AI and Law 7593 · What Your Company Has to Comply With
There is time until 2027. Use it.
What Paraguay's new personal data protection law changes for companies that use artificial intelligence.
Law 7593/2025 is Paraguay's first general personal data protection law.
It applies from the end of November 2027 to companies and public bodies.
For anyone using AI with customer or employee data, it changes five concrete
things.
Updated: 27 October 2026 · By Andreas Walther, founder of Contrast Concepts
This guide is for information and is not legal advice. The articles cited were checked against the official text of the law (in Spanish). For specific decisions, consult a lawyer.
The timeline
2025 · Publication
The law was promulgated and published on 27 November 2025. It creates
the National Personal Data Protection Agency, within MITIC and with functional
autonomy.
Until 2027 · Regulation pending
The Executive has 24 months to issue the implementing decree (Article
60). Several details depend on it, for example which companies must appoint
a data protection officer.
November 2027 · Entry into force
24 months after publication (Article 57): the end of November 2027. From
then on, the Agency can supervise, receive complaints and impose sanctions.
What changes for companies using AI
Five articles worth knowing.
Automated decisions
A person can ask for a review of a decision based on automated processing
that affects them, and learn the criteria used. If an AI screens candidates,
scores customers or approves credit, someone has to be able to review it.
Data leaving the country
Personal data may only go abroad with an adequate level of protection
or appropriate safeguards. The big AI providers process outside Paraguay,
so this applies almost always.
A contract with the provider
Whoever processes data on your company's behalf, such as an AI provider,
is a data processor. You need a contract that sets which data, for what
purpose, for how long and with what obligations.
Impact assessment
Mandatory, among other cases, for systematic automated profiling with
legal effects, or for processing sensitive data on a large scale.
Incidents within 72 hours
If there is a breach, you must notify the authority and, where applicable,
the people affected, within 72 hours of the company becoming aware of it.
What to prepare before 2027
A practical list, from simplest to most work.
- A written rule on which data may go into AI tools and which may not.
- Company accounts, not personal ones, in ChatGPT, Claude, Gemini or whatever tool you use.
- A list of what personal data the company holds and where: systems, spreadsheets, WhatsApp, email, AI tools.
- For each use, the legal basis: contract, consent, legal obligation or legitimate interest.
- Data processing agreements with every provider that processes data for you.
- An up-to-date privacy notice that is always accessible.
- A person who reviews what the AI decides when it affects someone.
- An incident plan: who decides, who notifies and how, within 72 hours.
People's rights and sanctions
Anyone can request access to, correction, deletion, objection to and portability
of their data (Article 26). The company must answer within 30 calendar
days at most, free of charge.
They also have the right to be told, when they hand over their data, who processes it and for what (Article 27).
They also have the right to be told, when they hand over their data, who processes it and for what (Article 27).
Fines range from 20 to 2,500 daily minimum wages, up to 5,000 with sensitive
data and up to 10,000 with sensitive data of children and adolescents (Article
46).
The authority can also suspend the data processing, which for an automated process means switching it off.
The authority can also suspend the data processing, which for an automated process means switching it off.
Frequently asked questions about Law 7593
- When does Law 7593 apply?
- The law was published on 27 November 2025 and enters into force 24 months after publication (Article 57), that is, at the end of November 2027. The Executive has the same period to issue the implementing regulation.
- Can I use ChatGPT or another AI with customer data?
- Yes, if there is a legal basis for that use, a contract with the provider as a data processor (Article 11) and safeguards for the transfer abroad (Article 19). In practice: business accounts with a data processing agreement, not personal accounts.
- Do I need every customer's consent?
- Not always. Article 5 allows other bases besides consent, such as performing a contract, a legal obligation or legitimate interest. Which one applies depends on each use of the data, and it is worth putting in writing.
- Does my company need a data protection officer?
- The law requires one in the cases the implementing regulation will define (Article 18), which has not been issued yet. It can be someone on the team or a contracted service.
- What fines does the law set?
- From 20 to 2,500 daily minimum wages, up to 5,000 for sensitive data and up to 10,000 for sensitive data of children and adolescents (Article 46). The authority can also suspend the data processing.
Do you know where your customers’ data is?
Book a free 60-minute call. We’ll look at how you use AI today and what is worth sorting out before 2027. No sales sequence.