--- title: "Latin America bloc Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/latin-america-bloc/ source_html: /jurisdictions/latin-america-bloc/index.html description: "Latin America bloc data protection and privacy regulation: 10 categories, 77 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: b5605b3f2cdbbfcc6fbd4d31f364d6f80f74b52eded2d20dc5948d131355bdd5 generator: "fe-fleet/md-twin@1.0" --- # Latin America bloc Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 77 claims · 39 sources in the cumulative register Download report (PDF) Expand all Brazil's data-protection authority, the ANPD, has finalized a new international-transfer regulation, effective 2026, introducing an adequacy framework alongside ANPD-approved model contractual clauses, binding corporate rules, and certifications — a suite of transfer mechanisms modeled on the GDPR's Chapter V approach. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (2 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=LATIN-AMERICA-BLOC)[Build Report](/reports/?j=LATIN-AMERICA-BLOC)[Compare](/compare/?j=LATIN-AMERICA-BLOC) Framework posture Unregulated gap 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority OAS Department of International Law / Secretariat for Legal Affairs (technical secret Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2026-11 Possible summit-level endorsement of RIPD 2026 Standards Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 3 Red categories 57 Sub-modules 77 Claims 4 Tier-1 sources Traffic-light mix 3 red 6 amber 1 green (sums to 10 rendered categories; click to filter) 3 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 834 Full executive summary 100 Jurisdiction sub-brief 2 162 Jurisdiction sub-brief 3 198 ###### Latest update · 4 November 2026 #### Lead Signal The principal development across Latin America is the unanimous approval by the Ibero-American Data Protection Network, known as RIPD, of an updated set of regional Standards for Data Protection for Ibero-American States, adopted at Cartagena de Indias and replacing the prior 2017 version. The update adds new provisions covering artificial intelligence, automated decision-making, biometrics and neurodata, marking the first time the regional soft-law framework has addressed these categories explicitly. The updated text is now to be forwarded to SEGIB, the Ibero-American General Secretariat, for possible adoption at the Ibero-American Summit scheduled for 4-5 November 2026 in Madrid, a date that falls just after the anchor point. Until and unless that adoption occurs, the Standards remain non-binding regional guidance rather than an instrument with direct legal force in any individual state. This is a coordinated regional signal rather than a binding legal obligation, and it should be read as such: the unanimous approval by RIPD member authorities indicates convergence of regulatory thinking across the region on how to treat artificial intelligence, biometric data and neurodata, but it does not itself create enforceable rights or duties until individual states choose to legislate consistently with it, or until any summit-level endorsement translates into something more binding at a national level. #### Other Developments Reinforced protections proposed for children's data. The same 2026 Standards update introduces measures aimed at processing children's personal data, including privacy-by-default settings, limitations on access to children's data, restrictions on profiling and targeted advertising directed at minors, and tools for effective age verification together with mechanisms to block or mute unwanted contact. These measures sit within the same non-binding instrument as the artificial intelligence and biometrics provisions and carry the same pending status ahead of the Madrid summit. Standing soft-law architecture remains unchanged. The Organization of American States' Updated Principles on Privacy and Personal Data Protection, adopted by General Assembly resolution in November 2021, continue to stand as a separate Americas-wide soft-law instrument, distinct from the Ibero-American RIPD network. The two frameworks should not be conflated: one is hemispheric and OAS-driven, the other is the Ibero-American practitioner network now moving toward its 2026 update. #### Outlook The near-term question is whether the Madrid Ibero-American Summit on 4-5 November 2026 results in formal endorsement of the updated Standards at the level of heads of state and government. Such endorsement would not convert the Standards into binding law, but it would give the artificial intelligence, biometrics, neurodata and children's-data provisions a stronger political mandate that could accelerate their uptake into national legislation across the region. Absent that endorsement, or in the event of a delayed or partial adoption, the Standards would continue to circulate as RIPD-level regional guidance without the added weight of summit-level backing. 