Guide on Personal Data Protection in Argentina

Argentina’s constitution, its Personal Data Protection Act (DPA), Regulatory Decrete 1558/2001 and Dispositions issued by the Argentine National Data Protection Agency (NDPA) set forth the system for the protection of personal data in Argentina.

The Data Protection Act creates the NDPA as the supervisory governmental authority of the law. However, in 2017, the National Decree 899/2018 designated the Agency of Access to Public Information as the authority in charge of DPA’s enforcement.

Data subjects have the right to access the information and request for rectification, update or deletion of it.

Argentina’s Personal Data Protection system recognises the following principles:
• Purpose proportionality.
• Legality.
• Data quality and accuracy.
• Purpose.
• Confidentiality.
• Temporary limitation.

However, Convention 108+ -which has been recently approved by the congress- and the new bill adopt some additional principles (i.e. accountability).

Yes, Controllers require Data Subject’s consent in order to collect and process Personal Data. Notwithstanding, the law foresees certain exceptions to this general rule in its article 5.

Article 25 of the Data Protection Act and the Regulatory Decree establish the responsibilites and obligations of data processors. Among other obligations, they must follow the controller’s instruction, comply with the Data Protection Law, protect the confidentiality and destroy the data once the obligations have been fulfilled.