Argentina PDPL Compliance with ConsentX

Consent requirements under Argentina PDPL

Consent is a central principle under Law 25.326.

The law generally requires consent to be free, express and informed, documented in writing or through another legally equivalent means appropriate to the circumstances. When consent is combined with other declarations, the consent must be expressly and prominently presented after the required information has been provided.

The law also establishes exceptions where consent is not required, including certain data obtained from unrestricted public sources, processing required by law or governmental functions, certain limited identification lists and data necessary for an existing contractual, scientific or professional relationship.

Consent may also be revoked, although revocation does not have retroactive effect.

Privacy notice and transparency

Before collecting personal data, organisations should provide individuals with clear information about the processing activity.

The required information includes matters such as:

• The existence of the database or file
• The identity and contact details of the responsible party
• The purpose of the collection
• The intended recipients or categories of recipients
• Whether providing the requested information is mandatory or optional where applicable
• The individual's rights under the applicable privacy framework

Argentine guidance also emphasises that information provided to individuals should be clear, simple and understandable.

Data subject rights

Argentina's privacy framework provides individuals with important rights over their personal data.

These include:

• Access - obtain information about personal data held and processed
• Rectification - correct inaccurate or incomplete information
• Update - ensure personal data remains accurate and current
• Suppression - request deletion where the applicable requirements are met
• Confidentiality - request appropriate protection of personal information in applicable circumstances

The Argentine framework also provides for a habeas data action through which individuals can seek access to their data and, in applicable cases, rectification, suppression, confidentiality or updating.

Cookies and online tracking

Argentina's privacy framework can apply to cookies and online identifiers where they constitute personal data.

The Argentine government currently identifies information such as IP addresses and cookie identifiers among examples of personal data. Whether a particular cookie or tracking technology falls within the applicable requirements depends on the information collected, whether an individual can be identified and the purpose of processing.

Organisations using cookies and tracking technologies should therefore assess the data collected and provide appropriate notice and consent mechanisms where required.

Security and confidentiality

Organisations responsible for databases must implement appropriate measures to protect personal data.

Law 25.326 requires databases to meet technical and organisational conditions that protect data integrity and security. It also imposes confidentiality obligations on individuals involved in the processing of personal data, with the duty continuing after their relationship with the data controller ends.