The Universal Periodic Review (UPR) is the mechanism through which the UN Human Rights Council reviews the human rights situation of all 193 member states every four and a half years. It is not a court and does not produce sanctions: it works through peer review, where it is the States themselves, not independent experts, who formulate recommendations to the country under review, based on three inputs: the report submitted by the State itself, a compilation of UN information, and a summary of civil society contributions.

For this cycle, in October 2025, TEDIC submitted, together with APC, Derechos Digitales, and Artigo 19, stakeholder reports on the state of digital rights in Paraguay, documenting the issues we had been monitoring: state surveillance, personal data protection, the rollout of digital identity, and the risks faced by human rights defenders and journalists in digital environments.

In February 2026, we traveled to Geneva for the UPR pre-session, where civil society organizations meet directly with the state delegations that will take part in the review, to convey in person the priorities we had documented in writing months earlier. This is the moment where it’s actually possible to influence which recommendations States end up making.

In May 2026, the formal review took place: on May 6, 85 delegations took the floor during the interactive dialogue in Geneva, and out of that exchange came the 266 recommendations that make up the Working Group’s final report (A/HRC/63/8).

In September 2026, the Human Rights Council formally adopted that outcome. We went through the exercise of systematizing the full document to answer one concrete question: of everything said about Paraguay, what was specifically said about technology and human rights?

The answer was: little, and scattered. We go through it recommendation by recommendation.

What did make it in

This is the third cycle TEDIC has taken part in the UPR, and even so, very few recommendations touched on digital issues. Of the 266 recommendations Paraguay received, only a handful address technology and human rights directly or tangentially.

109.93 – Personal data protection, tied to the NGO law

“Amend Law No. 7363/2024 and its related regulations to remove the restrictions imposed on civil society organizations and ensure the protection of personal data.” (Germany)

While the request centers on regulating the personal data protection law, here it is framed as a clause within the broader demand around the Law on Control, Transparency and Accountability of Non-Profit Organizations. It’s good news that a State explicitly linked oversight of CSOs to the right to data protection, that’s exactly the kind of connection we’ve been pointing to, but it’s also a sign that, for the UN system, “personal data” in Paraguay is still read almost exclusively as a civic space control issue, rather than as an agenda in its own right with enough standing to merit its own recommendation.

109.197 – Digital violence against women

“Strengthen measures to prevent and combat violence against women and girls, including by reviewing existing legislation to comprehensively address all forms of digital violence against women.” (Estonia)

Along with Germany’s, this is the most specific recommendation in technological terms. It explicitly names “digital violence” as a category to be addressed comprehensively in Paraguayan legislation. It’s a concrete point of leverage: based on this recommendation, Paraguay now has a formal follow-up obligation on an issue we’ve repeatedly documented — from the use of platforms as a vector for harassment to the non-consensual distribution of intimate content.

109.223 – Sexual exploitation of children online

“Take the necessary measures to prevent, combat, and punish all forms of sexual exploitation and abuse of children, including those occurring online.” (Algeria)

What stands out is that the online environment is explicitly named as a space of risk, but the recommendation doesn’t specify concrete mechanisms (for example, platform obligations, online reporting channels, or coordination between service providers and the child protection system). It remains a general mention rather than a roadmap.

What was left out

Just as telling as what was said is what wasn’t. No State made a specific recommendation on:

• State surveillance and interception of communications, even though Paraguay has been carrying pending recommendations on this issue since the 2016 cycle (recommendations 102.62 and 102.63 from that period).
• Digital identity and the digital ID card: the rollout process we documented in detail, with its risks of exclusion and lack of human rights impact assessment, does not appear anywhere in the report.
• Artificial intelligence or data governance as an agenda in its own right.
• Freedom of expression online as a standalone category — it only appears indirectly, folded into the numerous recommendations (more than twenty) on protecting journalists and human rights defenders from the Law on Control, Transparency and Accountability of Non-Profit Organizations.

What’s next

Paraguay had time during the September session to state which of these recommendations it accepts and which it merely notes. From there, the real work begins: tracking implementation over the next four and a half years, until the next UPR cycle.

The UN Human Rights Council formally adopted the outcome of Paraguay’s UPR as part of the agenda of its 63rd session. Our colleagues from APC were in Geneva in September, presenting the topic we had brought together with them at the February pre-session, and read a statement on TEDIC’s behalf during the adoption.

At TEDIC, we’ll be closely watching, in particular, 109.93 and 109.197, because they offer a formal anchor to demand concrete progress on data protection and digital violence. And we’ll keep pushing, cycle after cycle, for state surveillance and digital identity to finally enter the conversation with the centrality they deserve.

This publication has been funded by the European Union. Its content is the sole responsibility of TEDIC and does not necessarily reflect the views of the European Union.