics