Argentina

Ley 25.326 article 1 covers data held in any file, register, database or other technical means, public or private. The Spanish text reads 'asentados en archivos, registros, bancos de datos, u otros medios tecnicos de tratamiento de datos'. It is grounded in article 43 of the Constitution, the habeas data right. Unlike Brazil's LGPD or Europe's GDPR, there is no clause applying it to companies with no presence in Argentina. There is no rule making you appoint a local representative either. The 2023 reform bill would have added both. Journalistic sources are expressly excluded. The law also applies to companies as well as people, 'in so far as relevant'. That is unusual internationally, and it means company data can be covered. The regulator's own register of final penalties shows action against Google Argentina SRL in 2020, which is a locally registered company.

Ley 25.326 article 12 bans sending data to countries or international bodies that do not protect it well enough. There are narrow exceptions. They cover court cooperation, medical and epidemiological exchange for treatment, banking and stock-exchange transfers, treaty duties, and intelligence work against organised crime and terrorism. The AAIP's approved destinations are the European Union and European Economic Area states, the United Kingdom and Switzerland. They also include Guernsey, Jersey, the Isle of Man, the Faroe Islands, Andorra, New Zealand and Uruguay. Israel is approved for automated work only, and Canada for the private sector only. Our industry search turned up duties that sit near storage, rather than rules forcing data to stay in Argentina. The central bank requires technology and information-security management to be carried out in Argentina. It also requires you to tell the supervisor before you outsource any process. The supervisor must get unrestricted access, written into the contract and into every subcontract, 'con independencia de la ubicacion geografica'. The insurance rulebook requires records to be held at the company's registered office in Argentina and made available to the supervisor. It has no chapter on cloud, cybersecurity or where data must sit. The public sector's new resilience rule requires a second data centre. It does not say where that centre must be. We found no health, telecom or securities rule requiring data to stay in Argentina.

The rules are Disposición DNPDP 60-E/2016, which sets the model clauses and the approved-country list. Resolución AAIP 34/2019 updated that list, including for the United Kingdom. Resolución AAIP 159/2018 sets the criteria for company-wide binding rules. Those need no formal approval if they follow the published guidance. Resolución AAIP 198/2023, from October 2023, added another option. It adopted the Ibero-American Data Protection Network model clauses. There is one set for passing data to another company that decides how to use it, and one for passing it to a supplier. Non-standard contracts go to datospersonales@aaip.gob.ar within 30 days of signature. Traffic the other way matters commercially too. The European Commission treats Argentina as a safe destination, so European data can flow in with no extra paperwork.

Beatriz de Anchorena has led the AAIP since Decreto 110/2022, following a public hearing process. The agency's own authorities page still showed her in post on 18 August 2026. Its structure includes a dedicated Dirección Nacional de Protección de Datos Personales. The register of final penalties lists 244 of them. That is 111 under the data protection law (Ley 25.326) and 133 under the do-not-call law (Ley 26.951). They run from 2016 to a most recent final decision in September 2025. Named targets include banks, telecoms operators, Google Argentina, Andreani Logística and Swiss Medical. So enforcement is steady and low-key rather than dramatic. For large firms the industry regulators matter more. They are the central bank (BCRA), through its Superintendencia de Entidades Financieras y Cambiarias, and the securities regulator (CNV). They also include the insurance regulator (SSN), the telecoms regulator (ENACOM) and the financial intelligence unit (UIF). Since Decreto 941/2025 there is also a new Centro Nacional de Ciberseguridad. It was publicly launched on 21 May 2026 and is already issuing binding technical rules for government bodies.

MINIMUM KEEP-TIMES. Ley 25.246 article 21, as amended by the 2024 reform Ley 27.739, sets a minimum of ten years. It covers all records needed to reconstruct transactions, plus customer checks and business correspondence. Ley 26.529 article 18 sets ten years from the last entry for a clinical record, tied to the contract limitation period. BCRA Comunicación A 7724 requires information supporting accounting entries and audit logs to be recoverable for no less than six years. It must be available to the supervisor immediately. MAXIMUM KEEP-TIMES. Ley 25.326 article 4.7 makes you destroy data once you no longer need it for the purpose you collected it for. Article 26.4 limits credit-worthiness data to the last five years, dropping to two years once the debt is paid. CLASHES. The minimum keep-time wins. Article 16.3 blocks deletion where a law requires you to keep the data. The ten-year telecom keep-time is a special case. See the telecom rule below.

The general law has no article on reporting breaches. Resolución AAIP 47/2018 approved 'medidas de seguridad recomendadas' for computerised and paper systems. It says on its face that these are advice, not commands. Banks, payment service providers on the BCRA register and systemically important payment infrastructures are different. The consolidated RRCI text is Comunicación A 7266, last updated by A 8280 and consolidated on 17 July 2025. It requires a first notice to the Gerencia de Auditoría Externa de Sistemas within the first hour. You must send frequent updates while the incident lasts more than an hour. You must send a root-cause closing report within five calendar days, by email to audext.incidente@bcra.gob.ar. Reportable incidents expressly include loss or unauthorised disclosure of customer data. They also include incidents that start at a third party, or anywhere in its supply chain. Public sector bodies report through CERT.ar under the cybersecurity rules. So one incident at a bank using a foreign cloud provider can start the one-hour central bank clock. No clock runs to the privacy regulator at all.

1. Ley 25.326 article 14 gives you ten calendar days to answer an access request. Article 16 gives you five working days to correct, update or delete. That is far shorter than the one month common elsewhere. Miss the deadline and the person can bring a habeas data court action. 2. Article 31 caps administrative fines at 100,000 pesos. That was worth about 67 US dollars at the central bank's official rate of 1,487.50 pesos per dollar on 14 August 2026. The same article allows suspension, and closure or cancellation of the database. Article 32 added criminal offences to the Penal Code, at articles 117 bis and 157 bis. They carry prison terms that fall on individuals, doubled for public officials. 3. You must still register in the Registro Nacional de Bases de Datos under article 21. It is a paperwork duty that foreign-owned local companies routinely forget. 4. Ley 22.963, the Ley de la Carta, covers maps. You may not publish any map or publication showing Argentine territory, in whole or in part. You need approval from the Instituto Geográfico Nacional first. You must use the official version, including the island and Antarctic territories. You must carry an 'Aprobado por el Instituto Geográfico Nacional' credit line. Customs can stop unapproved publications at the border. 5. BCRA Comunicación A 7724 requires technology and information-security management to be carried out in Argentina. You must also tell the supervisor before outsourcing starts. This is a rule about where people and work sit, not about where data sits, so offshoring plans miss it. 6. One more. More than half of all final privacy penalties are for calling numbers on the Registro Nacional No Llame under Ley 26.951, not for mishandling data.

PENDING. The 2023 reform bill (Mensaje 87/2023) would have made the law apply to companies with no presence in Argentina. It would have added a local representative duty, breach reporting, and fines based on turnover. It was never passed. The agency's own page on it was last updated in May 2025. The agency keeps publishing material to build support for reform. DATED ITEMS. Disposición 1/2026 of the Centro Nacional de Ciberseguridad was published on 13 May 2026. It gives national public sector bodies with data centres 180 days to adjust infrastructure, policies and contingency plans. They must also file a disaster-recovery report with at least one failover test. That lands around 9 November 2026. Decreto 269/2026 is currently reshaping what the cybersecurity bodies each cover. POWERS ALREADY HELD, which matter more than the bill. The regulator can add or remove countries from the approved-destinations list by resolution, with no consultation. So a destination can stop being usable overnight. The agency itself was created by decree, under a law that lets the government restructure it. Its head's term runs from a 2022 appointment. The European Commission also reviews Argentina's own approved status from time to time. An unfavourable review would change data coming into Argentina rather than data leaving it.