Latin America bloc Data Protection & Privacy Regulation

Lawful Processing & Special Data

RIPD's updated 2026 Standards define neurodata, for the first time in this regional instrument, as data related to the functioning, activity or structure of the human brain that is capable of identifying a person or inferring information about their physiology, health or mental states. The standards place neurodata within the special, or sensitive, data categories, alongside the pre-existing categories carried over from the 2017 text. This is a soft-law classification rather than a binding legal category in any Ibero-American state's domestic law, but it marks the first time a regional reference instrument of this kind has addressed neurotechnology-derived data as a distinct and sensitive processing category, anticipating a processing risk that national legislation in the region has not yet generally addressed.

Outlook

Watch for whether any Ibero-American state begins incorporating a neurodata special category into domestic legislation following the standards' approval, and whether the Madrid Summit's possible endorsement in November 2026 accelerates that process.

Cross-Border & Adequacy

No bloc-wide transfer mechanism exists across the LATAM region equivalent to an adequacy regime. The RIPD's 2026 Estandares place particular emphasis on facilitating international personal-data transfers, articulating common criteria and bases intended to favour the region's social and economic development, while explicitly remaining non-binding soft law rather than a legal transfer mechanism. Separately, and independently of any RIPD or OAS initiative, a pattern of individual-state accession to the Council of Europe's Convention 108+ has continued to develop: Uruguay acceded in 2013, Mexico in 2018, and Argentina ratified on 17 April 2023. These accessions reflect choices made by individual states rather than a coordinated bloc position, and should not be read as evidence of LATAM-wide harmonisation on cross-border transfer standards. The result is a region where a state's cross-border transfer posture depends on which of these separate tracks, if any, it has joined: Convention 108+ accession, domestic legislation modelled on the RIPD's non-binding criteria, or neither. No single instrument currently supplies a transfer mechanism that operates uniformly across the bloc.

Outlook

The RIPD's transfer-facilitation language in the 2026 Estandares gives national legislators a common reference point, but converting that soft-law emphasis into an operative cross-border mechanism would require individual states to adopt implementing provisions, since the RIPD itself has no power to create a binding regional transfer regime. Further Convention 108+ accessions by other LATAM states remain a separate and independent path to watch.

Algorithmic, Biometric & Surveillance Governance

The Ibero-American Data Protection Network has unanimously approved an updated set of regional Standards for Data Protection for Ibero-American States, adopted at Cartagena de Indias and replacing the 2017 version. The central substantive change is the addition of provisions addressing artificial intelligence, automated decision-making, biometrics and neurodata, categories the prior version of the Standards did not address. This is the first time this regional soft-law instrument has engaged directly with these emerging technology categories, and it signals a coordinated regulatory direction among the network's member authorities toward treating algorithmic and biometric processing as requiring distinct governance attention rather than being folded into general data protection principles.

The updated Standards have been forwarded to SEGIB, the Ibero-American General Secretariat, for possible adoption at the Ibero-American Summit in Madrid on 4-5 November 2026, a date falling just after the anchor point. Until that summit decision is known, the Standards remain non-binding regional guidance: they express a unanimous convergence of view among RIPD member authorities on how artificial intelligence, automated decision-making, biometrics and neurodata should be governed, but they do not themselves create enforceable obligations in any individual state. Any binding effect would have to come from subsequent national legislation adopted consistently with the Standards, or from whatever political weight a summit-level endorsement might add.

This durable structural point bears stating plainly: the significance of this development lies in the coordination itself, not in any immediate legal effect. A unanimous regional approval of standards addressing artificial intelligence and biometrics is a meaningful signal of regulatory direction for a bloc that has historically varied widely in how comprehensively its member states regulate data protection, let alone emerging technology categories specifically. It indicates that the regional conversation has moved to treat these categories as requiring dedicated standards language, which is itself new relative to the 2017 baseline.

Outlook

The near-term event to watch is the outcome of the Ibero-American Summit on 4-5 November 2026, which will determine whether the updated Standards receive head-of-state-level political endorsement. Separately, and over a longer horizon, attention should turn to whether individual Ibero-American states begin incorporating artificial intelligence, automated decision-making, biometric or neurodata provisions into their own national legislation consistently with the updated regional Standards, which would be the point at which this soft-law convergence would translate into enforceable obligations.

