In March 2023, the Dutch government prohibited civil servants from installing TikTok on work devices, citing concerns over potential espionage linked to the app's Chinese ownership. The decision followed an assessment by the national intelligence agency (AIVD), which identified apps from countries with aggressive cyber programs—such as China, Russia, Iran, and North Korea—as posing heightened security risks. While the policy did not name TikTok explicitly, it discouraged the use of applications from these nations on government-issued phones . This move aligned the Netherlands with other Western countries implementing similar restrictions on the Chinese-owned platform.

According to Art. 6 of Resolution 588/2009, the commercialisation, installation, and operation of telecommunications apparatus or equipment are only allowed with prior approval by CONATEL (National Telecommunications Commission). According to Art. 2, the goods that need to be homologated include: telecom equipment and devices intended to be connected to public telecom networks or connected through a network termination; telecom equipment and devices that make use of the radioelectric spectrum (including antennas); equipment that does not fall into the previous categories, which are subject to some technical regulation, at the discretion of CONATEL. Certification by foreign suppliers is allowed, but the application must be submitted to the regulatory body for equipment homologation (Art. 17). Once equipment type testing has been performed, a Paraguayan representative must apply for CONATEL’s certificate of approval by submitting the required documentation, as well as sending a type approval request letter addressed to the president of CONATEL.
It is also reported that the following ICT goods need to be homologated: car audio systems, RF transceivers, BT speakers, modems, wireless microphones, and RFID (Radio Frequency Identification) equipment.

Paraguay implements a de minimis threshold, that is the minimum value of goods below which customs do not charge duties, equal to USD 100, below the USD 200 threshold recommended by the International Chamber of Commerce (ICC). Resolution No. 1298 of 2018 of the Ministry of Industry and Commerce, as well as Art. 223 of the Customs Code, establishes that express shipments up to USD 100 that are not subject to prior import licenses are exempt from paying customs duties. Yet, these shipments are liable to pay the casual VAT of 13% and the transportation payment. As for operations between USD 100 and USD 1,000, they must pay between 15% and 35% of the Common External Tariff, as applicable. Art. 219 of the Customs Code further states that international postal shipments are not subject to customs duties for values up to 200 USD.

According to Art. 1197 of the Civil Code, companies incorporated abroad that want to offer their services in Paraguay are required to establish a representation with a domicile in the country, in addition to the particular domiciles resulting from other legal causes.

Law No. 1334 provides a comprehensive framework for consumer protection that also applies to online transactions. According to Art. 3 of Law No. 1334, the Law on consumer protection applies to all activities between suppliers and consumers in connection with the distribution, sale, purchase or any other form of commercial transactions of goods and services.

Paraguay has signed and ratified the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Paraguay enacted Law No. 6822/2021, drawing upon the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Paraguay enacted Law No. 6822/2021, drawing upon the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

According to Arts. 14 and 15 of Law No. 7593/25 on Personal Data Protection in the Republic of Paraguay, the controller must carry out a data protection impact assessment (DPIA) before any processing operation that, by its nature, scope, context or purposes, is likely to pose significant risks to data subjects’ rights. A DPIA is mandatory where:
(a) there is a systematic and comprehensive evaluation of personal aspects based on automated processing, including profiling, underpinning decisions with legal or similarly significant effects;
(b) large-scale processing of sensitive data or data on criminal convictions and offences is undertaken; or
(c) large-scale, systematic monitoring of publicly accessible areas takes place. The supervisory authority must publish a list of operations requiring a DPIA and may also issue a list of operations exempt from this requirement.
Where a DPIA shows that the envisaged processing would still involve high risk in the absence of mitigation measures, the controller must engage in prior consultation with the supervisory authority and may not commence processing until the authority has issued its opinion.
Moreover, according to Art. 4(h), the controller or processor, where applicable, shall designate a data protection officer. Art. 18 regulates the role of the data protection officer, who is responsible for supporting and supervising compliance with data protection rules.

Law No. 4868 on Electronic Commerce establishes a safe harbour regime for intermediaries for copyright infringements. According to Art. 11 of Law No. 4868, if the service receiver provides the data, the intermediary service provider shall not be responsible for the information transmitted under several circumstances, including when providers or data do not initiate the transmission is not changed by providers. Art. 16 requests all providers to establish a mechanism to remove content that violates copyright and related rights and industrial property laws from the network. This mechanism must be public and accessible to any user.

Law No. 4868 on Electronic Commerce establishes a safe harbour regime for intermediaries beyond copyright infringements. According to Art. 11 of Law No. 4868, if the service receiver provides the data, the intermediary service provider shall not be responsible for the information transmitted under several circumstances, including when providers or data do not initiate the transmission is not changed by providers. Art. 16 requests all providers to establish a mechanism to remove content that violates copyright and related rights and industrial property laws from the network. This mechanism must be public and accessible to any user.

According to Art. 4 of the National Telecommunications Commission's (CONATEL) Resolution No. 656/2008, the activation of a Mobile Telephony Service line requires the Sales Agent to implement procedures for identifying and registering the User. For natural persons, this involves presenting a copy of their identity document. Users who fail to provide the necessary documentation or meet the requirements specified in Art. 5 will be unable to activate a Mobile Telephony Service line. According to Art. 5, a Mobile Telecommunications Service Provider must maintain a record of its activated lines, which includes information such as an ID Document, the electronic serial number of the terminal (ESN) and/or the SIM card, if applicable, among others.

According to Art. 3 of Law No. 5653, any Internet service providers shall develop and offer free software to detect, filter, classify, delete and block harmful information, and they shall provide clients with such software and its teaching manual, which explains how to install and use it.

According to Arts. 3-7 of Decree No. 6832/2017, a prior import licence is required for the importation of mobile telephone devices, including mobile phones (other than satellite phones), laptops, parts and accessories for mobile phones, and mobile phone motherboards.

Art. 19 of the Law on the Protection of Personal Data establishes Paraguay’s rules on international transfers of personal data, permitting transfers (including onward transfers) only if the destination country, territory, sector or international organisation provides an adequate level of protection as determined by the National Data Protection Agency. Alternatively, transfers are permitted when controllers and processors implement appropriate safeguards, such as contractual clauses, binding corporate rules, codes of conduct or certification mechanisms, in accordance with the regulations to be adopted under the law. It also provides derogations, including transfers grounded in international treaties, judicial or intelligence cooperation to combat serious crime, contractual necessity (including authentication, service improvement, support, maintenance and billing), banking or securities transfers, health-related purposes, epidemiological studies with adequate anonymisation, and the data subject’s prior explicit consent. Although the Agency has been established, it is not yet operational, and no regulations have yet been issued.