Paraguay Ley 7.593/2025: Automated-Decision Rights in DP Law
By Anthony Guerriero, Founder and lead analyst, The Leveraged Years. Asunción, 27 November 2025. Last verified: 2026-07-25.
Most coverage of Latin American AI rules stops at Brazil and Mexico. Paraguay rarely makes the list, which is exactly why its new statute is worth reading in full. On 27 November 2025 Paraguay promulgated Ley Nº 7.593/2025 "De Protección de Datos Personales en la República del Paraguay", a general, cross-sector personal-data law. It is a broad data-protection statute, but one provision speaks directly to how automated systems decide things about people, and that is where this piece zooms in: Article 33, which lets people have an automated decision reviewed, state their point of view, contest it, and be told the criteria behind it. This piece works only from the official text published by the Biblioteca y Archivo Central del Congreso Nacional (BACN), Paraguay's official legislative archive.
What Ley 7.593/2025 puts into Paraguayan law
Before this statute, Paraguay's data rules were sector-specific, most visibly Ley Nº 6.534/2020 on credit data. Ley 7.593/2025 adds a general, cross-sector regime on top of that. It does not sweep the older law away. Article 59 repeals only a handful of specific subsections of Ley 6.534/2020, and Article 58 provides that references to the old credit-data supervisor now point to the new agency, so the credit-data statute survives in amended form. Under Article 2, the new regime covers any processing of personal data, whether fully automated, partly automated, or manual when the data sits in a filing system. It defines controllers and processors, sets lawful bases for processing, regulates sensitive data and cross-border transfers, and, in Article 34, creates a national supervisory authority. That article gives the agency sanction powers, and Article 46 enumerates them: warnings, fines, and suspension of processing activities.
For readers tracking AI governance, the point is not that Paraguay wrote an "AI law." It did not. It wrote a data-protection law whose definitions and rights reach automated systems. The statute defines elaboración de perfiles (profiling) as "the result of processing of personal data carried out in an automated and semi-automated way to evaluate certain aspects of a natural person," and it attaches concrete rights to decisions produced that way. That framing, profiling plus a review right, is the same structural move the EU made in the GDPR and Brazil made in the LGPD.
Article 33: the right to challenge an automated decision
The operative provision is Article 33, titled Derechos ante decisiones individuales automatizadas o semiautomatizadas (Rights regarding individual automated or semi-automated decisions). The first paragraph reads:
"El titular de datos tiene derecho a solicitar la revisión de las decisiones tomadas sobre la base del tratamiento automatizado de datos personales, que afecten negativamente a sus intereses o produzcan efectos jurídicos, incluidas las decisiones encaminadas a definir sus aspectos personales, profesionales, de consumo, de crédito, de su personalidad. Asimismo, derecho a expresar su punto de vista y a impugnar la decisión."
English gloss: "The data subject has the right to request review of decisions taken on the basis of automated processing of personal data that negatively affect their interests or produce legal effects, including decisions aimed at defining their personal, professional, consumer, credit, or personality aspects. Likewise, the right to express their point of view and to contest the decision." (Ley 7.593/2025, Art. 33)
Three rights sit inside that first paragraph: review of the decision, a voice in the process, and the power to contest the outcome. The second paragraph of Article 33 adds a transparency duty rather than a general right to an explanation. The controller "must provide, whenever requested, clear, complete, and adequate information about the criteria and procedures used for the automated decision," subject to commercial and industrial secrets the controller is bound to keep. A related duty sits in the right to information. Article 27 entitles a person to learn of "the existence of automated decisions, including profiling, and at least in such cases meaningful information about the logic applied, without prejudice to the controller's intellectual-property rights" (Ley 7.593/2025, Art. 27). Read together, Article 33 and Article 27 give a right to review, a right to express a viewpoint, a right to contest, and a right to information about the criteria and procedures and, where profiling is involved, the logic applied. Neither uses the word "explanation."
Two details matter for anyone building or buying automated tools that touch Paraguayan residents. First, the right covers semi-automated decisions, not only fully automated ones, so a human rubber-stamp in the loop does not remove the obligation. Second, the statute names credit scoring and consumer profiling explicitly, the exact use cases where opaque models already drive real outcomes.
Who Ley 7.593/2025 covers
Article 2 sets a broad, extraterritorial scope. The law applies to any processing of personal data carried out by natural or legal persons, "regardless of the medium, the country of the establishment's headquarters, or the country where the data is located," in these situations: processing by a controller or processor established in Paraguay, even when the processing happens abroad; and processing by a controller or processor not established in Paraguay when it handles data of people located in Paraguayan territory, when its activities relate to offering goods or services to residents of Paraguay, or when its activities relate to monitoring the behavior of people insofar as that behavior takes place in Paraguayan territory.
In plain terms, a foreign company running an automated screening or scoring system aimed at people in Paraguay is inside the law's reach even without a local office. That mirrors the targeting logic that made the GDPR consequential far outside Europe.
