Latin America regulations for tech companies: Brazil, Mexico, Colombia, Chile, Argentina and Peru

This is the fifth article in a series on what a technology company faces in different regions. The earlier ones covered the UAE, the Gulf and Egypt, the CIS and Russia. This one covers Latin America regulations: Brazil, Mexico, Colombia, Chile, Argentina and Peru. The five questions are the same: personal data, cybersecurity, financial regulators, e-invoicing and electronic signatures.

To be upfront: I have not worked with companies in Latin America, so there are no stories from practice here, only a map built from primary sources. These are laws, decrees and regulators’ resolutions on official portals (planalto.gov.br, dof.gob.mx, bcn.cl, argentina.gob.ar, elperuano.pe and the websites of ANPD, SAT, SIC, DIAN, SII, ARCA and SUNAT). The facts were checked against primary sources as of late September 2026, and the key ones were checked again in an independent pass against the same document. I do not give legal opinions: the map shows which act to read, and how it applies to your company is for a lawyer in that country.

Latin America regulations: what is shared and what differs

• Personal data. None of the six countries has a general requirement to keep data in the country. The laws do reach abroad, though: Brazil’s, Peru’s and, from December 2026, Chile’s apply to a foreign company that offers services to people in the country.
• Deadlines for notifying the regulator of a breach range from 48 hours in Peru to 15 business days in Colombia. Mexico requires notice only to individuals, immediately, and Argentina has no general duty to notify at all.
• Cybersecurity. Only Chile has a framework law with hard deadlines, and it names cloud providers directly as operators of vital infrastructure. In the other countries the real IT requirements come from financial regulators.
• E-invoicing has long been mandatory here, everywhere: the tax authority checks or receives the document almost at the moment it is issued. Peppol is not used anywhere.
• Electronic signatures are tiered everywhere: any signature is broadly acceptable, and the top tier rests on the state’s public key infrastructure.

Personal data

Country	Law and regulator	Breach notification	Maximum fine
Brazil	LGPD, ANPD	ANPD and individuals within 3 business days	2% of revenue in Brazil, up to R$ 50 million per violation
Mexico	New LFPDPPP of 2025, SABG	Individuals only, immediately	Up to 320,000 UMA, about 37.5 million pesos; double for sensitive data
Colombia	Ley 1581 de 2012, SIC	SIC within 15 business days	Up to 2,000 minimum monthly wages under the law (converted to UVB since 2024, about 2.8 billion pesos), can be imposed repeatedly
Chile	Ley 21.719, new Agency from 01.12.2026	From 01.12.2026 without undue delay	20,000 UTM, up to 4% of revenue for repeat violations
Argentina	Ley 25.326, AAIP	No general obligation	Up to 50 million pesos for similar violations
Peru	Ley 29733 and the 2024 regulation, ANPD	ANPD and individuals within 48 hours	100 UIT (550,000 soles), no more than 10% of revenue

Brazil. The LGPD, Brazil’s General Data Protection Law, applies wherever the company is registered, if the data are collected in Brazil or services are offered to people there. Since September 2025 the ANPD (National Data Protection Agency) has had the status of a regulatory agency. Transfers abroad are possible only on the law’s grounds, including adequacy (since January 2026 the EU, Iceland, Liechtenstein and Norway), the ANPD’s standard contractual clauses adopted in full and without changes, corporate rules, or consent. There is no registration, but a DPO with public contact details is required; small companies are exempt. Since March 2026 the ECA Digital, a digital statute for children, has been in force, with fines of up to 10% of the group’s revenue in Brazil, capped at R$ 50 million per violation.

Mexico adopted a new data protection law in March 2025 and abolished the regulator INAI; supervision passed to the Secretariat of Anti-Corruption and Good Governance (SABG). As of late September 2026 there is no new regulation under the law. Mexico has no concept of adequate countries: domestic and international transfers are governed the same way, through a privacy notice and consent, with exceptions such as transfers within a group. The regulator does not need to be notified of a breach, only the individuals themselves, and immediately.

