Latin American Data Privacy

In 2024, Latin American countries ramped up their data protection laws, following the general trend seen in international privacy law outside of the European Union. While many countries in Latin America enacted measures in 2024, others scheduled their regulations to go into effect in early 2025, and still others continue to wrestle with the legislative process.

As a result, a patchwork of privacy laws blankets the region, and companies must ensure they understand key regulatory differences depending on where they operate. With so many countries adopting legal frameworks that align closely with the GDPR, companies that do business in Latin America should refresh their privacy practices to ensure compliance with these new laws. Below is a review of key developments in Latin American countries in 2024 and a preview of what the landscape will look like in 2025.

Enacted Laws

Argentina, which was the first Latin American country to adopt an “adequacy determination” from the European Commission, continues to develop its privacy laws. On June 1, 2024, Resolution No. 126/2024 of the Access to Public Information Agency (Argentina’s data protection authority) went into effect. The Resolution establishes a new classification of sanctions for violations of the existing Data Protection Law No. 25,326 (Argentina’s overarching law governing privacy of personal data, which generally aligns with the GDPR) and Telephony Services Law No. 26,951 (which establishes the National Do Not Call Registry). Additionally, the Resolution unifies in one source the records of violation for each law.

Bermuda’s Personal Information Protection Act (PIPA) is slated to take effect on January 1, 2025 after years of waiting—the statute was passed in 2016. Key provisions of PIPA include requirements for organizations to implement standardized safeguards, breach notifications, updated and accurate privacy notices, and a review of contracts with service providers to ensure protection of personal data. One significant aspect of PIPA is that, with the exception of Bermuda’s Human Rights Act, PIPA will prevail in the event of any conflict with any other laws enacted.

Brazil enacted the General Data Protection Law (LGPD), which generally aligns with EU’s GDPR, in 2020. During 2024, the LGPD saw significant upgrades, including approving standard contractual clauses (SCCs) for international data transfers, granting data subjects more control over their own data, enhanced and stricter penalties for non-compliance, more stringent data reporting requirements, an expansion of scope of what LGPD applies to, and an election campaign-specific resolution.

In Paraguay, a law called the Regulation of Credit Information Bureaus and Protection of Credit Personal Information went into effect on January 1, 2024. It limits which Credit Information Bureaus are permitted to operate. More controversially, Law 7269/2024 also went into effect in 2024 Law 7269/2024 authorizes and requires the collection of biometric data (including facial recognition) from all attendees of sporting events. Proponents of the law state it is designed to prevent and control violence in sports. Opponents of this law state that there is no distinction between people who are participating in violent acts at sporting events and those who are mere attendees. Lastly, the Personal Data Protection Bill remains in the legislative chambers. First proposed in 2021, the Personal Data Protection Bill includes data subject rights, security standards, data protection officer responsibilities, and processes for creating an enforcement authority.

Pending Legislation

Bolivia does not yet have a comprehensive data protection law in place. However, there are several privacy-related bills pending in Bolivia’s Congress, including both a Personal Data Protection Bill, which establishes processing and consent requirements for personal data, and a Comprehensive Data Protection Law. If passed, this would augment the right to privacy, which is recognized in the Bolivian Constitution. As 2025 approaches, the Bolivian legislature may make moves to advance these bills.

Chile’s Congress passed the Personal Data Protection Bill on August 26, 2024. The bill is now under review by the Constitutional Court, which must approve it before it is enacted by the President. This bill modernizes Chile’s existing data protection regulations and aligns Chile’s framework with the GDPR’s. It also explicitly includes anonymization and pseudonymization as recommended practices to comply with the law.

Colombia seeks to reform its existing General Data Protection Regulation. Like many other Latin American countries, the reforms seek to align Colombia’s privacy regime with international standards, including the GDPR. Key areas of reform relate to establishing new legal bases for legitimate data processing, consent for minors over 16, limiting data processing, new timelines for reporting incidents, and the right of data subjects to not be subjected to fully automated decisions.

Colombia’s focus on addressing AI and automated processes is consistent with its recent focus on reconciling data privacy rights with the increasing use of AI.