Argentina

Ley 25.326 article 1 frames the law around data 'asentados en archivos, registros, bancos de datos, u otros medios tecnicos de tratamiento de datos', public or private, and grounds it in article 43 of the Constitution (the habeas data right). Unlike Brazil's LGPD or the EU's GDPR, there is no express extraterritoriality clause and no representative obligation; the 2023 reform bill would have added both. Journalistic sources are expressly carved out. The law is also applied, 'in so far as relevant', to legal persons - unusual internationally, and it means company data can be in scope. The regulator's own final-sanctions register shows action against, for example, Google Argentina SRL (2020), which is a locally incorporated entity.

Ley 25.326 article 12 prohibits transfers to countries or international bodies that do not provide adequate levels of protection, with narrow exceptions for judicial cooperation, medical and epidemiological exchange for treatment, banking and stock-exchange transfers, treaty obligations, and intelligence cooperation against organised crime and terrorism. The AAIP's approved destinations are the European Union and European Economic Area states, the United Kingdom, Switzerland, Guernsey, Jersey, the Isle of Man, the Faroe Islands, Andorra, New Zealand, Uruguay, Israel (automated processing only) and Canada (private sector only). The sector search produced storage-adjacent duties rather than residency walls: the central bank requires that technology and information-security management functions be performed in Argentina and that the supervisor be told before any process is outsourced, with unrestricted supervisory access written into the contract and into every subcontract 'con independencia de la ubicacion geografica'; the insurance rulebook requires records to be held at the entity's registered office in Argentina and available to the supervisor, but contains no cloud, cybersecurity or localisation chapter at all; and the public sector's new resilience rule requires an alternative data processing centre without saying where it must be. No health, telecom or securities localisation rule was found.

The instruments are Disposición DNPDP 60-E/2016 (model clauses and the adequacy list), Resolución AAIP 34/2019 (updating the list, notably for the United Kingdom), Resolución AAIP 159/2018 (criteria for binding corporate rules, which need no formal approval if they follow the published guidance) and Resolución AAIP 198/2023 (October 2023), which adopted the Ibero-American Data Protection Network model clauses for controller-to-controller and controller-to-processor transfers as an additional option. Non-standard contracts go to datospersonales@aaip.gob.ar within 30 days of signature. Traffic in the other direction also matters commercially: the European Commission treats Argentina as an adequate destination, so EU data can flow in without extra paperwork.

Beatriz de Anchorena has been the head of the AAIP since Decreto 110/2022, following a public hearing process; the agency's own authorities page still showed her in post on 18 August 2026, and its structure includes a dedicated Dirección Nacional de Protección de Datos Personales. The final-sanctions register lists 244 penalties: 111 under the data protection law (Ley 25.326) and 133 under the do-not-call law (Ley 26.951), running from 2016 to a most recent final decision in September 2025. Named targets include banks, telecoms operators, Google Argentina, Andreani Logística and Swiss Medical. Enforcement is therefore steady and unglamorous rather than headline-grabbing. Sector regulators matter more in practice for large firms: the central bank (BCRA) through its Superintendencia de Entidades Financieras y Cambiarias, the securities regulator (CNV), the insurance regulator (SSN), the telecoms regulator (ENACOM), the financial intelligence unit (UIF), and since Decreto 941/2025 a new Centro Nacional de Ciberseguridad, publicly launched on 21 May 2026 and already issuing binding technical rules for government bodies.

Floors: Ley 25.246 article 21 (as amended by the 2024 reform, Ley 27.739) requires a minimum of ten years for all records needed to reconstruct transactions plus customer due-diligence files and business correspondence; Ley 26.529 article 18 sets ten years from the last entry for the clinical record, tied to the contractual limitation period; BCRA Comunicación A 7724 requires information supporting accounting entries and audit logs to be recoverable for no less than six years and available immediately to the supervisor. Ceilings: Ley 25.326 article 4.7 requires data to be destroyed once no longer necessary for the purpose collected, and article 26.4 limits credit-solvency data to the last five years, reduced to two years once the obligation is cancelled. Conflict is resolved in favour of the floor: article 16.3 excludes deletion where the data must be kept under a legal duty. The telecom ten-year retention duty is a special case - see the telecom rule below.

The general law contains no breach-notification article; Resolución AAIP 47/2018 approved 'medidas de seguridad recomendadas' for computerised and non-computerised systems and is expressly advisory. For banks, payment service providers on the BCRA register and systemically important payment infrastructures, the consolidated RRCI text (Comunicación A 7266, last updated by A 8280, consolidated 17 July 2025) requires initial notification to the Gerencia de Auditoría Externa de Sistemas within the first hour, frequent updates while the incident lasts more than an hour, and a root-cause closing report within five calendar days, by email to audext.incidente@bcra.gob.ar. Reportable incidents expressly include loss or unauthorised disclosure of customer data, and incidents originating at a third party or anywhere in its supply chain. Public sector bodies report through CERT.ar under the cybersecurity dispositions. So a single incident at a bank using a foreign cloud provider can trigger the one-hour central bank clock with no privacy-regulator clock at all.

1. Ley 25.326 article 14 gives ten calendar days to answer an access request and article 16 gives five working days to correct, update or delete - far shorter than the one month common elsewhere, and missing the deadline opens the door to a habeas data court action. 2. Article 31 caps administrative fines at 100,000 pesos, worth about 67 US dollars at the central bank's official rate of 1,487.50 pesos per dollar on 14 August 2026; the same article allows suspension and closure or cancellation of the database, and article 32 inserted criminal offences into the Penal Code (articles 117 bis and 157 bis) carrying prison terms that attach to individuals, doubled for public officials. 3. Registration in the Registro Nacional de Bases de Datos remains a live obligation under article 21 - a paperwork duty that foreign-owned local entities routinely forget. 4. Ley 22.963 (the Ley de la Carta) prohibits publishing any map or publication depicting Argentine territory, in whole or in part, without prior approval by the Instituto Geográfico Nacional, requires the official version including the insular and Antarctic territories, requires an 'Aprobado por el Instituto Geográfico Nacional' credit line, and lets customs stop non-approved publications at the border. 5. BCRA Comunicación A 7724 requires technology and information-security management functions to be performed in Argentina and outsourcing to be notified to the supervisor before it starts - a people-and-process localisation rule that offshoring plans miss because it is not a data rule. 6. Bonus: more than half of all final privacy penalties are for calling numbers on the Registro Nacional No Llame under Ley 26.951, not for data-handling failures.

Pending: the 2023 reform bill (Mensaje 87/2023) would have added extraterritorial reach, a representative duty, breach notification and turnover-based fines; it was never enacted and the agency's own page on it was last updated in May 2025, while the agency continues to publish material to build support for reform. Dated items: Disposición 1/2026 of the Centro Nacional de Ciberseguridad (published 13 May 2026) gives national public sector bodies with data centres 180 days to adjust infrastructure, policies and contingency plans and to file a disaster-recovery report with at least one failover test - roughly 9 November 2026; Decreto 269/2026 is currently reshaping the cybersecurity bodies' remits. Dormant switches, which matter more than the bill: the regulator can add or remove countries from the approved-destinations list by resolution, with no consultation, so a destination can stop being usable overnight; the agency itself was created by decree under a law that lets the executive restructure it, and its head's term runs from a 2022 appointment; and Argentina's own adequacy status in the European Union is periodically reviewed by the European Commission, so an unfavourable review would change flows into Argentina rather than out of it.