Paraguay Law on Protection of Personal Data (Law No. 6534/2020)

Per Paraguay Law 6534/2020: international data transfer. Requirements include (a) restrict transfer of patrimonial credit data internationally except where conditions are met including adequacy + appropriate safeguards + explicit consent + necessity for contract/legal obligation/vital interests + (b) document transfer impact assessments where appropriate + (c) maintain inventory of cross-border data flows + recipients + safeguards + (d) implement contractual protections with processors + sub-processors involving international transfer + (e) maintain records for regulator inspection.

• Paraguay Law 6534 evidence for PARAGUAY-6

• database registration + processor controls partial

Per Paraguay Law 6534/2020: ARCO rights + patrimonial update. Requirements include (a) implement Right of Access enabling data subjects to confirm processing + obtain copy + (b) implement Right of Rectification of inaccurate or incomplete personal data + (c) implement Right of Cancellation/Erasure where lawful basis no longer applies + (d) implement Right of Opposition to processing + (e) implement Right of Patrimonial Information Update including obligation to update credit information including resolution of debt + (f) implement Habeas Data action enabling judicial remedy + (g) maintain mechanism for receiving + verifying + processing + responding to requests within statutory timelines.

• Paraguay Law 6534 evidence for PARAGUAY-3

• database registration + processor controls partial

Per Paraguay Law 6534/2020: enforcement + lifecycle. Requirements include (a) cooperate with Supervisory Authority and Enforcement + (b) understand Penalties for breach of obligations under the Law + (c) support Habeas Data and Judicial Remedies for data subjects + (d) accept Liability for Damages from breach of personal data protection obligations + (e) implement Retention and Deletion including retention schedules + secure deletion when no longer required + (f) implement Direct Marketing and Opt-Out safeguards including suppression lists + (g) deliver Training and Awareness programme covering Law 6534 + privacy + security + breach response across personnel + (h) maintain governance + lifecycle management + continuous improvement.

• Paraguay Law 6534 evidence for PARAGUAY-8

• database registration + processor controls partial

Per Paraguay Law 6534/2020: governance + accountability. Requirements include (a) maintain Records of Processing and Database Registration with the supervisory authority where required + (b) maintain Processor Obligations and Contracts ensuring processors process only on instructions + maintain security + assist with rights + breach notification + (c) maintain Confidentiality Duty across personnel handling personal data with appropriate confidentiality undertakings + (d) implement supplier + processor + sub-processor due diligence + ongoing oversight + (e) cooperate with the supervisory authority including providing information + facilitating audits + (f) maintain documented governance + accountability framework.

• Paraguay Law 6534 evidence for PARAGUAY-7

• database registration + processor controls partial

Per Paraguay Law 6534/2020: heightened safeguards for high-risk processing. Requirements include (a) apply higher protection for Sensitive Data including health + biometric + religious + political + sexual orientation + (b) apply heightened safeguards for Patrimonial Credit Information including accuracy + truthfulness + timeliness + (c) implement Children's and Adolescents' Data protections per the Law + Paraguayan civil age + (d) implement Ethical Standards for processing including dignity + non-discrimination + transparency + (e) maintain documented risk assessment + safeguards + (f) integrate with broader privacy programme.

• Paraguay Law 6534 evidence for PARAGUAY-4

• database registration + processor controls partial

Per Paraguay Law 6534/2020: lawful basis + consent + notice. Requirements include (a) obtain valid consent of the data subject that is free + specific + informed + with mechanism for withdrawal + (b) recognise lawful basis for processing patrimonial credit information per the Law + (c) provide notice to data subjects covering identity of controller + purposes + categories + recipients + retention + rights + (d) implement special protections for sensitive data + patrimonial information + (e) maintain records of consent + privacy notices + (f) maintain change management for consent and notice updates.

• Paraguay Law 6534 evidence for PARAGUAY-2

• database registration + processor controls partial

Per Paraguay Law No. 6534/2020 on Protection of Personal Data of Patrimonial Credit: scope + definitions + processing principles. Law 6534/2020 focuses on patrimonial credit information. Requirements include (a) determine applicability of Law 6534/2020 to credit-related personal data processing in Paraguay + (b) apply key definitions including personal data + patrimonial credit information + data subject + data controller + database + (c) apply processing principles including lawfulness + finality (purpose limitation) + quality + truthfulness + accuracy + completeness + integrity + (d) document applicability + classification + (e) maintain records demonstrating principle compliance + (f) align internal definitions with Law 6534/2020.

• Paraguay Law 6534 evidence for PARAGUAY-1

• database registration + processor controls partial

Per Paraguay Law 6534/2020: security of processing. Requirements include (a) implement appropriate technical + organisational security measures appropriate to risk + nature of patrimonial credit data + (b) maintain measures including pseudonymisation + encryption + ongoing confidentiality + integrity + availability + resilience + restoration capability + regular testing + (c) maintain Data Integrity + Data Accuracy as foundational principles + (d) implement Data Loss Prevention + Information Security baselines + (e) implement security testing + monitoring + improvement + (f) integrate with broader information security programme + (g) maintain incident response capability.

• Paraguay Law 6534 evidence for PARAGUAY-5

• database registration + processor controls partial