Comprehensive regime
Ley 25.326, Ley de Protección de los Datos Personales
Ley 25.326, Ley de Protección de los Datos Personales (2000)Official consolidated text of Ley 25.326, InfoLEG (Ministerio de Justicia y Derechos Humanos)
In force since 30 October 2000. Binds public and private bodies.
What this law does
Ley 25.326 requires free, express, and informed consent before processing personal data, with exceptions for data from unrestricted public-access sources, data gathered for a State function or legal obligation, and a few other narrow grounds.
Article 7 forbids collecting sensitive data (racial or ethnic origin, political opinions, religious, philosophical, or moral beliefs, union membership, or health or sexual-life information) except for reasons of general public interest authorized by law or for statistical or scientific purposes that cannot identify the data subject.
Article 12 prohibits transferring personal data to a country or international organization that does not provide an adequate level of protection, subject to enumerated exceptions such as international judicial cooperation and treaty-based transfers. Article 20 bars basing a court decision or administrative act that evaluates a person's conduct solely on the result of automated processing that profiles their character or personality.
Article 21 requires registering any file, record, or database intended to provide reports with the National Registry, and article 27 lets a business gather data for advertising or profiling purposes only from sources available to the public or furnished with the data subject's consent.
Article 31 backs the Act with administrative sanctions of warning, suspension, a fine of one thousand to one hundred thousand pesos, or closure of the file, and article 32 inserted articles 117 bis and 157 bis into the Código Penal. Article 157 bis, since substituted by Ley 27.759 in 2024, punishes unauthorized access to, disclosure from, or illegitimate insertion into a personal database with one month to two years' imprisonment.
That penalty rises to six months to four years for conduct reaching a genetic-data databank or DNA registry. Article 33 arms an affected person with a habeas data judicial action to learn what personal data is held and demand its correction, deletion, or confidentiality.
What it requires