Americas data privacy and cybersecurity frameworks: the complete compliance map

Argentina PPL — Personal Data Protection Law 25,326

Public and private entities that process personal data of Argentine residents. Enforced by the Agencia de Acceso a la Información Pública (AAIP). Extraterritorial application is asserted where processing affects Argentine residents, though enforcement at distance remains limited in practice.

Organisations register their databases but treat registration as the end of the compliance programme. The PPL requires ongoing accuracy, purpose limitation, and deletion — none of which are managed after the initial registration filing.

Consent-based data collection, purpose limitation, data subject access and correction rights, mandatory registration of databases with the AAIP, and data transfer restrictions to countries without adequate protection. Technical safeguards are referenced at a principle level — the law says ''appropriate measures'' without specifying them.

The AAIP can investigate complaints, issue administrative sanctions, and refer criminal matters. Fines have historically been modest relative to EU standards, though the AAIP has increased enforcement activity since 2020. Argentina is pursuing a legislative update that would raise fines and expand rights.

The PPL is the baseline. Resolution 132/2018 adds security-specific obligations on top of it for financial and critical infrastructure entities. Organisations in those sectors must satisfy both — the PPL for data rights and 132/2018 for technical controls.

Argentina Resolution 132/2018

Financial institutions and critical infrastructure operators regulated in Argentina. The regulation specifically targets entities where a cybersecurity failure would have systemic consequences.

Organisations that have completed a PPL compliance programme assume they have covered Argentina. Resolution 132/2018 is frequently missed entirely, particularly by multinationals whose legal teams mapped the base privacy law and stopped.

Formal risk assessments, documented incident response procedures, regular security audits, and technical controls mapped to identified risks. Unlike the PPL''s principle-level language, 132/2018 requires that controls be demonstrable and auditable.

Enforcement falls under the Argentine financial and infrastructure regulators, not the AAIP. The consequence of non-compliance is regulatory sanction that can include operating restrictions — a materially different risk profile than the PPL''s fine-focused regime.

Structurally similar to Canada OSFI B-13 in that both add a cybersecurity governance layer on top of a base privacy regime. B-13 is more detailed and principle-based; 132/2018 is narrower in scope but more prescriptive about audit requirements.

Bahamas Data Protection Act

Organisations operating in the Bahamas or processing personal data of Bahamian residents, including financial services firms (the Bahamas is a significant offshore financial centre), tourism operators, and technology companies.

The Bahamas DPA is frequently overlooked by organisations that focus on their primary jurisdiction (often the US or UK) and treat Caribbean operations as low-risk appendages. The financial services concentration in the Bahamas means the data being processed is often high-sensitivity even when volume is low.

Lawful processing, consent requirements, data subject rights (access, correction, deletion), and appropriate security measures for both automated and manual processing. The Act is enforced by the Data Protection Commissioner.

The Data Protection Commissioner can investigate complaints and impose sanctions. Enforcement has been relatively limited in volume but is increasing as the financial services sector faces pressure from correspondent banking relationships that require documented data governance.

Broadly aligned with other GDPR-influenced frameworks in the group (Brazil LGPD, Uruguay Law 18,331) in its rights structure, but enforcement maturity is lower. Organisations that have mapped LGPD or Uruguay Law 18,331 will find significant conceptual overlap.

Bermuda BMA CCC — Bermuda Monetary Authority Cyber and Cloud Computing Code

Insurance companies, banks, and other financial institutions licensed by the Bermuda Monetary Authority. Bermuda''s insurance and reinsurance sector is globally significant — many of the world''s largest reinsurers are BMA-licensed.

Cloud governance. Bermuda-licensed insurers that use AWS, Azure, or GCP as shared infrastructure frequently have no documented cloud risk management programme that satisfies the BMA CCC''s requirements. The assumption that cloud provider SOC 2 reports satisfy the BMA''s oversight expectations is incorrect — the BMA expects the institution to demonstrate its own governance, not simply inherit the provider''s certification.

