Guides
Data protection for nutritionists in Argentina: Law 25.326
What Law 25.326 requires from a nutrition practice in Argentina: article 8 for health professionals, registering databases with the AAIP, and the safeguards expected.
Law 25.326 has a feature that works in your favour and that almost nobody uses: an article written specifically for health professionals. Understanding it changes how you justify everything you do with client data.
The Argentine framework is Law 25.326 on the Protection of Personal Data, implemented by Decree 1558/2001. The enforcement authority is the Agency for Access to Public Information (AAIP). Reform bills have been under discussion for years, but 25.326 remains the law in force.
Article 8, your most solid basis
The law classifies health information as sensitive data, and article 7 heavily restricts collecting sensitive data. If you stopped there, the conclusion would be that you can barely work. But article 8 expressly opens the door: healthcare establishments and professionals in the health sciences may collect and process personal health data of those who come to them or are under treatment, respecting the principles of professional secrecy.
Consent is still needed, separately and expressly, for anything that is not care itself: marketing communications, use of photographs, publishing cases, or sharing data with third parties not involved in treatment.
Registering your database
This is the most overlooked obligation and the one that sets the Argentine regime apart in the region. The law provides that databases going beyond exclusively personal use be registered with the enforcement authority. A database of client clinical records is not personal use.
- Check the AAIP site for the current procedure and forms before registering.
- Register once and keep the declaration current if purposes or controllers change.
- Keep the registration receipt with the rest of your compliance documentation.
Your clients’ rights
| Right | What the client can ask for | Response deadline |
|---|---|---|
| Access | To know what data you hold and for what purpose | 10 calendar days |
| Rectification | To correct inaccurate or incomplete data | 5 business days |
| Updating | To bring outdated information up to date | 5 business days |
| Deletion | To erase data, within the limits of your retention duty | 5 business days |
Professional secrecy and your team
Article 8 conditions processing on respecting professional secrecy, and that duty does not stop with you: it reaches everyone in contact with the information. If you work with reception staff, assistants, or colleagues, a signed confidentiality agreement is not a formality — it is how you extend that duty to people who do not carry it by virtue of their qualification.
Safeguards
The law requires adopting the technical and organisational measures needed to guarantee security and confidentiality, and prohibits recording data in databases that lack technical conditions of integrity and security. Translated to a practice:
- A dedicated account for each person with access, with a second factor where possible.
- Encryption on the machines used to view clinical records.
- Backups with restoration actually tested.
- Access logging where the tool supports it.
- Signed confidentiality agreements with every collaborator.
- Immediate removal of access when someone leaves the team.
Vendors and data outside the country
If your practice software, email, or storage is hosted outside Argentina, an international transfer is involved. The law conditions it on the destination country offering adequate protection or on contractual guarantees being in place. In practice: ask each vendor for their data processing agreement and document where data is hosted.
Frequently asked questions
Is client consent enough on its own?
It works, but it is fragile as a sole basis because it can be withdrawn. For care itself, lean on article 8 and reserve consent for non-care uses.
Do I have to register my database if I work alone?
The obligation attaches to the database going beyond exclusively personal use, not to your legal form or size. A database of client clinical records exceeds that, so check the current AAIP procedure.
Can I use WhatsApp with clients?
It is common and not prohibited, but keep it to coordination and reminders, tell clients you use that channel, and do not leave clinical documentation stored there.
What if I stop practising?
The duty of custody continues for the clinical record retention period. You need to arrange who takes over and document it.
This guide is informational and is not legal advice. Check the regulations in force in your country and consult a professional if in doubt.
Next step
Take clinical nutrition to the next level with Almendra
Design plans, manage clients, and automate follow-ups in a single platform.