Data Protection in Paraguay and Chile: A Comparative Analysis and Assessment Against the GDPR Standard

Abstract

This article presents a comparative analysis of Paraguay’s Law No. 7593/2025, Law on the Protection of Personal Data in the Republic of Paraguay; its predecessor, Law No. 6534/2020, Law on the Protection of Personal Credit Data; Chile’s Laws No. 21,719 and No. 21,663; and the European Union’s General Data Protection Regulation (GDPR). The objective is to assess Paraguay’s degree of normative and institutional alignment with the international standard, considering the shortcomings revealed during the 2025 cybersecurity crisis. The study uses a qualitative approach, a non-experimental design, and a descriptive-analytical scope, through a structural comparative legal methodology and the documentary analysis of legislation, specialized scholarship, and institutional reports. The comparison is organized according to governing principles, data subject rights, accountability, data breaches, international transfers, automated processing, supervisory authorities, and sanctions. The results show that Paraguay’s new legislation formally brings the country closer to the GDPR and overcomes the previous sectoral model. However, challenges persist regarding the implementation of the supervisory authority, institutional coordination, and technical capabilities to prevent and respond to incidents. The Chilean model presents greater specialization by distinguishing legal supervision from the technical management of cybersecurity. It is concluded that the effectiveness of Paraguay’s regime will depend on the authority’s autonomy and resources, the application of accountability, and coordination with cybersecurity agencies to transform normative guarantees into effective protection of fundamental rights.