Personal Data Protection Plan: New Guidelines

The Argentinian State is one of the main entities collecting, storing, and processing personal data. Because personal data is a strategic asset for public organizations, the Federal Council for Transparency issued the Guidelines to Create a Personal Data Protection Plan for the public sector. The goal is to aid public entities to manage personal data properly.

The Guidelines emphasize the importance of documenting the Personal Data Protection Plans and of conducting regular reviews and audits of the plans. Thus, they establish that the Personal Data Protection Plans should:

1. establish the organizations’ objectives regarding the protection of personal data,
2. identify applicable rules and laws,
3. outline the methods of personal data collection, the types of data to be collected, and their internal flow,
4. define the legal bases for data processing,
5. describe the measures taken to ensure the security of personal data,
6. set retention periods,
7. establish an action plan for security incidents, including notifying authorities and affected individuals.

Further, the Guidelines highlight the essential nature of the privacy policy in the Personal Data Protection Plan, emphasizing that this document enables public entities to fulfill their duty to inform.

Regarding its content, the Guidelines recommend using the Argentine Data Protection Authority’s Resolution 40/2018 as a guide. This Resolution approved the data protection policy template for the public sector. The Guidelines also highlight the frequent hiring of foreign data hosting service providers, and state that data controllers must execute the corresponding data processing agreements.

Finally, the Federal Council for Transparency emphasizes that, while the Guidelines serve as guidance, each entity and Province should tailor them to the challenges and realities of their jurisdictions.