Algorithmic, Biometric & Surveillance Governance

The Red Iberoamericana de Protección de Datos has approved a substantial update to its Estándares de Protección de Datos para los Estados Iberoamericanos, the regional standards text it last revised in 2017. The update adds provisions covering artificial intelligence systems, automated decision-making, biometric data processing and neurodata, an emerging category covering data derived from neural or brain-computer interfaces. The approval within the network was unanimous, and the revised text has been forwarded to the Secretaría General Iberoamericana for possible formal adoption at the Ibero-American Summit of Heads of State and Government, scheduled for 4-5 November 2026 in Madrid.

It is worth being precise about what this instrument is and is not. The RIPD network's membership spans Spain and Portugal alongside Latin American data protection authorities, so what is being built here is an Ibero-American standard rather than a purely Latin American one, and its legal status even on adoption would be soft law - a standard for member authorities to draw on, not a directly binding regional regulation comparable to the EU's General Data Protection Regulation. That said, the practical gap this fills is real: no bloc-wide binding authority or framework currently governs algorithmic and biometric processing across Latin American states, with substantive rules on these subjects set individually by each country that has chosen to legislate on them. A unanimously approved regional standard addressing AI and biometrics, even if non-binding, would give national regulators and legislators across the region a common reference text to draw from when building or amending their own domestic rules - a function soft-law instruments have historically served in this region, including the OAS's own earlier Updated Principles on Privacy and Personal Data Protection.

The adoption question remains open as of this reporting window. The Ibero-American Summit at which SEGIB might adopt the text falls on 4-5 November 2026, just after the date this account is anchored to, so whether the Estándares update is formally adopted, adopted with amendment, or deferred cannot yet be stated. What can be stated is that the text has cleared unanimous approval within the network that drafted it, which is itself a meaningful procedural threshold for a document covering as contested a set of subjects as AI and biometric governance.

Outlook

Whether the Ibero-American Summit formally adopts the updated Estándares on 4-5 November 2026 will determine whether this text moves from a network-approved draft to a standard SEGIB member states are invited to implement. Adoption would not create binding obligations in any Latin American state directly, but it would give national legislators drafting AI or biometric rules a common regional reference point for the first time. A primary SEGIB or RIPD document confirming the Summit's outcome, rather than media reporting of network deliberations, would materially strengthen the evidentiary basis for anything said about this instrument going forward.

Algorithmic, Biometric & Surveillance Governance

The Ibero-American Data Protection Network's 2026 update to its regional standards incorporates, for the first time, specific references to artificial intelligence, automated decision-making, bias prevention, algorithmic governance and neurodata. These are new additions against the prior 2017 text, which did not address this territory, and mark the clearest extension of the region's soft-law privacy framework into algorithmic-governance subject matter identified this period. Pinpoint article-level detail of exactly how the updated text frames the automated-decision and neurodata provisions has not been obtained, so the precise operative content of these provisions cannot yet be stated beyond the fact of their inclusion.

A related outcome reported from the same 2026 meeting, recounted in Argentina's own data-protection authority's account of its participation, was the approval of a regional reference framework specifically for the design, deployment and ethical supervision of artificial-intelligence systems and other emerging technologies. This reference framework sits alongside, and is distinct from, the AI-related amendments made to the Estándares themselves, though both emerged from the same 2026 gathering and reflect the same underlying regional push to bring data-protection soft law into alignment with AI-governance concerns. Neither the amended standards nor the reference framework binds any state directly.

Outlook

Obtaining pinpoint article-level detail of the automated-decision and neurodata provisions, and tracking whether the new AI reference framework is operationalised by any individual member authority, are the two developments most likely to sharpen this picture going forward.

Algorithmic, Biometric & Surveillance Governance

This is the module where the RIPD's 2026 update is most consequential. The revised Estandares, approved 26 May 2026, incorporate for the first time provisions addressing artificial intelligence, automated decision-making, biometrics, the prevention of algorithmic bias, and the data quality used by automated systems — none of which featured in the 2017 version they replace. The RIPD followed this with a dedicated instrument specifically on this ground: on 25 September 2026 it approved the Estandares Iberoamericanos sobre el uso de datos personales en sistemas de inteligencia artificial, following consultation and technical deliberation among member authorities. Together the two texts give the region's data protection authorities a common, if non-binding, reference framework for AI and automated-decision governance where previously none existed at the regional level. The same 2026 Estandares also define neurodata for the first time within the special-category framework, as data related to the functioning, activity or structure of the human brain capable of identifying a person, or of revealing information about their physiology, health or mental states. This places neurotechnology-derived data on a comparable special-category footing to other sensitive data types under the RIPD's framework, ahead of any binding national legislation addressing the category specifically. As with the rest of the RIPD's output, none of this is directly enforceable against any member state; its effect depends on national transposition.

