EY and AHK Paraguay Briefing on the New Data Protection Framework

On August 6, professional services firm EY Paraguay and the Paraguayan-German Chamber of Commerce and Industry (AHK Paraguay) convened an after office session at the Torre de las Américas in Asunción. The event gathered executives, legal specialists and industry representatives to dissect the new Personal Data Protection Law and its practical implications for companies.

Speakers included Juan Pablo Grisolía, financial services and business consulting partner at EY Argentina; Jorge L. Garnier, legal services leader at EY Argentina with over 20 years’ international experience in corporate law and compliance; and Nabila Larroza, legal services manager at EY Paraguay specializing in digital law and AI regulation. Together they outlined how the new law aligns with the EU’s General Data Protection Regulation (GDPR) and what that means for corporate governance, data transfers, cybersecurity and the responsible use of artificial intelligence.

Why Paraguay’s GDPR-Style Law Matters for Business

The discussion underscored that Paraguay’s legislation borrows heavily from GDPR principles, making it one of Latin America’s most comprehensive data protection frameworks. Businesses that already comply with GDPR—often because they handle European customer data—will find the transition smoother, but local firms face a steep learning curve. The panel highlighted the convergence of privacy, cybersecurity and AI governance as a critical operational challenge; companies will need to integrate legal, IT and risk management functions rather than treat compliance as a standalone project.

The presence of AHK Paraguay signals the importance for companies trading with Germany and the wider EU. Demonstrating GDPR-equivalent data protection can become a competitive differentiator when seeking partnerships or supply chain contracts. However, enforcement remains untested, and the business community must watch for regulatory guidance on issues like international data transfers and AI processing.

Advertisement

Immediate Steps for Companies

For organizations in Paraguay, the event served as a call to move from awareness to action. While the law’s full implementing regulations are still being shaped, companies can already:

  • Map data flows — conduct a thorough audit of what personal data is collected, where it is stored, and how it moves, especially across borders.
  • Appoint a data protection officer where required, and train staff on the new obligations to reduce legal exposure.
  • Review vendor and partner contracts to ensure they contain adequate data processing clauses aligned with GDPR-style standards, particularly if any EU customer data is involved.