Ley 7593/2025 art. 33 — an LGPD-style right to REQUEST REVIEW, not a prohibition, and the only ADM rule in the atlas whose trade-secret carve-out protects the data subject's own secrets
Binds Responsables and encargados del tratamiento — controllers and processors, natural or legal persons, public or private. Art. 2 fixes an extraterritorial reach on the GDPR art. 3 pattern and says so expressly, applying «independientemente del medio, país de su sede o el país donde se encuentren los datos»: (a) any controller or processor established in Paraguay, even where the processing happens abroad; and (b) a controller or processor NOT established in the national territory where it processes data of natural persons situated in Paraguayan territory (except for transit purposes), where its processing activities relate to the offering of goods or services directed at residents of Paraguay, or where they relate to monitoring the behaviour of natural persons to the extent that behaviour takes place in Paraguay. The first non-establishment limb is broader than GDPR art. 3(2), which requires an offering or monitoring nexus; Paraguay's limb (b)(i) catches mere processing of data of people located in the country. The Law covers only data of personas físicas (art. 1). Out of scope: purely household or family activity with no disclosure or commercial purpose, and processing for public security, migration, defence, national security and criminal matters, investigation and law enforcement — the last subject to a proportionality and fundamental-rights proviso rather than a clean carve-out.. Art. 33 of Ley N° 7593/2025 «De Protección de Datos Personales en la República del Paraguay» (promulgated and published 27 November 2025) is headed «Derechos ante decisiones individuales automatizadas o semiautomatizadas» and reads: «El titular de datos tiene derecho a solicitar la revisión de las decisiones tomadas sobre la base del tratamiento automatizado de datos personales, que afecten negativamente a sus intereses o produzcan efectos jurídicos, incluidas las decisiones encaminadas a definir sus aspectos personales, profesionales, de consumo, de crédito, de su personalidad. Asimismo, derecho a expresar su punto de vista y a impugnar la decisión.» The shape is Brazilian LGPD art. 20, not GDPR art. 22. There is no prohibition and no «solely» — nothing is forbidden ex ante, so a controller may lawfully run a fully automated decision and the subject's remedy is an ex post request for review. Widely circulated secondary summaries describe Paraguay as importing «the right not to be subject to automated decisions» on the GDPR model; the enacted text does not say that, and the difference is the whole substance of the article. Two further widenings follow from dropping the GDPR frame. The heading and the operative words reach «semiautomatizadas» decisions, so partial automation with a human in the loop is inside the article rather than outside it — the opposite of the «únicamente» escape that Panama, Uruguay and every Directive 95/46 descendant rely on. And the trigger is disjunctive and asymmetric: decisions that «afecten negativamente a sus intereses» OR that «produzcan efectos jurídicos». The first limb is a bare adverse-interest test with no significance threshold at all, materially lower than GDPR art. 22's «le afecte significativamente de modo similar»; the second is unqualified legal effect, so unlike Panama's art. 19 a favourable legal effect still engages the right. The illustrative list — «aspectos personales, profesionales, de consumo, de crédito, de su personalidad» — is LGPD art. 20's list with «de consumo» added. The second paragraph is the explanation duty: on request the controller must give «información clara, completa y adecuada sobre los criterios y procedimientos utilizados para la decisión automatizada», qualified by «con observancia del respeto por secretos comerciales e industriales del titular o que el titular se vea obligado por ley o por contrato a guardar». That carve-out is unique in the atlas. LGPD art. 20 §1 reserves the CONTROLLER's commercial and industrial secrets, and that reservation is what has made the Brazilian provision hard to enforce; Paraguay's text instead attaches the secrets to «el titular», which the Law's own art. 3 definition fixes as the data subject. Read literally the controller may withhold the logic only to protect the SUBJECT's trade secrets or the subject's own confidentiality duties — a carve-out that would almost never bite and that inverts the protection it was copied from. The row is published on the enacted wording; whether this is a drafting slip to be cured by the reglamento is not something the gazette text answers, and no reglamento exists yet. There is no exhaustive-consent-or-contract exit list of the GDPR art. 22(2) kind, and no bar on automated decisions over sensitive data. The third paragraph adds a general duty to «adoptar las medidas adecuadas para salvaguardar los derechos del titular» and a non-exclusivity clause. Profiling is defined at art. 3 («Elaboración de perfiles») in GDPR art. 4(4) terms and covers processing carried out «de forma automatizada y semi automatizada», but art. 33 never mentions profiling; the link is made instead by art. 27, the information duty, which requires disclosure of «la existencia de decisiones automatizadas, incluida la elaboración de perfiles y, al menos en tales casos, información significativa sobre la lógica aplicada, sin que ello afecte derechos intelectuales del responsable del tratamiento» — GDPR art. 13(2)(f) with an intellectual-property carve-out that, unlike art. 33's, does run in the controller's favour. Art. 14 requires a data-protection impact assessment for «evaluación sistemática y completa de aspectos personales de titulares de datos basada en tratamiento de datos automatizado, incluyendo la elaboración de perfiles, y sobre cuya base se adopten decisiones que produzcan efectos jurídicos para las personas físicas o afectación significativa de modo similar» — note that the DPIA trigger keeps the GDPR significance threshold that art. 33 discards, so the article that creates the right is broader than the article that requires the risk assessment.