Outlook

The near-term question is uptake: whether individual LATAM data protection authorities begin referencing the AI-specific instrument or the neurodata definition in their own guidance or enforcement practice, and whether any national legislature moves to enact binding AI or neurodata provisions modelled on the RIPD text.

Algorithmic, Biometric & Surveillance Governance

RIPD's Strategic Plan 2026-2030 establishes a regional reference framework intended to guide the design, deployment and ethical oversight of artificial-intelligence systems and other emerging technologies across Ibero-American states. The Plan also creates an Ibero-American Data Protection Observatory, intended to support ongoing regional analysis and foresight on these issues; the Observatory concept is reported as having endorsed a proposal originally put forward by Argentina. Taken together with the neurodata special-category addition described above, this signals a deliberate broadening of the region's soft-law reference framework to address AI-driven and biometric or neuro-technological processing risks, even though the instrument binds no state directly.

Outlook

The Observatory's establishment and its first areas of analytical focus are worth watching as the framework moves from strategic plan to operational activity; no operational milestones were evidenced this cycle beyond the Plan's establishment.

Children & Vulnerable Groups

The same 2026 update to the Ibero-American Data Protection Network's regional Standards introduces reinforced accountability measures specifically directed at the processing of children's personal data. The measures described in reporting on the update include privacy-by-default settings for services handling children's data, limitations on access to that data, restrictions on profiling and targeted advertising directed at minors, and tools intended to support effective age verification together with mechanisms allowing users to block or mute unwanted contact. These provisions sit within the same unanimously approved Standards text adopted at Cartagena de Indias, replacing the 2017 version, and carry the same pending status as the artificial intelligence and biometrics provisions discussed elsewhere in this update: the Standards have been forwarded to SEGIB for possible adoption at the Ibero-American Summit in Madrid on 4-5 November 2026, a date that falls just after the anchor point.

The confidence behind this specific set of measures is understood to be qualified rather than fully confirmed, reflecting that the detailed children's-data provisions are drawn from secondary reporting on the Standards update rather than from a directly retrieved primary text of the full instrument. The direction of the measures is nonetheless clear: age verification, profiling and advertising restrictions, and contact-blocking tools represent a substantive expansion of how the regional framework treats children as a category warranting distinct protective measures, where the prior 2017 Standards did not address these questions with comparable specificity.

As with the artificial intelligence and biometrics provisions in the same update, these children's-data measures remain non-binding regional guidance pending any summit-level adoption decision. They do not themselves create an enforceable age-verification or profiling-restriction obligation in any individual Ibero-American state. Their significance lies in signalling where the region's coordinated regulatory attention is heading: toward treating children's data processing, including profiling, advertising and age verification, as warranting dedicated reinforced accountability measures rather than general-purpose data protection rules alone.

Outlook

Whether these children's-data measures gain additional political weight will depend on the outcome of the Ibero-American Summit on 4-5 November 2026. Beyond that date, the measures' practical significance will depend on whether individual states translate the age-verification, profiling-restriction and contact-blocking elements into binding national legislation, since the regional Standards themselves do not carry direct legal force absent such domestic implementation.

Children & Vulnerable Groups

The same 2026 update to the RIPD's Estándares de Protección de Datos para los Estados Iberoamericanos that addresses artificial intelligence and biometrics also introduces reinforced-accountability measures specifically for children's personal data. The provisions, as reported, include default privacy-protective configurations for services used by minors, restrictions on profiling and behavioural advertising directed at children, and requirements for effective age-verification mechanisms alongside tools allowing children or their guardians to block or mute unwanted contact. This detail is understood to form part of the unanimously approved standards text now forwarded to the Secretaría General Iberoamericana for possible adoption at the Ibero-American Summit of 4-5 November 2026.

