Paraguay:
What EU customers expect

Overview: trade with the EU

EU imports from Paraguay are almost entirely agricultural: according to the European Commission, the share was 82 % in 2025. Soy from the east of the country and beef from the Chaco are the best known examples. Both fall under the EUDR, and that is exactly where European buyers start asking questions.

For Paraguay, the EU-Mercosur Agreement is the biggest step in trade policy in years. Asunción hosted the signing on January 17, 2026.

Data protection: Ley 7593/2025 compared with the GDPR

Until 2025, Paraguay had no general data protection law. The main area covered was credit data (Ley 6534/2020). Ley Nº 7593/2025 de Protección de Datos Personales was promulgated on November 27, 2025. It provides for a 24-month transition period, which means it becomes fully applicable at the end of November 2027. The implementing regulation has not been issued yet.

The law adopts many core ideas of the GDPR: legal bases, data subject rights, obligations for controllers and processors, and rules for transfers abroad. Supervision will lie with an Agencia Nacional de Protección de Datos Personales, attached to the Ministry of Information and Communication Technologies (MITIC) with functional autonomy. Fines range from 20 to 10,000 minimum daily wages.

Paraguay has no EU adequacy decision. Your EU customers need standard contractual clauses (Implementing Decision (EU) 2021/914) and a transfer impact assessment for every transfer of personal data to Paraguay. That includes simple cases, for example when your sales team in Asunción looks up customer data in a German retailer's CRM.

Cybersecurity compared with NIS2

Paraguay has no cybersecurity law. Several bills are before Congress, including a "Ley de Ciberseguridad de la República del Paraguay" introduced in June 2025. For now, the framework is the Estrategia Nacional de Ciberseguridad 2025 to 2028 (Decreto Nº 3900/2025). The national emergency team CERT-PY is part of the Dirección General de Ciberseguridad within MITIC.

None of this creates obligations for companies like those under NIS2, meaning risk management, supply chain security and fixed reporting deadlines for whole sectors. For banks, the central bank has its own information security requirements.

For suppliers from Paraguay, this means the requirements come through the contract with the EU customer. An agricultural trader with its own logistics software will be asked about access control, backups and contingency plans. A maker of connected devices will be asked about the Cyber Resilience Act.

Reporting deadlines compared

In practice, the EU customer sets the deadline in the contract, usually 24 to 48 hours. Agree in advance who reports on your side and who can be reached if something happens on a weekend.

Authorities, CSIRT, accreditation body

With certificates, what matters is less where the certification body is located than who accredited it. Before you hire one, ask whether its accreditation by ONA or by a foreign body is covered by the international recognition arrangement of the Global ACI (since January 1, 2026 the successor to IAF and ILAC; existing accreditations remain recognized). If so, EU customers will generally accept the certificate. Some large groups still require a specific certifier. Clarify that before you spend money on an audit.

What EU customers typically ask for

For soy and meat exporters, the EUDR comes first: geolocation data for every plot, proof of deforestation-free origin after December 31, 2020, and proof of legal production under Paraguayan law. Paraguay is classified as a standard-risk country under the EUDR. In the Chaco in particular, where a lot of forest has been cleared in recent decades, buyers look closely.

Food manufacturers usually need a certificate for IFS, BRCGS or FSSC 22000, and industrial companies often need ISO 9001. If you process data belonging to European customers, you will receive standard contractual clauses and a security questionnaire.

In the contract, these requirements usually sit in several annexes: standard contractual clauses, a data processing agreement, technical and organizational measures, reporting deadlines and audit rights. Your EU customer also has to carry out a transfer impact assessment for Paraguay. For that, it needs information from you on access, encryption and possible requests from public authorities. The more precise your answers, the sooner the contract gets signed. If you keep the technical and organizational measures and their evidence in a tool such as Sightadel, every new customer gets answers from the same basis.

A sensible starting point for companies in Paraguay:

1. Find out which data you receive from EU customers and where it is stored.
2. Set up records of processing and name a person responsible for data protection. You will need both under Ley 7593/2025 at the latest.
3. Put an incident reporting process in place that meets the deadlines in your contracts.
4. For soy and meat exports, collect geolocation data for your own plots and those of your suppliers.
5. Check which certificate your customers ask for most often, and schedule the audit in good time.

The free EU Readiness Check shows where your company stands today.

Agreement with the EU

The EU-Mercosur Agreement was signed in Asunción on January 17, 2026. Since May 1, 2026, the trade part has been provisionally applied between the EU and Paraguay, Argentina, Brazil and Uruguay. To claim the tariff preference, you need a statement on origin. The broader partnership agreement is still going through ratification.

What this means in practice: for each product, check the tariff rate, the tariff reduction schedule and the rule of origin. You will find both in the European Commission's Access2Markets portal, sorted by tariff code. For processed goods, the rule of origin decides whether enough value was added within Mercosur. Some agricultural products are subject to tariff rate quotas, meaning limited volumes at the preferential rate. Your importer in the EU often knows these rules better than you do and can help you put the statement on origin on the invoice correctly. Keep your proof of origin for several years, because customs can check after the fact.

FAQ