Documented cyber risk management programme, incident reporting to the BMA within defined timeframes, explicit cloud governance requirements for institutions using third-party cloud providers, and board-level accountability for cyber risk. The cloud governance provisions are the most distinctive element — the BMA requires formal cloud risk assessments and documented oversight of cloud providers.

The BMA has supervisory authority that extends to licence suspension or revocation for material non-compliance. The BMA''s enforcement posture has been active, particularly following incidents at BMA-licensed entities. Regulators with licence authority are categorically different from those with fine authority.

The BMA CCC is the most operationally specific framework in this group. Its cloud governance requirements have no equivalent in any other Americas framework listed here. Organisations subject to both BMA CCC and OSFI B-13 (Canadian parent companies of Bermuda subsidiaries) face the highest combined burden in the group.

Brazil LGPD — Lei Geral de Proteção de Dados

Any organisation that processes personal data of individuals located in Brazil, regardless of where the controller is headquartered. The extraterritorial reach is broad and mirrors GDPR''s structure. The ANPD enforces the law across both public and private sectors.

The Encarregado requirement. Brazil''s LGPD requires a named, publicly identified data protection contact — this is not optional, and it is not satisfied by listing a generic privacy email address. Vulnox assessments of organisations with Brazilian user bases consistently find either no named Encarregado or a named individual who has no actual authority over data processing decisions.

Legal basis for every processing activity (10 legal bases are available, with consent being just one), appointment of a DPO-equivalent (Encarregado), breach notification to the ANPD within 72 hours of a significant incident, processing records, and data subject rights including portability. Security measures must be ''technical and administrative'' and proportionate to risk.

The ANPD became fully operational in 2021 and issued its first administrative sanctions in 2023. Fines can reach 2% of Brazilian revenue, capped at BRL 50 million per infraction. The ANPD has been methodical rather than aggressive but its enforcement pipeline is building.

LGPD is the most GDPR-aligned framework in the group and the highest-enforcement-risk statute for organisations with significant Brazilian operations. Uruguay Law 18,331 has EU adequacy status but Brazil does not — meaning EU-to-Brazil data transfers require separate transfer mechanisms.

Canada CSAG — OSFI Cyber Security Self-Assessment Guidance

Federal government departments, agencies, and their IT service providers. Also used by OSFI-regulated financial institutions as an assessment methodology for evaluating their security posture before system authorisation.

Using CSAG as a checklist rather than a risk-based assessment instrument. The methodology is designed to surface where controls are insufficient relative to system risk classification. Organisations that complete it as a documentation exercise without genuine risk calibration produce assessments that satisfy the form but not the intent.

A structured methodology for assessing IT system security posture aligned with the Government of Canada''s Directive on Security Management. The CSAG is an assessment tool rather than a standalone compliance standard — it structures how controls are evaluated, not which controls must be present.

For government entities, CSAG findings feed into system authorisation decisions. Systems that cannot demonstrate adequate security posture through the CSAG methodology may not receive operating authority. The consequence is operational: an unauthorised system cannot legally process government data.

CSAG is complementary to OSFI B-13 — B-13 sets the governance expectations, CSAG provides the assessment framework. For federally regulated financial institutions, both are relevant. CSAG also overlaps significantly with ITSP-10-171 for organisations handling Protected B or equivalent data on mobile devices.

Canada ITSP-10-171

Government of Canada departments and agencies, plus contractors handling sensitive government data (Protected B or equivalent) on mobile devices and portable storage. Issued by the Canadian Centre for Cyber Security.

Treating ITSP-10-171 as a BYOD policy question rather than a contract requirement. The guidance applies to the data, not the device ownership model. A personally owned device used to access Protected B data is in scope regardless of who owns it.

Baseline security for mobile device management including device encryption, remote wipe capability, and configuration management. The guidance specifies minimum technical standards for devices that handle sensitive information outside controlled environments.