Enacted but not yet applicable. The Law was approved by the Cámara de Diputados on 14 October 2025 and by the Cámara de Senadores on 5 November 2025 and so «queda sancionado, de conformidad con lo dispuesto en el artículo 207 numeral 2) de la Constitución» (art. 61); the Biblioteca y Archivo del Congreso Nacional record for Ley N° 7593/2025 carries «Promulgación: 27-11-2025» and «Publicación: 27-11-2025». Art. 57 is the whole vigencia clause — «La presente ley entrará en vigor luego de transcurridos veinticuatro meses de su publicación oficial» — and it names no date, so the first day of application is computed rather than read off. The computation is governed by the Código Civil (Ley N° 1183/1985), whose art. 342 makes arts. 337 to 341 applicable to «todos los plazos señalados por las leyes, por los jueces, o por las partes en los actos jurídicos, siempre que en las leyes o en esos actos no se disponga de otro modo», and Ley 7593 disposes nothing else. Art. 339 fixes the terminal day — «El plazo establecido por meses o por años concluirá al transcurrir el día del último mes que tenga el mismo número que aquél en que comenzó a correr el plazo» — and art. 341 adds that «todos los plazos serán contínuos y completos, debiendo siempre terminar en la media noche del último día». Twenty-four months from the publication of 27 November 2025 therefore run out at the midnight ending 27 November 2027, and because art. 57 makes the Law effective only «luego de transcurridos» — once the twenty-four months have ELAPSED — the first day on which it applies is 28 November 2027. That is the date carried in this row. It was previously carried as 27 November 2027; that date is not supported by arts. 339 and 341, under which 27 November 2027 is a day the plazo is still running. A stricter alternative would have the plazo begin to run on 28 November 2025 rather than on the day of publication, by analogy with art. 338 («si el plazo está señalado por días a contar desde uno determinado, quedará éste excluido del cómputo») and with art. 1 of the same Code, under which laws bind «desde el día siguiente al de su publicación»; on that reading art. 339's same-numbered day is 28 November 2027 and the first day of application is 29 November 2027. Art. 338's dies a quo rule is on its face confined to plazos «señalado por días», so this row takes 28 November 2027 and records the 29 November 2027 alternative rather than resolving it. No reading of the Code yields 27 November 2027. This is a computation question inside a single primary source, not a conflict between two primary sources. Nothing in the atlas applies to Paraguay before that date. The only data-protection statute currently in force, Ley N° 6534/2020 «De Protección de Datos Personales Crediticios», is credit-data only and contains no automated-decision rule; Ley 7593 does not repeal it but amends it, derogating arts. 3(a), 3(b), 4, 20(b) and 21(x) (art. 59) and redirecting every reference in it from the Secretaría de Defensa del Consumidor y el Usuario to the new regulator (art. 58). Art. 34 creates that regulator, the Agencia Nacional de Protección de Datos Personales, as a deconcentrated unit inside the Ministerio de Tecnologías de la Información y Comunicación with the rank of Dirección Nacional and functional autonomy — so the enforcement body does not exist yet either. Art. 60 requires the Poder Ejecutivo to issue the reglamento within twenty-four months of publication in the gaceta oficial, i.e. by the same November 2027 mark at which the Law bites, leaving open the possibility that the Law becomes applicable with the implementing rules only just made or not made at all. Re-check at the reglamento and at the constitution of the Agencia; either could change the art. 33 reading, particularly the «secretos comerciales e industriales del titular» carve-out. Re-checked on 31 August 2026 against the Biblioteca y Archivo del Congreso Nacional record for Ley N° 7593/2025: the enacted text of arts. 33, 57 and 60 is unchanged, the record still carries «Fecha de Promulgación: 27-11-2025» and «Fecha de Publicación: 27-11-2025», and it records no corrigendum, amending law or implementing decree. No reglamento under art. 60 and no instrument constituting the Agencia Nacional de Protección de Datos Personales had been published as of that date.
Stated maximum penalty — 20 to 2,500 jornales mínimos «para actividades diversas no especificadas», rising to 5,000 jornales where the infraction concerns sensitive data and to 10,000 jornales where it concerns sensitive data of children and adolescents (art. 46). At the jornal mínimo of G. 117.077 fixed by Resolución MTESS N° 670/2026 with effect from 1 July 2026, that is roughly G. 2,34 million to G. 293 million (about USD 320 to USD 40,000), G. 585 million (about USD 80,000) for sensitive data and G. 1.171 million (about USD 160,000) for children's sensitive data — indicative only, since the jornal is re-fixed by the Executive and will have moved before the Law applies in November 2027. There is no turnover-based alternative. Art. 46 also allows an apercibimiento with a deadline for corrective measures and suspension of processing activities, cumulatively or separately, and art. 42 gives the Agencia corrective measures (cessation or suspension of processing, deletion of the data, imposition of technical, legal or organisational measures) whose appeal has no suspensive effect. A breach of art. 33 is fineable only through a residual catch-all, which is the same structural gap Panama's art. 19 has. Art. 43 classifies faltas as leves or graves only, and both enumerations reach the ARCO-plus-portability set while omitting the automated-decision right: art. 44 lists failures to honour «los derechos de acceso, rectificación, supresión, limitación del tratamiento o a la portabilidad» and art. 45 the reiterated obstruction of «acceso, rectificación, supresión o a la portabilidad». The words «decisión automatizada» and «revisión» appear nowhere in arts. 44 to 45. The route in is therefore the final item of art. 44 — «El incumplimiento de las obligaciones legales o reglamentarias, siempre y cuando las mismas no hayan sido catalogadas como faltas graves» — so refusing a review under art. 33 is a falta LEVE, prescribing in one year (art. 44) rather than two (art. 45). Art. 46 states its 20–2,500 band without splitting it between leves and graves, so the ceiling is not formally reduced by the classification; art. 47 supplies the graduation criteria. Art. 41 preserves the constitutional hábeas data guarantee and a separate judicial action for damages.