Law No. 7593/25 on the Protection of Personal Data in the Republic of Paraguay provides a comprehensive regime of data protection in the country.

According to Art. 10 of Law No. 4868, intermediary service providers and data service providers shall store the connection and traffic data generated during the established communication for at least six months.

According to Art. 1 of Resolution No. 1350, telephone service providers shall store a detailed call log of all Paraguayan users for a period of six months.

In accordance with Arts. 1-3 of Resolution No. 2583/2024 of the National Telecommunications Commission (CONATEL), which establishes the obligation for all Internet Access and Data Transmission Service licensees to retain connection records, such licensees must keep connection logs for each subscriber for a minimum period of six months, including the data necessary to identify the subscriber. The Resolution further requires licensees to store for a minimum period of six months, for each connection made by the subscriber, including the assigned IP address and, where network address translation (NAT) is used, the TCP/UDP ports employed and the date and time of the IP communication, together with the identification of the subscriber to whom the service is contracted.

According to Arts. 14 and 15 of Law No. 7593/25 on Personal Data Protection in the Republic of Paraguay, the controller must carry out a data protection impact assessment (DPIA) before any processing operation that, by its nature, scope, context or purposes, is likely to pose significant risks to data subjects’ rights. A DPIA is mandatory where:
(a) there is a systematic and comprehensive evaluation of personal aspects based on automated processing, including profiling, underpinning decisions with legal or similarly significant effects;
(b) large-scale processing of sensitive data or data on criminal convictions and offences is undertaken; or
(c) large-scale, systematic monitoring of publicly accessible areas takes place. The supervisory authority must publish a list of operations requiring a DPIA and may also issue a list of operations exempt from this requirement.
Where a DPIA shows that the envisaged processing would still involve high risk in the absence of mitigation measures, the controller must engage in prior consultation with the supervisory authority and may not commence processing until the authority has issued its opinion.
Moreover, according to Art. 4(h), the controller or processor, where applicable, shall designate a data protection officer. Art. 18 regulates the role of the data protection officer, who is responsible for supporting and supervising compliance with data protection rules.

Paraguay has ratified the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Paraguay does not have a comprehensive framework in place that provides effective protection of trade secrets, but there are limited measures addressing some issues related to them. Art. 65 of the Labour Code establishes the employee's obligations to maintain strict confidentiality of technical, commercial and manufacturing secrets of the products in the production of which they are directly or indirectly involved or of which they have knowledge by reason of the work performed, as well as of administrative matters whose disclosure could be detrimental to the company. In addition, the literature indicates that in the absence of special laws for the protection of industrial secrets, Criminal Law has a role since Art. 147 of the Penal Code establishes penalties for the disclosure of "other people's" secrets and industrial or trade secrets.

It is reported that there is no obligation for passive infrastructure sharing in Paraguay to deliver telecom services to end users. However, it is practised in both the mobile and fixed sectors based on commercial agreements.

Paraguay is not a signatory of the 1996 World Trade Organization (WTO) Information Technology Agreement (ITA) nor the 2015 expansion (ITA II).

It is reported that the telecommunications sector is open to competition, except for fixed lines and international carrier services, which remain under State monopoly with the "Compañía Paraguaya de Comunicaciones". This is despite full foreign ownership being allowed in the telecommunications sector. In December 2001, as part of the process of “Reorganization of decentralized Public Entities, of reform and modernization of Central Administration Organizations”, provided for by Law 1615/2000, the National Telecommunications Administration (ANTELCO) changed its name to Compañía Paraguaya de Comunicaciones Sociedad Anónima (Copaco S. A.), becoming a 100% state-owned company.

According to Art. 33 of the Public Procurement and Contracting Law, international contracting may only be pursued under two conditions: (i) when a market analysis conducted by the bidder determines that no domestic suppliers, consultants, or contractors are able to offer the required goods, services, consulting, or work, either in terms of quantity, quality, or price; or (ii) when, following a national call for bids, no proposals are submitted, or none meet the requirements specified by the bidder. Art. 33 further establishes the obligation to register an address in Paraguay or to designate a local representative for the purposes of the relevant communications at the time of contracting in the case of a foreign bidder.

Compañía Paraguaya de Comunicaciones (COPACO S.A.) is the leading fixed-line telephony operator in Paraguay and is wholly state-owned. It is reported that, in December 2001, within the framework of the “Reorganisation of Decentralised Public Entities and the Reform and Modernisation of Central Administration Organisations” established by Law No. 1615/2000, the former National Telecommunications Administration (ANTELCO) was converted into Compañía Paraguaya de Comunicaciones Sociedad Anónima (COPACO S.A.), as a 100% state-owned company. COPACO also owns 100% of the mobile service operator HOLA.

According to Art. 33 of the Public Procurement and Contracting Law, in international contracting procedures, the bidders shall grant the benefit of a 10% margin of preference to bids that incorporate (i) the use of the country's human resources and (ii) the acquisition and lease of goods produced in the Republic of Paraguay.

In accordance with Art. 27 of the Public Procurement and Contracting Law, an Annual Public Procurement Program is established to promote micro, small, and medium-sized enterprises (MSMEs). This program must specify expenditure items and categories from the Catalogue of Goods, Services, Consultancy, and Public Works that are designated for preferential contracting with MSMEs. The Law requires each entity to set an annual market reserve for MSMEs, aiming to reach 20% within a period not exceeding five years from the law's enactment.