The reinforced-accountability framing is notable against the backdrop of a region where protections for children's data have, to date, been set individually and unevenly by national legislators, with no common regional baseline. If adopted, this would be the first soft-law standard reaching across Latin American states to specifically address default privacy settings, profiling restrictions and age verification for minors as a connected package, rather than leaving each element to be addressed piecemeal in domestic law. The age-verification element in particular echoes a broader global regulatory current - jurisdictions well beyond this region have moved toward requiring verifiable age checks for services accessed by children - and its appearance in a regional Ibero-American standard suggests that current is reaching Latin American standard-setting bodies as well as national legislatures.

Confidence in the specifics of the children's-data provisions is somewhat more qualified than for the AI and biometric provisions in the same update, reflecting that this detail rests on the same regional media account of the network's internal deliberations rather than a primary network or SEGIB document retrieved and reviewed directly. The substance of what the update does for children's data should accordingly be read as probable rather than confirmed pending sight of the underlying text.

Outlook

As with the AI and biometric strand of the same update, whether these children's-data provisions survive into a formally adopted text depends on the outcome of the 4-5 November 2026 Ibero-American Summit, a date falling just beyond this reporting window. Sight of the primary RIPD standards document, once available, would allow the specific accountability and age-verification mechanisms described here to be confirmed against the actual text rather than against secondary reporting of the network's approval process.

Children & Vulnerable Groups

The Ibero-American Data Protection Network's 2026 update to its regional standards strengthens specific guarantees for the protection of children and adolescents in digital environments. The updated text names default protective configurations, limitations on access, restrictions on profiling and behavioural advertising directed at minors, effective age-verification measures, and tools enabling guardians to exercise group-level control over a child's digital environment, as elements of the strengthened approach. These provisions form part of the same 26 May 2026 update that replaced the network's prior 2017 standards and that, separately, introduced the network's first references to artificial intelligence and related technologies.

As with the AI-facing elements of the same update, the children's-protection provisions are soft law addressed to RIPD's member authorities across Latin America, Spain and Portugal, rather than directly binding obligations on any single state. The strengthening is nonetheless a substantive move: naming effective age verification and restrictions on profiling and behavioural advertising directed at minors as named elements goes beyond general, abstract privacy principles and into specific operative territory that a member authority could draw on in its own domestic guidance.

Outlook

Whether any individual member state incorporates the strengthened children's-protection language from the 2026 standards into its own binding domestic law, and whether the standards are formally adopted at the anticipated Ibero-American Summit of Heads of State in the second half of 2026, are the developments to track on this module.

Children & Vulnerable Groups

The RIPD's 2026 Estandares introduce reinforced-responsibility measures for the processing of minors' personal data, a substantive expansion over the 2017 text they replace. These measures include default protective-privacy configurations, limitations on access to minors' data, restrictions on the construction of profiles and on behavioural advertising directed at minors, requirements for effective age verification, and tools enabling the blocking, muting and control of groups. The provisions sit within the same May 2026 update that introduced the Estandares' first treatment of artificial intelligence, automated decision-making and neurodata, reflecting a broader recognition within the update that minors face compounding risk from automated and profiling-based systems specifically. As with the rest of the RIPD framework, these measures are non-binding soft law: the RIPD has no sanctioning power over member states, and the practical protection afforded to minors in any given LATAM jurisdiction depends on whether that jurisdiction's own data protection authority or legislature adopts equivalent binding rules domestically.

Outlook

The measure to watch is domestic transposition: whether any LATAM data protection authority issues guidance or regulation incorporating the RIPD's default-privacy, age-verification or behavioural-advertising restrictions for minors, converting soft-law recommendation into enforceable domestic obligation.

Children & Vulnerable Groups

RIPD's 2026 Standards strengthen the region's reference provisions on consent for children's and adolescents' personal data. The standards require that, in obtaining such consent, the controller secure authorisation from the holder of parental authority or guardianship, applied under the representation rules of each Ibero-American state's own domestic law -- meaning the precise mechanics of parental authorisation remain nationally determined even as the standard itself is regional. A further, more specific provision, at point 14.3 of the standards, requires that processing for profile-building for advertising purposes obtain a specific consent kept separate from consent given for other processing. This separate-consent requirement is targeted at preventing a single, bundled consent from covering commercial advertising-profiling of minors, addressing a processing practice that general consent frameworks often fail to isolate.