When Ley 7.593/2025 takes effect
This is the part easy to get wrong. The law is enacted, but it is not yet operative. Article 57 states that "the present law shall enter into force after twenty-four months have elapsed from its official publication." With official publication on 27 November 2025, that puts the operative date at 27 November 2027. Article 60 gives the Executive the same 24 month window to issue the implementing regulation, and Article 58 folds the credit-data authority's functions into the new agency once the law is in force.
| Milestone | Date | Source |
|---|---|---|
| Approved by Chamber of Deputies | 14 October 2025 | Closing formula |
| Approved by Senate | 5 November 2025 | Closing formula |
| Promulgated and officially published | 27 November 2025 | BACN record |
| Entry into force (Art. 57) | 27 November 2027 | Art. 57 |
| Deadline for implementing regulation (Art. 60) | By 27 November 2027 | Art. 60 |
What it does not do
Reading the automated-decision right for more than it says is the common error, so here are the limits, all from the text itself.
- It does not ban automated decisions. Article 33 grants a right to review and contest after the fact. It does not require prior human approval, and it does not prohibit fully automated outcomes.
- It does not force disclosure of source code or model weights. The transparency duty is limited to "criteria and procedures" and is expressly subject to commercial and industrial secrets.
- It is not an AI Act. It regulates personal-data processing, not AI systems as a product category. There is no risk-tier system, no conformity assessment, no prohibited-use list.
- It is not in force yet. Obligations, including the Article 33 right, become enforceable on 27 November 2027, not on the 2025 promulgation date.
- It does not create a private cause for damages inside this provision. Enforcement runs through the new agency's administrative sanctions in Article 46, ranging from warnings to fines and suspension of processing.
Paraguay, Brazil, and Mexico: how automated-decision rights compare
The Paraguayan right did not appear in a vacuum. It sits within a regional pattern where general data laws, not dedicated AI statutes, carry the automated-decision protections. The table below compares the three. Only the Paraguay row was verified against its primary text for this piece; the Brazil and Mexico rows summarize their named instruments for context.
| Jurisdiction | Instrument | Automated-decision provision | What the person can do | Status |
|---|---|---|---|---|
| Paraguay | Ley 7.593/2025 | Article 33 | Request review, express a view, contest the decision, obtain the criteria and procedures used | Enacted 27 Nov 2025, in force 27 Nov 2027 |
| Brazil | LGPD, Lei 13.709/2018 | Article 20 | Request review of decisions taken solely on automated processing that affect their interests; request information on the criteria used | In force |
| Mexico | Ley Federal de Protección de Datos Personales en Posesión de los Particulares | Handled through ARCO rights (access, rectification, cancellation, opposition) rather than a single dedicated review article | Access and opposition rights that reach profiling, without an express standalone automated-decision review right of the Article 33 type | In force |
Paraguay lands closer to Brazil's model than to Mexico's, giving an explicit, named review-and-contest right rather than folding automated decisions into general access and opposition. For a company operating across the region, a single automated system may face three different framings of the same obligation, and Paraguay's is now among the more explicit.
Key facts: Ley 7.593/2025 at a glance
- Instrument
- Ley Nº 7.593/2025 "De Protección de Datos Personales en la República del Paraguay" (BACN record, id 12924).
- Issuer
- Congreso de la Nación Paraguaya; approved by Deputies 14 Oct 2025 and Senate 5 Nov 2025; promulgated by the Executive 27 Nov 2025.
- Automated-decision provision
- Article 33: right to review, express a view, and contest decisions based on automated processing, plus a duty to disclose the criteria and procedures used.
- Supervisory authority
- Article 34 creates the Agencia Nacional de Protección de Datos Personales, a deconcentrated unit within MITIC with the rank of National Directorate and sanction powers.
- Penalties
- Article 46: warnings; fines from 20 to 2,500 daily minimum wages, up to 5,000 for sensitive data, up to 10,000 for children's sensitive data; suspension of processing.
- Status
- Enacted and published 27 Nov 2025; enters into force 27 Nov 2027 (Article 57).
Frequently asked questions
What does Article 33 of Ley 7.593/2025 grant?
It gives a data subject the right to request review of decisions based on automated processing that harm their interests or produce legal effects, the right to express their point of view, and the right to contest the decision. The controller must supply clear information about the criteria and procedures behind the decision.
When does the law take effect?
It was promulgated and published on 27 November 2025. Article 57 sets entry into force at 24 months after publication, so the operative date is 27 November 2027.
Who enforces it?
Article 34 creates the Agencia Nacional de Protección de Datos Personales inside MITIC, with the rank of a National Directorate and the power to sanction.
What are the penalties?
Article 46 allows warnings, fines from 20 up to 2,500 daily minimum wages, up to 5,000 for sensitive-data breaches, up to 10,000 where the data belongs to children and adolescents, and suspension of processing.
Primary sources
- Official full text, BACN: Ley Nº 7.593/2025 De Protección de Datos Personales en la República del Paraguay
- BACN law record (numeric permalink): bacn.gov.py/leyes-paraguayas/12924