Non-compliance affects government contracts and system authorisation. Contractors that cannot demonstrate ITSP-10-171-compliant mobile device management risk losing access to government networks and data.

ITSP-10-171 is the most narrowly scoped instrument in the Canadian cluster — device-specific, not programme-wide. It complements CSAG (system-level) and B-13 (institutional governance) but does not substitute for either.

Canada OSFI B-13

Banks, insurance companies, trust companies, and all other federally regulated financial institutions (FRFIs) in Canada. CISOs, CROs, and technology risk teams. B-13 is principle-based, meaning institutions must demonstrate outcomes, not follow a prescriptive control list.

Treating B-13 as a documentation exercise. Because B-13 is principle-based, OSFI examiners evaluate whether governance actually functions — whether the board receives meaningful cyber risk reporting, whether incident response plans have been tested, whether third-party assessments are substantive. Polished policy documents with no operational substance do not satisfy B-13.

Governance structures for technology and cyber risk, risk identification and assessment programmes, control implementation proportionate to institutional size and complexity, incident response planning and testing, and third-party technology risk management. Board-level accountability is explicit.

OSFI conducts supervisory examinations that assess B-13 compliance directly. Institutions found materially deficient can face capital add-ons, enhanced supervision, or in extreme cases restrictions on business activities. The reputational consequence of an adverse OSFI finding is significant in Canadian financial markets.

B-13 is the dominant cybersecurity governance framework in the Canadian cluster and the highest regulatory sophistication instrument in the group. It shares thematic overlap with Bermuda BMA CCC (board accountability, third-party risk) but goes further on incident response testing requirements.

Canada PIPEDA — Personal Information Protection and Electronic Documents Act

Private-sector organisations operating in Canada that collect, use, or disclose personal information in commercial activities. Note: Quebec (Law 25), Alberta (PIPA), and British Columbia (PIPA) have their own substantially similar legislation that applies instead of PIPEDA within those provinces.

The provincial exception confusion. Organisations with operations in Quebec, Alberta, or BC sometimes apply PIPEDA to those operations when the provincial legislation actually applies instead. The difference is not trivial — Quebec''s Law 25 has much higher fines and stricter consent requirements than PIPEDA.

Ten Fair Information Principles including accountability, consent, limiting collection, accuracy, safeguards, and openness. The safeguards principle requires security protection appropriate to the sensitivity of the information. Mandatory breach reporting to the Office of the Privacy Commissioner of Canada (OPC) for breaches that create a real risk of significant harm.

The OPC investigates complaints and can make recommendations, but historically had limited fine authority. Bill C-27 (the proposed Consumer Privacy Protection Act) would significantly increase penalties if enacted. Current PIPEDA enforcement relies primarily on reputational pressure and court-ordered compliance, though the OPC has shown willingness to litigate.

PIPEDA is Canada''s general privacy law. B-13 is the sector-specific cybersecurity governance layer for FRFIs. PIPEDA compliance does not imply B-13 compliance. An FRFI must satisfy both, and they address different things: PIPEDA governs how personal data is handled, B-13 governs how technology and cyber risk are managed at the institutional level.

Chile Act 19,628 — Protection of Private Life

Public and private entities in Chile that process personal data. The current law applies to both automated and manual processing and grants data subjects rights of access, correction, cancellation, and blocking.

Building a Chile compliance programme against Act 19,628 as written and treating it as stable. The law is actively being replaced. Organisations that are not tracking the legislative reform cycle will find their compliance programmes obsolete at enactment, with no transition buffer if the new law includes a short implementation window.

The existing Act 19,628 is relatively thin — consent requirements, purpose limitation, and basic data subject rights — without the technical specificity of more modern frameworks. However, Chile is in an active legislative reform process. The proposed new law (Ley de Protección de Datos Personales) would introduce GDPR-aligned structures including a new data protection authority, mandatory breach notification, and significantly higher fines.