Outlook

As with the other 2026 Standards provisions, the practical effect of these children's-consent and profiling-consent rules depends on domestic transposition by individual Ibero-American states; no such transposition was evidenced this cycle.

Children & Vulnerable Groups

Protection of children and adolescents in digital environments has been named among the principal innovations of the RIPD's 2026 Estandares update, sitting alongside the algorithmic-governance and neurodata additions discussed elsewhere in this cycle's coverage as one of the headline axes of the revised regional standard. This finding is reported at a probable, rather than confirmed, confidence tier, since it traces to a characterisation of the update's principal innovations rather than to a direct citation of the specific children's-protection provisions themselves; the underlying source establishes that this is a named priority of the update without necessarily detailing every specific mechanism the update introduces for this population.

The inclusion of children and adolescents' digital-environment protection as a principal innovation is notable given the RIPD's function as a regional soft-law benchmark spanning Ibero-American, not purely Latin American, member states: a standard-setting body of this kind naming a vulnerable-groups protection as one of its headline updates signals that the issue has achieved sufficient regional consensus to warrant explicit treatment in the benchmark document, even though, as with the algorithmic-governance provisions, any binding effect depends on subsequent domestic legislative or regulatory action by individual member states.

No LATAM-specific national-level development on children's or vulnerable-groups data protection, distinct from this regional benchmark update, was located this cycle; the finding here is confined to the regional-standard level.

Outlook

Given this is reported at a probable rather than confirmed confidence tier and traces only to a characterisation of the update's principal innovations, a dedicated review of the Estandares' specific children's-protection text would materially improve confidence in exactly what mechanisms this innovation comprises. Whether individual LATAM member states subsequently draw on this regional benchmark to strengthen their own domestic children's-data-protection provisions is the item to watch in coming cycles.

Enforcement & Redress

Brazil's ANPD underwent a significant capacity and institutional-standing shift this cycle. Lei No. 15.352/2026 converted the ANPD into an autonomous regulatory agency with its own legal personality and financial autonomy, a material change from its prior institutional status. Concretely reflecting that new capacity, the ANPD's first public hiring competition, for 50 positions, was authorised on 24 June 2026, suggesting the agency is moving to build out staffing commensurate with its expanded autonomous mandate.

That expanded capacity appears to be translating into enforcement activity: in June 2026 the ANPD opened 19 new administrative sanctioning proceedings, described as the largest such batch in the authority's history. This is a material escalation-of-activity signal, though it should be read against the authority's enforcement record to date, which remains thin in absolute terms: Brazil has, as of this cycle's sourcing, a single public LGPD fine applied to a private company, R$14,400 against Telekall Infoservice for processing without legal basis. That fine sits far below the maximum sanctioning power available to the ANPD under LGPD Article 52, which authorises fines of up to R$50 million or 2% of the company's Brazilian revenue per infraction, whichever is lower, alongside non-monetary sanctions including warnings, publicisation, data blocking or deletion, and processing suspension.

All of the Brazilian enforcement findings in this module are reported at a probable, rather than confirmed, confidence tier, since they trace to Brazilian legal-blog and compliance-industry sourcing rather than to a directly retrieved ANPD primary-source page; this is a material sourcing gap given that ANPD enforcement is the strongest enforcement-activity signal in this cycle's LATAM data-protection coverage, and a primary-source retrieval in a future cycle would be the single most valuable improvement to confidence here.

The combination of newly gained institutional autonomy, an enlarged hiring plan, and the largest-ever sanctioning batch together describe a regulator moving from a comparatively quiet enforcement posture toward a more active one, even though the absolute enforcement record, one public fine to date, has not yet caught up with that shift in institutional capacity and activity volume.

Outlook

Whether the 19 sanctioning proceedings opened in June 2026 result in published fines, and at what scale relative to the LGPD Article 52 ceiling, is the central item to track for Brazil's enforcement trajectory in coming cycles; a wave of published outcomes from this batch would be the clearest signal yet of whether the ANPD's new autonomy is translating into materially increased sanctioning activity. Separately, retrieving ANPD's own primary-source enforcement records directly, rather than relying on Brazilian legal-blog secondary sourcing, would meaningfully strengthen the evidentiary basis for tracking this module going forward.