Colombia. Transfers to countries without adequate protection are prohibited as a rule, but the SIC’s list includes the US, Mexico, Peru, the EU and the UK. Transfers elsewhere are possible under a transfer contract with prior notice to the SIC. A transfer to a processor abroad does not need consent if a contract in the form set by the regulation is in place. Companies with assets above 100,000 UVT (Colombia’s tax value unit) register their databases in the RNBD register. The SIC has shown it is ready to use its harshest measure: in 2025 it ordered the World project to stop processing iris scans permanently.

Chile holds the key date here. On 1 December 2026 Ley 21.719 comes into force, fully rewriting the 1999 law: it creates an independent Data Protection Agency, extends the law to foreign companies that offer services to people in Chile or monitor their behaviour, and introduces breach notification and fines of up to 20,000 UTM (Chile’s monthly tax unit), and up to 4% of revenue for large companies with repeat violations. A foreign company without an establishment in Chile gives the Agency an electronic channel for its representative. As of late September 2026 a bill to move the date to 1 December 2027 is in committee in the Senate, with government urgency. Until it is passed, 1 December 2026 is the legal date.

Argentina still works under a 2000 law. Databases beyond personal use are registered with the AAIP, and in its view that also covers companies without an establishment in Argentina. Transfers to countries without adequate protection are possible under the AAIP’s model contractual clauses (any other contract must be submitted for approval within 30 days), corporate rules, or consent. There is no general duty to report a breach, but banks and payment providers report critical and important cyber incidents to the central bank within an hour.

Peru. The 2024 regulation has applied since 31 March 2025: 48 hours to notify the regulator and individuals, extraterritorial reach, and a representative in Peru for a foreign controller. For large-volume or sensitive-data processing, the DPO becomes mandatory in stages by revenue: for companies with revenue of 1,700 to 2,300 UIT (Peru’s tax unit), from around 30 November 2026. An important detail: under the regulator’s directive, keeping databases outside Peru or in a foreign cloud gives the high level of its territorial criterion. But for deciding whether a DPO is mandatory, hosting in Peru gives the same result, so moving servers into the country does not remove the duty.

Cybersecurity

Chile is the only country with a framework law. Ley 21.663 has applied since 2025 and covers providers of essential services, including digital and IT services to third parties. ANCI has classed hosting, SOC, cloud, SaaS, PaaS and IaaS among the critical ones. The first list of operators of vital infrastructure (December 2025) names the Chilean companies of AWS, Microsoft, Google, IBM and Oracle directly. A significant incident is reported to the national CSIRT: an early warning within 3 hours, an update within 72 hours (24 if such an operator’s essential service is disrupted) and a final report within 15 days. Fines go up to 20,000 UTM, and up to 40,000 for operators of vital infrastructure.

Peru has applied the regulation of its digital trust decree since February 2026: public bodies and digital service providers in finance, basic services, healthcare, transport, education and critical activities, and internet providers, report critical incidents within 48 hours. Cloud and hosting intermediaries are expressly excluded: the service provider reports, and it must require the same from its contractors.

Brazil, Mexico, Colombia and Argentina have no framework law. In Brazil a general bill is still being drafted and has not been submitted to Congress; cloud for federal bodies requires data to be kept in Brazil and SOC 2 reports. In Mexico the 2025 cybersecurity policy binds only the federal administration, and information security services formally count as private security and need a state permit, plus a federal one when operating in two or more states. In Argentina a new National Cybersecurity Center has been working since 2026, but no specific critical infrastructure has been designated, and government suppliers meet minimum requirements for their part of the work.

Financial regulators

There is no hard localisation, only narrow rules (a backup data centre in Chile, accounting books in Argentina). Cloud for critical processes is allowed everywhere, but through a procedure. For a bank’s contractor this means approval lead times and the regulator’s audit rights in the contract:

Regulator	Cloud and outsourcing	Incidents
BCB (Brazil)	Notify within 10 days after the contract; abroad, an agreement with that country’s supervisor or approval 60 days ahead	“In a timely manner”, no hours set
CNBV (Mexico)	Notify 20 business days ahead; offshore with approval	Immediately, details within 5 business days, customers within 48 hours
SFC (Colombia)	For core and accounting processes: provider details within the 15 days before processing starts, ISO 27001 and SOC reports	Through customer channels at once
CMF (Chile)	Critical services: a direct contract and CMF access; a backup data centre in Chile for significant services abroad	CMF within 30 minutes, CSIRT within 3 hours
BCRA (Argentina)	Critical cloud and SOC services: notify 60 days ahead	1 hour
SBS (Peru)	Notify within 30 days after launch; cloud with annual ISO 27017/27018 and SOC 2	At once; a bank’s priority-service outage of 4+ hours within 5 hours (1+ hour within 2 hours for the largest banks), other significant outages within 1 business day

In Peru the SBS is preparing a single operational-incident report to replace the two current ones (draft published 16.09.2026).

E-invoicing

Latin America was among the first to make e-invoicing mandatory across the whole economy, and the model is almost the same everywhere: a document takes effect only once the tax authority or an authorised provider has accepted it.

• Brazil. An NF-e (electronic invoice for goods) takes effect only after authorisation before the taxable event and is signed with an ICP-Brasil certificate. The main change now is the IBS/CBS tax reform, which brings in new consumption taxes. The new tax fields are mandatory in the NF-e from 3 August 2026, in the NFS-e (electronic service invoice) for most services, including software development and IT support, from 1 October 2026, and for digital platforms, hosting and data processing, software licensing and internet content from 1 December 2026. 2026 is a test year, with a soft transition programme.
• Mexico. A CFDI 4.0 (Mexico’s digital tax invoice) is checked and stamped by the SAT or an authorised PAC provider before it reaches the customer. From 2026 a CFDI without a real transaction is treated as fake: the SAT can suspend issuing, cancel the seal certificate and publish the company’s name, and fake invoices carry 2 to 9 years in prison.
• Colombia. Prior validation by the DIAN, UBL 2.1 format. Foreign providers of digital services without tax residence do not have to issue invoices.
• Chile. Invoices, boletas receipts, dispatch notes and debit and credit notes are electronic only (with narrow exceptions), and each document is sent to the SII (Chile’s tax service) before it goes to the buyer. From 1 November 2026 invoices and dispatch notes that accompany a shipment of goods must carry data for tracing it.
• Argentina. A document has tax effect only once ARCA (formerly AFIP) authorises it: normally with an online CAE (electronic authorisation code), with the deferred CAEA allowed only during outages. From 1 November 2026 electronic documents or a fiscal controller are mandatory for all monotributistas, including the social monotributo, and the financial sector joins in stages until March 2027.
• Peru. An invoice is sent to SUNAT on the day of issue or within 3 days, and a rejected one has no tax effect. Large taxpayers must work through an OSE operator or the SUNAT system.

Electronic signatures

For an ordinary B2B SaaS contract, an electronic signature on an agreed platform is enough almost everywhere. There are caveats worth knowing in advance:

• Brazil. In private dealings, signatures outside ICP-Brasil are valid if the parties have accepted them. The signature levels in the 2020 law apply only to dealings with government bodies, and a signature through gov.br is free and counts as advanced.
• Mexico. In commerce a foreign certificate works like a Mexican one if it is equally reliable, and an agreement between the parties is enough. Taxes need the SAT’s e.firma, which a legal entity obtains through a representative with a notarised power of attorney.
• Colombia. Identification methods agreed by the parties are presumed to meet the law. The electronic notarial escritura pública has not been in effect since June 2023.
• Chile. Advanced signatures are issued by accredited providers (12 as of September 2026); ClaveÚnica holders can obtain one remotely. Foreign certificates are recognised through a Chilean provider or a treaty; there is a mutual recognition agreement with Argentina.
• Argentina. A signature without a certificate from a licensed authority remains “electronic”, and in a dispute whoever relies on it must prove it is genuine. Typical e-sign platforms produce exactly this kind of signature.
• Peru. Three signature levels; for simple and advanced ones, whoever relies on the signature proves it is genuine, while for a qualified one the challenger must prove forgery.

