Data privacy law: Understanding everything about Argentina’s PDPA

Author: Priyasha Purkayastha, Sr. Content Writer, TJC Group

Data privacy regulations are in force across the world; they are an integral part of modern-day living. These essential laws are designed to protect individuals and their personal data, requiring organisations to adhere to strict guidelines on data storage, handling, and processing

Introduction

Since our contemporary society is data-driven, enforcing data privacy laws for companies to comply with helps protect the privacy rights of individuals. Additionally, the personal information remains secured and protected from potential misuse or unauthorised access. As a matter of fact, if laws did not exist to safeguard personal data, there would be no trust in digital interactions, and individuals would have no control over their personal information. E-commerce and digital government services could effectively break down. Data privacy laws, therefore, are essential for not just protecting individual citizen rights but also fostering a secure environment for digital services and data exchanges.

Data privacy vs data security

Data privacy should not be confused with data security, although there is a commonality between these two terms. Data privacy focuses on handling, processing, storing, and using personal information, whereas data security refers to the protective measures implemented by organisations to prevent unauthorised data access, breaches, or data damage. Therefore, strict data security measures ensure data privacy, and both are essential for a compliance and comprehensive approach to data protection.

Understanding Argentina’s Personal Data Protection Act 25.326 (PDPA)

Across the world, different countries have introduced different data privacy laws to protect their citizens and control the activities of companies doing business in their jurisdictions. Although the laws differ from country to country, overall, they are well aligned with the leading global privacy standards, such as the GDPR in the EU, DPDP in India, and Loi 25 in Quebec, Canada.

Keeping up with TJC Group’s efforts to educate our readers on data privacy and its respective laws, this month, we are covering the Personal Data Protection Act 25.326 (PDPA) of Argentina. Here’s what you should understand about Argentina’s PDPA regulations.

At a glance – the PDPA explainer

Argentina’s PDPA law came into force in 2000 and is at the heart of the country’s data protection framework. The PDPA was designed to regulate how any organisation involved with data processing and control can collect, store, share, and disclose personal information about individuals in Argentina.

PDPA law applies equally to both private and public entities, and it is monitored for compliance by the Agencia de Acceso a la Información Pública (AAIP). Translated into English, the Agency for Access to Public Information (AAIP) is the country’s data protection authority, which also has the power to impose penalties for compliance violations.

Key definitions within PDPA

To understand the scope of PDPA, it is crucial to understand key legal terms and definitions. According to the law, Personal Data is any information about an individual or a legal entity that can be identified either directly or indirectly. Sensitive Data is any data that reveals an individual’s racial or ethnic origin, political opinions, religious beliefs, health, or sexual orientation.

What is the scope of PDPA?

The PDPA has a broad scope, and it covers all aspects of personal data processing, including collection, use, and transfer. It mandates that all data processing activities must be lawful, fair, and transparent, with explicit consent to process an individual’s data. Additionally, organisations must implement adequate security measures to protect an individual’s personal data. Moreover, they must also ensure that individual data subjects are able to access, correct, or delete their information as required.

How does PDPA impact consumers and businesses?

Designed to protect consumers, the PDPA guarantees the right for an individual to access data, correct inaccuracies, and, if needed, object to data processing. Businesses must comply with the PDPA, which means they must have robust data management practices in place to ensure the data security of individuals. Failure to comply is likely to result in a financial penalty and legal action.

Argentina’s Personal Data Protection Act (PDPA) includes the following specific measures to protect individuals as follows:

• Consumers have the right to be informed about what personal data is being collected, the purposes for its processing, and who will process it.
• Consumers can request access to any personal data being held by organisations, and they have the right to request that it be deleted when no longer needed for the purposes for which it was originally collected.
• Consumers have the right to request corrections to their personal data if they are inaccurate or incomplete.
• Consumers can object to certain data processing activities, particularly those involving automated decision-making, which ensures that individuals have full control over how their data is used.

Any organisation that processes personal data from Argentina residents, regardless of their geographical location, must comply with the PDPA. The AAIP rigorously enforces the law according to a three-tiered monitoring system to assess the severity of PDPA infractions and decide upon the corresponding penalties.

If breaches are detected, the penalties can range from a formal warning to a very significant financial fine – potentially up to 2-4% of global annual turnover. Additional penalties may include the suspension, deletion, or closure of data files.

Compliance with PDPA – Organisational obligations

PDPA applies to all organisations that are processing personal data within Argentina, regardless of where the data processing occurs. It protects the personal data of both individuals and legal entities, which is broader in coverage than the GDPR, which only focuses on individuals. PDPA also requires the same level of protection and consent to be extended to children and minors. Unlike some privacy laws, the PDPA does not impose a timeframe for notifying the authorities of a data breach.

How can businesses prepare for PDPA compliance?

To prepare for PDPA compliance, businesses will need to conduct a full data audit and ensure they have up-to-date privacy policies. They may also need to implement data protection measures.

In addition to the PDPA, Argentina has introduced other privacy-related regulations, including the Personal Data Protection Regulatory Decree, which imposes additional requirements for data processing.

Conclusion

Understanding and complying with Argentina’s PDPA regulations is crucial for all businesses that are operating in or interacting with Argentine residents. The law not only aligns with international standards but also emphasises the protection of personal data, ensuring that individuals’ privacy rights are respected and upheld. In the future, we can expect the PDPA to become more rigorous and more closely aligned with other data privacy regulations, such as GDPR.

If you would like support with any aspect of data volume management to ensure your organisation is compliant with its key data privacy regulations, contact TJC Group today!

Data privacy series

This article is part of the data privacy series. Check out other articles that might be of your interest:

• Data privacy: Your absolute guide to its importance, regulations, and more
• GDPR in the EU | A comprehensive guide to knowing all about it
• Decrypting the Digital Personal Data Protection (DPDP) Act, 2023 of India
• Quebec’s Data Privacy Law 25: What is it and how to comply with it
• Data protection law in Japan: a guide to understand APPI (tjc-group.com)
• New Zealand: The Privacy Act 2020 (coming soon)
• California Consumer Privacy Act (CCPA): Everything you need to know (coming soon)
• All about The New Jersey Data Protection Act (NJDPA) (coming soon)
• All about South Korea data protection law (PIPA): Everything you need to know (coming soon)
• Data protection laws in Middle East (coming soon)