Current enforcement under Act 19,628 runs through the courts rather than a dedicated regulator. This means enforcement is complaint-driven and slow. The new law, once enacted, would establish a proper supervisory authority with administrative sanction power.

Chile is currently the weakest framework in the Latin American privacy cluster from an enforcement standpoint, but the reform trajectory suggests it will align with Brazil LGPD and Colombia Law 1581 standards within the next legislative cycle. Planning ahead for LGPD-level requirements in Chile is a defensible posture.

Colombia Law 1581 of 2012

Organisations operating in Colombia or processing personal data of Colombian citizens. The Superintendencia de Industria y Comercio (SIC) enforces the law and has been increasingly active — SIC investigations and sanctions have increased year-over-year since 2019.

The data bank registration requirement. Colombia requires organisations to register their databases with the SIC. This is a procedural step that organisations managing complex data environments frequently fail to complete for all relevant databases, particularly shadow IT systems and acquired data sets from mergers.

Consent-based collection, purpose limitation, data subject rights (access, correction, deletion, objection), mandatory registration of data banks with the SIC''s national database registry, and security measures proportionate to data sensitivity. Decree 1377 of 2013 implements the transfer restrictions and requires data processing policies to be published and accessible.

The SIC can impose fines, suspend operations, and close data banks. Fines are scaled to the severity of the violation and the size of the organisation. The SIC has sanctioned major corporations including financial institutions and telecoms operators.

Colombia Law 1581 is structurally similar to Argentina PPL in its rights and obligations framework. Both require database registration — a feature not shared by LGPD or Mexico LFPDPPP. Organisations managing multi-country Latin American compliance programmes should treat the registration requirement as a distinct workstream, not an incidental filing.

Costa Rica Law 8968 — PRODHAB Law

Organisations operating in Costa Rica that collect or process personal data, including public institutions, financial firms, and healthcare providers. The Agencia de Protección de Datos de los Habitantes (PRODHAB) enforces the law.

The registration requirement is the consistent failure point. Costa Rica shares this mechanism with Colombia and Argentina — organisations must affirmatively register databases, not simply comply with processing obligations. Technology companies managing large data processing operations in Costa Rica (common in the BPO sector) frequently fail to register the full scope of their databases.

Individual rights over personal data, obligations for data controllers and processors, mandatory registration of personal data databases with PRODHAB, and appropriate security measures. The registration requirement covers both automated and manual databases.

PRODHAB can investigate complaints and impose sanctions. Enforcement has been growing as PRODHAB has matured as an institution. Costa Rica''s digital economy growth — particularly in technology services and business process outsourcing — has brought more organisations into scope.

Costa Rica Law 8968 sits in the same tier as Colombia Law 1581 and Argentina PPL in terms of maturity and enforcement mechanism. The database registration requirement is the key operational parallel. Uruguay Law 18,331 is the most advanced framework in this tier.

Mexico LFPDPPP — Federal Law on Protection of Personal Data Held by Private Parties

Private-sector organisations operating in Mexico that process personal data of Mexican residents. The public sector has separate legislation. Enforcement authority rests with INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales).

ARCO rights response workflows. Mexico''s LFPDPPP requires that data subject requests be acknowledged within 20 business days and substantively responded to within a further 15 business days. Organisations that handle ARCO requests ad-hoc rather than through a defined workflow routinely miss these deadlines, which is itself a violation.

Privacy notices (Aviso de Privacidad) that must be visible at the point of data collection, ARCO rights (Access, Rectification, Cancellation, Objection) that must be operationally fulfillable within defined timeframes, consent requirements, purpose limitation, and security measures. Mexico''s framework is notable for its detailed privacy notice requirements — the content and timing of privacy notices are specifically regulated.

INAI can impose fines and has done so against major organisations. INAI is also a transparency regulator, which means its own enforcement actions are public record. The combination of privacy enforcement and transparency creates a reputational multiplier: a fine is also a public disclosure.