Calendar

• Since 01.10.2026: in Brazil, NFS-e with IBS/CBS fields for most services, including software development and IT support.
• Since 01.11.2026: Argentina has extended the obligation to issue electronic documents or use a fiscal controller to all monotributistas; Chile requires shipment tracing data in invoices and guías de despacho that accompany goods in transit.
• Around 30.11.2026: in Peru a DPO becomes mandatory for companies with revenue of 1,700 to 2,300 UIT that process large volumes of data or sensitive data.
• 01.12.2026: Chile’s data protection law Ley 21.719 comes into force (unless the move to 2027 is passed); in Brazil, NFS-e with IBS/CBS fields for hosting, software licences and internet content.
• 01.01.2027: in Brazil, new tax documents for Simples Nacional.
• 01.03.2027: in Argentina, persons outside the scope of VAT (no alcanzados) move to electronic documents only.
• Any time: a new regulation under Mexico’s data law, ANPD regulations on data subject rights and security, standards from Chile’s cybersecurity agency.

Where a tech company should start

1. Prepare for Chile by December 2026. If you offer services to people in Chile or monitor their behaviour, the law will apply to you too, even without an establishment in the country.
2. For Brazil, check tax documents for services. Software development and support got the new NFS-e fields on 1 October 2026; hosting, software licences and content get them on 1 December.
3. Keep a data transfer map at hand. In Colombia and Argentina transfers to countries without adequate protection need a contract or the regulator’s model clauses, or a statutory exception, and in Brazil the ANPD’s SCCs are accepted only without changes.
4. For financial customers, budget time for notifications. From 15 days in Colombia and 20 business days in Mexico (before the contract) to 60 days in Argentina before a critical service starts; in Brazil and Peru notice follows the contract or launch.
5. For a cloud provider in Chile, check the ANCI lists. Large clouds are already named there, and the requirements cover all providers of essential digital services.

What I do not do

• I do not give legal opinions. The map shows acts and articles; how they apply to a specific company is for a local lawyer to judge.
• I do not pass off the map as experience. I have not worked with companies in Latin America; this is a reading of primary sources.
• I do not promise the map will not age. Especially in Brazil, where the tax reform changes documents every few months.

Frequently asked questions

Do data have to be stored in Latin American countries?

None of the six countries has a general requirement. The restrictions concern transfers abroad: in Colombia and Argentina data can go to countries without adequate protection only with contractual safeguards (model clauses in Argentina, a transfer contract notified to the SIC in Colombia) or under a statutory exception, and in Brazil the law’s grounds are needed. Sector requirements come from financial regulators and the public sector.

When does Chile’s new data protection law come into force?

On 1 December 2026. A bill in the Senate would move it to 1 December 2027; as of late September 2026 it has not been passed, so the current date stands. The law will also apply to foreign companies that offer services to people in Chile.

How quickly must a data breach be reported?

In Peru within 48 hours, in Brazil within 3 business days, in Colombia within 15 business days. In Mexico the regulator does not need to be notified, only individuals, and immediately; Argentina has no general obligation; and in Chile, from 1 December 2026, notification is due without undue delay.

Is Peppol used in Latin America?

No. All six countries work through national tax platforms, and a document takes effect after the tax authority or an authorised provider has checked or accepted it.

Is an ordinary e-signature platform good enough for contracts?

For B2B contracts, broadly yes, if the parties have agreed to it. The caveat concerns evidential weight: in Argentina a signature without a certificate from a licensed authority remains electronic, and in Peru the same applies to simple and advanced signatures. In a dispute whoever relies on the signature must prove it is genuine.

Sources

• Lei nº 13.709/2018 (LGPD), planalto.gov.br.
• Ley 21.719 on personal data protection and Ley 21.663 on cybersecurity, BCN Chile.
• Mexico’s new LFPDPPP, Cámara de Diputados.
• Colombia’s Ley 1581 de 2012, Secretaría del Senado.
• Argentina’s Ley 25.326, InfoLEG.
• Peru’s regulation DS 016-2024-JUS, gob.pe.

Need a consultation?

If your product has users or customers in Latin America, book a call. We will work out which regimes already apply to you, what changes in December 2026 and how it fits into the architecture.