Argentina data protection law: Law 25.326 rules for licensing records

What is Argentina's data protection law and who enforces it?#

Argentina's data protection law is the Personal Data Protection Law, Law 25.326 of 2000, applied through Regulatory Decree 1558/2001 and enforced by the Agencia de Acceso a la Información Pública (AAIP). Since Decree 746/2017, the AAIP has been the supervisory authority for the law, a change the European Commission said significantly strengthened the regulator's independence.

The law defines personal data as information of any kind about identified or identifiable natural persons or legal entities. That second part matters for business records: data about client companies, not just individual contacts, can fall within its scope.

Argentina is also a party to Council of Europe Convention 108, which it joined in 2019, and Congress approved the modernized Convention 108+ protocol through Law 27.699 in 2022. These treaties shape how the AAIP reads the law, especially on international transfers.

When do a U.S., Canadian or EU company's records include people in Argentina?#

Records include people in Argentina more often than companies expect, because the data follows customers, staff and counterparties rather than the company's headquarters. Whether Law 25.326 reaches a particular database depends on where it is held, which entity controls it and how the data was collected, which is a question for counsel admitted in Argentina.

• 1Customer records: support tickets in Zendesk, orders in Shopify or NetSuite, or CRM contacts in Salesforce or HubSpot for buyers located in Argentina.
• 2Employee and contractor records: an Argentine subsidiary's HR files, payroll exports, Slack messages and Jira comments written by a team in Buenos Aires or Córdoba.
• 3Contact-center data: call recordings and transcripts from an Argentine support or sales team, including the callers' personal details.
• 4B2B records: account and contract data about Argentine client companies, which the law can treat as personal data of legal entities.
• 5Vendor and partner data: invoices, bank details and correspondence with Argentine suppliers and their staff.

Does licensing records about people in Argentina need consent?#

Usually yes. Article 11 of Law 25.326 allows personal data to be transferred to a third party (a cesión) only for purposes tied to the legitimate interests of both sides and with the data subject's prior consent, after the person has been told the purpose and who the recipient is. That consent can be revoked.

An AI developer receiving a license to train on the records is a third party, so a licensing delivery should be planned as a cesión. The recipient takes on the same legal obligations as the company that shares the data, and the sharing company is jointly and severally liable with it before the regulator and the data subject, which is why buyers and sellers both care how the consent question was answered.

Article 5 requires consent to be free, express and informed, in writing or an equivalent form. A privacy notice or employment contract that never mentioned sharing data for AI training rarely meets that standard, and the AAIP expects the company to be able to show that the person who consented was actually the data subject.

Article 11 lists exceptions where consent is not required, including when a law provides for the transfer and when the information has been put through a dissociation procedure so that data subjects cannot be identified. For most licensing projects, that dissociation exception is the practical route, not old consents.

What counts as dissociated data under Law 25.326?#

Dissociated data is data processed so that the information cannot be associated with an identified or identifiable person. Article 2 defines dissociation that way, and AAIP criteria adopted in 2019 add that a person is not identifiable when identifying them would require disproportionate or unfeasible measures or time.

That test is about the realistic effort to re-identify, not just about removing names. Free-text fields in tickets and chat logs, call audio, rare job titles, small locations and stable IDs can all point back to a person. Hashing an email address or customer ID usually leaves a stable key that can be matched, so it is pseudonymization rather than dissociation.

Sensitive data needs extra care. Article 7 bars forcing anyone to provide sensitive data, such as health, religious, political or union information, and limits its processing to reasons of general interest authorized by law or to statistical or scientific purposes where the data subjects cannot be identified.

De-identification addresses the privacy question only. It does not settle whether the company owns the records, whether a customer contract restricts their reuse, or whether it has the contractual right to license them to a third party.

How do Argentina's international transfer rules work?#

Article 12 of Law 25.326 prohibits transferring personal data to countries or international organizations that do not provide adequate protection, with narrow exceptions such as international judicial cooperation and certain medical data exchanges. Decree 1558/2001 adds that the prohibition does not apply when the data subject has expressly consented to the transfer.

The AAIP keeps the list of adequate destinations. Disposition 60/2016, as amended by AAIP Resolution 34/2019, lists the EU and EEA member states, the United Kingdom, Switzerland, Guernsey, Jersey, the Isle of Man, the Faroe Islands, Andorra, New Zealand, Uruguay, Canada (private sector only) and Israel (automated processing only). The United States is not on the list, so a transfer to a U.S. AI developer needs consent, approved clauses or another recognized route.

Disposition 60/2016 approved model contract clauses for transfers to a third party (cesión) and to service providers, and Resolution 198/2023 added the model clauses of the Ibero-American Data Protection Network (RIPD). A company that uses a contract departing from the approved models must submit it to the AAIP for approval within 30 calendar days of signing. Binding corporate rules that follow Resolution 159/2018 cover transfers within a corporate group, not licensing to an outside developer.

The transfer test sits on top of the third-party test. A transfer to an EU developer clears Article 12 because the EU is on the adequacy list, but it still needs consent or dissociation under Article 11.

Does the EU treat Argentina as adequate, and why does that matter?#

Yes. The European Commission recognized Argentina as providing adequate protection in Decision 2003/490/EC of June 30, 2003, and its first review, published January 15, 2024, concluded that Argentina continues to provide an adequate level of protection for personal data transferred from the EU.

For an EU company, that means EU personal data can flow to an Argentine affiliate or team without extra safeguards under EU law. It says nothing about the reverse direction or about licensing: once data is held in Argentina, Law 25.326 applies to further transfers, and the EU rules on the original data still apply.

The 2024 review also noted that the AAIP raised maximum fines in 2022 through Resolutions 240/2022 and 244/2022, and the Commission encouraged Argentina to write protections developed at the sub-legislative level into law, pointing to the reform bill then in Congress.

Is Argentina's data protection law about to change?#

Not yet. Law 25.326 remained the law in force on the date this page was reviewed. The executive branch sent a bill to replace it, together with Law 26.343, to the Chamber of Deputies on June 30, 2023 (file 0012-PE-2023, Message 87/2023), but no replacement law had been enacted. An earlier 2018 reform bill lost parliamentary status.

Plan releases under the current law and check the status of the reform before any agreement is signed. A new law would likely bring rules closer to GDPR, so build consent records and dissociation evidence that would still hold up under stricter requirements.

Which registration and data-subject rights should a release plan cover?#

Article 21 requires private databases intended to provide reports to be registered with the national database registry, which the AAIP runs; the AAIP excludes only files kept for exclusively personal use. Confirm the source database is registered before preparing a release.

Data subjects keep their rights after a license is signed. Under Article 14, people can ask for access free of charge at intervals of no less than six months, and the company must answer within ten calendar days of a formal request. Agree in the license who handles access and deletion requests that touch the delivered data, and how revoked consent is honored.

Release checklist for records about people in Argentina#

Use this checklist before any records about people in Argentina leave the company. Each step names the evidence a reviewer should see and who normally owns it.

How this applies when licensing through SourceX#

SourceX works with U.S., Canadian and EU companies that had 50 or more full-time employees at their peak. When such a company's records include people in Argentina, such as customers, an Argentine subsidiary or a support team there, the questions above become part of the rights review before any release.

The first step is a short company assessment that needs no data uploads. The company approves exactly what is released, once per deal, and de-identification is performed by SourceX directly or through its processing partner. Consent, registration and transfer decisions under Law 25.326 stay with the company and its counsel, and de-identification does not by itself create a right to license.

SourceX can consider companies in Argentina when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.