Paraguay: passenger data record

The 2025 data protection law

The Chamber of Deputies approved Ley Nº 7593/2025 on 14 October 2025 and the Senate on 5 November 2025 ¹. It was promulgated and published on 27 November 2025 ¹. It takes effect 24 months after publication, and the Executive must issue implementing regulations within the same period (articles 57 and 60) ¹.

The law creates the Agencia Nacional de Protección de Datos Personales as a deconcentrated unit of MITIC with functional autonomy (article 34) ¹. A Director General and a deputy are appointed by decree from a MITIC shortlist after a public competition, for three-year terms (articles 37 and 40) ¹.

• Biometric data used for unique identification is sensitive data (article 3) ¹. Processing it is prohibited except under listed grounds such as explicit consent (article 20) ¹.
• Large-scale processing of sensitive data needs a prior impact assessment (article 14) ¹.
• Fines run from 20 to 2,500 minimum daily wages, up to 5,000 for sensitive data and 10,000 for sensitive data of children and adolescents (article 46) ¹.
• Where the violator is a public institution, the agency issues a warning and corrective orders, and the institution handles disciplinary proceedings (article 50) ¹.

What the law says about migration data

Article 2 excludes processing for public security, migration, defence, national security and criminal investigation from the law's scope ¹. That processing must still respect fundamental rights and be necessary and proportionate, and the general principles apply as far as they are compatible ¹.

Public bodies may process and share data without consent when it is needed for their functions or public policies (articles 5, 20 and 25) ¹. Transfers abroad need an adequate level of protection, assessed by the agency, or safeguards such as contractual clauses (article 19) ¹. Exceptions include treaty obligations and judicial and intelligence cooperation ¹.

The migration agency

President Mario Abdo Benítez promulgated Ley Nº 6984 de Migraciones on 17 October 2022, as reported by Martín Riveros in ABC Color ⁴. That report referred to the Dirección General de Migraciones ⁴.

Paraguay's July 2024 follow-up report to the UN Committee on Migrant Workers says Ley 6984/2022 was promulgated and published in October 2022 and repealed Ley 978/1996 ³. The report refers to the agency as the Dirección Nacional de Migraciones (DNM) ³. It says 2023 training on border issues with the EU, the US government and IOM covered effective information exchange at the border ³.

The API/PNR project

On 25 June 2025 DNM director Jorge Kronawetter and DINAC president Nelson Mendoza signed an agreement that formally starts an API/PNR project for air entry points, as reported by Juan Massare in ABC Color ². The report said Paraguay was one of the few countries in the region without such a system ².

The agreement lays groundwork to jointly design a national system to receive, process and protect API/PNR data, coordinated with other security agencies ². The report gave no deadline, data fields, retention period or supplier ².

Contracts and official findings

We found no vendor contract, hosting arrangement or passenger fee for an API/PNR system in the records we opened ². We found no Contraloría General de la República finding on DNM data systems in those records ³.

Chronology