Meet Resolution 132/2018 and Law 25.326 duties with less manual work

Resolution 132/2018 is a rule issued by Argentina's Agencia de Acceso a la Información Pública (AAIP) setting the procedure for registering personal databases with the National Registry of Personal Databases. It requires registration, modification and deregistration to be filed online through the TAD or GDE platforms, without official fees or annual renewal. It works under Personal Data Protection Law 25.326, which sets the underlying data protection obligations.

Controllers of personal databases covered by Law 25.326 must register them with the National Registry of Personal Databases, using the procedure in Resolution 132/2018. This covers public sector bodies and private organisations. Foreign controllers without a local presence can also register, as the AAIP added an online form for them in 2022. Organisations should take legal advice on whether each database falls within the registration duty.

Resolution 132/2018 moved database registration online. Filings now go through the TAD remote procedures platform or the GDE electronic document system, carry no official fee and do not need renewing every year. Controllers must report later changes by sworn declaration. The resolution also required existing databases to re-register, with deadlines in 2019 that have now passed, and it repealed earlier registration rules.

The AAIP enforces Law 25.326 and can apply the sanctions set out in Article 31 of the law, which include warnings, fines, suspension and closure of the database. Failing to register a database, or keeping inaccurate registration details, can lead to enforcement action. Penalty levels have been updated by later AAIP rules, so check the current amounts with the regulator or a local adviser.

Resolution 132/2018 is narrower than GDPR. It deals with registering databases, while Law 25.326 sets principles similar to GDPR such as data quality, consent, security and rights of access, rectification and deletion. GDPR has no general database registration duty. The European Commission recognises Argentina as providing adequate protection, so organisations already working to GDPR will find much of their control evidence reusable.

To comply, identify the personal databases you control, document their purpose, data categories, security measures and recipients, then register them through the AAIP's online procedure and report any later changes. You also need to meet the Law 25.326 obligations behind the registration, including consent, data security, confidentiality and handling data subject requests. Keeping a live data inventory makes this far easier.

No. Resolution 132/2018 is a legal obligation, not a certification scheme, and there is no formal audit or certificate. Compliance is shown by registering your databases correctly and meeting Law 25.326 duties, which the AAIP can check through inspections and complaints. An ISO 27001 certificate can support evidence of security measures but does not replace registration.

Yes. OneClickComply supports Argentina Resolution 132/2018 today, with the Law 25.326 obligations behind it mapped to your controls. This lets you reuse evidence collected for GDPR, ISO 27001 and other standards. OneClickComply does not file registrations with the AAIP for you or guarantee compliance, but our audit team can guide you through the process.