Mexico''s ARCO rights framework maps reasonably closely to Argentina PPL rights and Colombia Law 1581 rights. The privacy notice specificity is unique to Mexico in the Americas context. Organisations managing Mexico alongside Brazil LGPD will find significant overlap in data subject rights management but different mechanics for the notice requirements.

Peru Law 29733 — Personal Data Protection Law

Public and private sector organisations in Peru that process personal data. The Autoridad Nacional de Protección de Datos Personales, housed within the Ministry of Justice, enforces the law and maintains a national registry of personal data banks.

The national registry filing. Like Colombia, Costa Rica, and Argentina, Peru requires affirmative registration of data banks. This is a procedural compliance step that is frequently completed for primary systems and missed for secondary processing environments, acquired data, and marketing databases.

Consent-based processing, purpose limitation, data subject rights, mandatory registration of personal data banks with the national registry, and security measures. Processing of sensitive data (health, biometric, financial) requires reinforced safeguards.

Enforcement has been relatively modest in volume but the authority has the power to impose fines and order data banks closed. Peru''s enforcement environment is similar to Colombia''s several years ago — growing institutional capacity with increasing investigation volume.

Peru Law 29733 is structurally similar to Colombia Law 1581 and Argentina PPL. The shared registration requirement creates a workstream that can be managed in parallel across these jurisdictions. Uruguay Law 18,331 is the most advanced framework in the region and serves as a useful benchmark for the trajectory of Peru''s framework.

Uruguay Law 18,331 — Protection of Personal Data and Habeas Data

Organisations operating in Uruguay or transferring personal data to or from Uruguay. The Unidad Reguladora y de Control de Datos Personales (URCDP) enforces the law. Uruguay is the only Latin American country to hold EU adequacy status for data transfers.

Organisations use Uruguay''s EU adequacy status as a transfer mechanism without actually complying with Uruguay Law 18,331''s substantive requirements. Adequacy means the EU recognises Uruguayan law as equivalent protection — it does not exempt the organisation from that law''s requirements on the Uruguayan side.

Strong data subject rights (access, rectification, deletion, opposition), consent and legal basis requirements, security obligations, cross-border transfer rules, and registration of databases with the URCDP. The adequacy decision from the EU means data can flow from EU member states to Uruguay without additional transfer mechanisms.

The URCDP is an active regulator with investigation and sanction authority. The EU adequacy status creates additional motivation for Uruguay to maintain enforcement standards — failure to do so risks loss of adequacy, which would be economically significant given Uruguay''s role as a data processing hub for regional operations.

Uruguay Law 18,331 is the benchmark framework in the Latin American privacy cluster. It is the most mature, the most enforced, and the only one with EU adequacy. For organisations building a multi-jurisdiction Latin American compliance programme, the URCDP''s requirements are the ceiling, not the floor.

All four require affirmative registration of personal data banks with a national authority. The procedural mechanics differ: Colombia''s SIC has an online registry with specific field requirements; Argentina''s AAIP has its own registration system; Peru and Costa Rica have separate authorities with their own processes. A unified Latin American data inventory is a good starting point but the registration submissions must be made separately to each jurisdiction''s authority — there is no reciprocal recognition mechanism.

Database registration requirement

All five frameworks grant data subjects rights of access, correction, and deletion, with similar names but different operational timelines. Brazil LGPD requires response within 15 days. Mexico LFPDPPP requires acknowledgment within 20 business days and substantive response within 35 business days total. Argentina PPL does not specify a statutory timeline with the same precision. Colombia Law 1581 has its own response window requirements. An organisation running a single data subject rights workflow across these jurisdictions needs to set its SLA to the shortest applicable deadline — which is Brazil''s 15-day window — and verify it meets all others.

Data subject rights management

Both frameworks require board-level governance of cyber risk and documented oversight of third-party technology providers. The BMA CCC goes further on cloud governance — it specifically requires cloud risk assessments and documented cloud provider oversight. B-13 addresses third-party risk more broadly without the cloud-specific provisions. A Canadian insurer with a Bermuda subsidiary faces both, meaning the cloud governance programme must satisfy the more demanding BMA CCC standard to cover both jurisdictions.

