Argentina was among the first countries outside Europe to be recognised by the European Commission as providing an adequate level of data protection. That status matters commercially, because it allows data to flow from the European Union to Argentina without additional safeguards, and it rests on a statute that predates most modern privacy regimes.
The framework
Law 25.326 on the Protection of Personal Data, together with Decree 1558/2001, sets the obligations. The supervisory authority is the Agency for Access to Public Information, which issues supplementary rules and hears complaints.
The statute is built around consent, purpose limitation, data quality and the rights of access, correction and deletion, with reinforced protection for sensitive data covering health, ethnic origin, political opinions, religious beliefs and union membership.
The obligation most companies miss
Databases containing personal data must be registered with the National Registry of Personal Databases. The registration is done in two stages, first the party responsible and then each database, through the government online filing platform.
An employee database qualifies. A customer list qualifies. A website contact form that stores what people submit qualifies. Compliance with this requirement is low across the market, which does not make it optional, and it is one of the first things a counterparty checks in a due diligence.
Employee data
Employment generates the most sensitive processing a company does. Medical records from pre employment and periodic examinations, absence reasons, disciplinary files, and any monitoring of communications or location.
Monitoring deserves particular care. Argentine courts weigh the employer interest against employee privacy and dignity, and monitoring that was not announced in advance, or that extends beyond what the stated purpose requires, tends to be treated as unlawful and can support a separate claim.
International transfers
Transfers to countries without adequate protection require specific safeguards. Group companies moving employee or customer data to a parent abroad, and the use of cloud services hosted outside Argentina, both fall within this and are frequently overlooked because the data never appears to leave the system the company uses every day.
What we review
The inventory of what is actually held and why, the legal basis for each processing activity, registration status, the notices given to employees and customers, monitoring practices, transfer arrangements and the procedure for responding when someone exercises their rights, which the statute answers on short deadlines.
To discuss a matter, write to estudio@mirandacalderon.com or see the contact page.