Guide

Collecting attendee data at an event in Argentina: what Law 25,326 means for foreign organizers

By SOMOS DER · October 30, 2026 · 7 min read

If you register attendees for an event in Argentina, you are building a personal database in Argentina, and the country's personal data law, Law 25,326, is the frame to work in. In practice it comes down to a few rules: get informed consent before collecting, say what the data is for and use it for nothing else, ask only for what you need (never make sensitive data mandatory), delete it when it stops being useful, and answer requests within fixed deadlines. For a foreign organizer there is one more: sending the list back to headquarters is an international transfer, and Argentina restricts it.

Why a registration form counts as a database

Law 25,326 on Personal Data Protection defines a database as any organized set of personal data that is processed, electronic or not, whatever the way it is built, stored or accessed. Name, email, ID number, phone and company are all personal data. A guest spreadsheet, an online form and a printed list on the accreditation desk count the same.

The law also requires databases to be registered. The Agency for Access to Public Information (AAIP), the supervisory authority, puts it this way: files and databases that allow information about people to be obtained must be registered, and the same page has a section to check whether you are covered and what your obligations are. If you run events in Argentina regularly and keep the database between editions, check it, or ask your local partner.

Your home rules (GDPR in Europe, LGPD in Brazil, state laws in the US or Mexico's law) may apply on top. What follows is a practical reading of the Argentine law for attendee registration. It does not replace advice from a lawyer for your case.

Consent: free, express, informed and on record

Article 5 says processing is unlawful if the data subject has not given free, express and informed consent, in writing or by an equivalent means. If consent is bundled with other statements (the event terms, for example), it must appear in an express and prominent way.

• A checkbox the attendee ticks, not one that comes pre-ticked.
• A short, visible text above the submit button, not hidden behind a terms link.
• Separate from other permissions. Agreeing to be registered to get in is not agreeing to receive marketing.
• In the attendee's language. If you invite English speakers, write the consent text in English too. The PASE registration page and QR email are available in Spanish and English (?lang=en forces English); there is no Portuguese version.

The law has exceptions, such as lists limited to name, national ID number, tax ID, occupation, date of birth and address. Do not rely on them for an event: email and phone, which you almost always ask for, are not on that list.

Tell people before you ask, and agree who the controller is

Article 6 lists what must be stated, expressly and clearly, before data is collected. For an event, the form text should answer: what the data is for and who may receive it (the organizer, the inviting brand, the accreditation system); who is responsible for the database; which questions are mandatory and which optional; what happens if a piece of data is not given (no email, no QR code); and how to request access, correction or deletion.

Five well written lines cover it. With foreign events there are often three parties: the brand, the agency abroad and the local producer. Agree among yourselves who appears as responsible before the form goes live.

Purpose and sharing: the data serves what you said

Article 4 says data cannot be used for purposes different from or incompatible with those for which it was collected. If you collected the list to check people in, you cannot later use it for a sales campaign you never announced. Article 11 requires the data subject's prior consent to hand the data to someone else, with the purpose stated and the recipient identified. If a sponsor wants the attendee list, or exhibitors will scan visitor badges, say so in the registration and get it accepted there.

Sending the list home: international transfers

This is the point foreign organizers miss most. Article 12 prohibits transferring personal data of any kind to countries or international bodies that do not provide adequate levels of protection. The AAIP page on international transfers lists the jurisdictions considered adequate: the European Union and European Economic Area, the United Kingdom, Switzerland, Guernsey, Jersey, the Isle of Man, the Faroe Islands, Canada (private sector only), Andorra, New Zealand, Uruguay and Israel (automated processing only). The United States, Brazil and Mexico are not on that list.

For destinations outside the list, the same page describes the routes: free model contractual clauses published by the AAIP, other contracts submitted to the AAIP within 30 days of signing, binding corporate rules for transfers inside a corporate group, or the express consent of the data subjects. If the attendee list will travel to a CRM abroad, decide the route before the form goes live, and if you choose consent, put it in the registration text.

Ask little, protect it, delete it

Article 4 requires data to be accurate, adequate, relevant and not excessive for the purpose. The question that shapes the form is: do I need this for the person to get in and for the event to work? Sensitive data has a stricter rule. Article 2 defines it as data revealing racial and ethnic origin, political opinions, religious, philosophical or moral beliefs, union membership and information on health or sex life, and Article 7 says no one can be forced to provide it. At events it shows up as dietary restrictions for health reasons, accessibility needs or meal choices tied to religion: make those questions optional, explain why, and let only catering or accessibility staff see them.

Article 9 requires technical and organizational measures against alteration, loss or unauthorized access. The weak points are usually a spreadsheet emailed to half the team, a printed list left on the desk at the end of the night and operators' phones with the database downloaded. One design detail helps: in PASE each attendee's QR code is a random code with no personal data inside, so a photo of a badge does not expose anyone's name or email.

The law sets no number of days for retention: Article 4 says data must be destroyed once it is no longer necessary or relevant for the purpose it was collected for. Decide before the event how long you need it (the closing report, invoicing, a next edition only if announced), write that date down, and agree with your accreditation provider how the data will be deleted.

Attendee rights and deadlines

Anyone can ask what data you hold on them, correct it or have it deleted. Article 14 gives ten calendar days to answer an access request, and Article 16 sets a maximum of five business days to correct, update or delete. Put a visible contact email in the form and in the confirmation email, and make sure someone on the team, in Argentina or abroad, knows these requests exist. Day to day corrections help too: PASE flags mistyped email domains (gmial.com, hotmail.con) before the form is sent, and «Resend my QR» lets an attendee get the code again at their own email.

Ask for little, say what it is for, do not use it for anything else, decide where it travels and delete it when it is no longer needed. That is most of the law applied to an event.

Frequently asked questions