Board-level accountability for cyber risk and third-party technology risk management

All four have breach notification obligations but with different triggers and timelines. Brazil LGPD: 72-hour notification to ANPD for incidents of significant risk. PIPEDA: notification ''as soon as feasible'' for breaches with real risk of significant harm — no specific timeline. Colombia Law 1581: notification through the SIC complaint process rather than a standalone breach notification obligation. Argentina PPL: no breach notification deadline in the current law — the pending reform would add one. Organisations managing incidents that cross these jurisdictions must triage which notifications are time-bound and which are not, and Brazil''s 72-hour clock starts from awareness, not investigation completion.

Mandatory breach notification

Treating jurisdictional compliance as cumulative rather than independent

Legal and compliance teams typically approach multi-jurisdiction coverage by mapping the most demanding framework first, then assuming lesser frameworks are satisfied by the work done for the higher bar. This logic works in some framework groups (GDPR compliance provides meaningful coverage toward many national European laws). It does not work in the Americas group because the frameworks are not a hierarchy. LGPD compliance does not give you Colombia Law 1581 database registration. PIPEDA compliance does not give you OSFI B-13 incident response testing. The frameworks address different things, not the same thing at different levels of rigor.

Organisations discover gaps at the worst moment: during a regulatory investigation, during a due diligence process for an acquisition or partnership, or when a data subject exercises rights in a jurisdiction the organisation did not realise it was subject to. The remediation cost at that point is always higher than preventive coverage would have been.

Mapping frameworks at point-in-time and treating the map as stable

Framework mapping projects are resource-intensive. Once completed, they get filed and referenced rather than maintained. In the Americas group, this is particularly dangerous because the regulatory environment is actively changing: Chile is replacing Act 19,628 entirely; Argentina PPL reform is in progress; Canada''s Bill C-27 would significantly change PIPEDA; Brazil''s ANPD is issuing new regulatory guidance quarterly. The map completed 18 months ago may cover a framework that no longer exists in its assessed form.

Chile is the clearest near-term risk. An organisation that built a Chile compliance programme against Act 19,628 and has not tracked the reform legislation will face a new law — with a new regulator, new fines, and new obligations — with no transition preparation. The new law''s implementation window may be shorter than the time required to rebuild the programme from scratch.

Assuming sector-specific cybersecurity frameworks are optional for regulated entities

Privacy law compliance is visible to legal teams. Sector-specific cybersecurity regulations (Argentina Resolution 132/2018, Bermuda BMA CCC, Canada OSFI B-13) are typically owned by technology risk functions that may not communicate clearly with the compliance team managing the privacy programme. The result is an organisation that has a complete privacy compliance programme and no cybersecurity governance programme that satisfies the sector regulator''s requirements.

Regulatory examinations by financial regulators (OSFI, BMA) evaluate cybersecurity governance, not just privacy. An organisation that passes its privacy audit and fails its prudential examination faces a materially different consequence — operational restrictions, capital requirements, or licence conditions — than a fine. The two risk tracks must be managed together.

Building data subject rights workflows to the least demanding jurisdiction in the portfolio

When managing data subject rights across multiple jurisdictions, teams naturally gravitate toward a single process. The benchmark they choose is often the jurisdiction where legal review was most recent, the volume of requests is highest, or the team is most comfortable. Brazil''s 15-day response window is frequently unknown to teams that built their workflow around PIPEDA''s ''as soon as feasible'' standard or Colombia''s longer response periods.

A data subject exercising rights under the LGPD who does not receive a response within 15 days has grounds for a complaint to the ANPD. The ANPD is operational and processes complaints. The gap between a unified workflow calibrated to the wrong jurisdiction and the LGPD''s actual deadline is an enforcement exposure that is entirely preventable.