5 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Brazil's data-protection authority, the ANPD, has finalized a new international-transfer regulation, effective 2026, introducing an adequacy framework alongside ANPD-approved model contractual clauses, binding corporate rules, and certifications — a suite of transfer mechanisms modeled on the GDPR's Chapter V approach. No bilateral EU-Brazil adequacy decision exists yet, so organisations continue to rely on consent or contractual mechanisms for EU-Brazil transfers in the interim, but the new framework gives the ANPD formal transfer-mechanism tools it lacked in earlier cycles. #### Other Developments Enforcement posture accelerates. The ANPD's enforcement activity moved from a guidance-and-consultation phase through 2023 into significant administrative fines by 2025, including against foreign platforms, with a 2026 posture described as increasingly comparable to European data-protection authority counterparts. The ANPD retains standing statutory power to impose fines of up to 2 percent of a company's Brazilian revenue, capped at BRL 50 million per violation, and to prohibit data-processing activities outright. Children's advertising protections tighten via a gambling-adjacent instrument. Interministerial Ordinance MF/SECOM/MJSP No. 73/2026 deems all gambling advertising directed at children and adolescents abusive by legal definition, consistent with the Digital ECA framework, and requires app stores and social platforms to prevent minor exposure to such advertising — a children-and-vulnerable-groups development sourced from gambling-advertising regulation rather than a dedicated data-protection instrument. #### Cross-Monitor Connections The Digital ECA-aligned advertising restriction connects directly to the advennt gambling-regulatory monitor's coverage of the same July 2026 ordinance package under its player-protection and distribution-platform-rules modules; that monitor addresses the gambling-sector operational consequences of the same instrument this brief reads for its children's-data-protection dimension. Brazil's international-transfer framework has no equivalent development flagged this cycle by the financial-integrity or world-payments monitors this cycle. #### Outlook Whether the ANPD's new transfer mechanisms progress toward an eventual EU-Brazil mutual adequacy arrangement is the key cross-border watch item for coming cycles; none currently exists, and organisations should not assume one is imminent. The ANPD's accelerating enforcement trajectory, now described as increasingly comparable to European counterparts, suggests coming cycles are likely to surface further administrative-fine activity. Argentina's, Mexico's, and Colombia's data-protection authorities remain an unresolved coverage gap this cycle. Read full brief · 834 words Standing brief, as of 25 August 2026. #### Regulatory Status Brazil's data-protection regime this cycle shows tightening on two fronts: a new ANPD international-transfer framework (adequacy framework, model clauses, binding corporate rules, certifications, effective 2026, with no EU-Brazil mutual adequacy yet in place) and an accelerating ANPD enforcement posture increasingly comparable to European counterparts. A cross-sector children's-protection development, Interministerial Ordinance No. 73/2026, extends minor-exposure protections into the gambling-advertising distribution chain under the Digital ECA framework. #### Outlook Progress toward EU-Brazil adequacy recognition and continued ANPD enforcement-activity acceleration are the two developments most likely to define Brazil's data-protection trajectory in the coming cycle. Read full brief · 100 words Standing brief, as of 4 October 2026. #### Regulatory Status Colombia is in an active legislative-tightening period across several fronts. Bill 282/2026C (introduced 26 August 2026) would extend Law 1581's territorial scope extraterritorially, introduce 72-hour breach notification, set fines up to 10,000 SMMLV or 5% of operating income, and reclassify identification biometrics as sensitive data, affecting bank and fintech KYC onboarding. Bill 208/2026C (introduced 28 August 2026) would impose age-verification and security obligations on social-media providers for minors. On cross-border transfers, the SIC has approved RIPD model contractual clauses (effective 5 January 2026) and is understood to hold adequacy decisions for Brazil, Ecuador, Kenya, Panama and South Africa. Under Law 2573 of 2026, the SIC has opened a consultation on identity-verification rules targeting fraudulent credit-bureau reports, with a final regulation anticipated in November 2026. #### Outlook The Law 2573 implementing regulation, anticipated November 2026, is the nearest-term marker. Bills 282/2026C and 208/2026C remain pre-committee-vote and should be watched for progress through the legislative process. Read full brief · 162 words Standing brief, as of 25 October 2026. #### Regulatory Status The Ibero-American Data Protection Network approved a materially updated version of its regional standards on 26 May 2026, replacing the 2017 text, with new provisions on artificial intelligence, automated decision-making, bias prevention, algorithmic governance and neurodata, and strengthened provisions on children's and adolescents' protection in digital environments (default protective configurations, access limitations, restrictions on profiling and behavioural advertising directed at minors, effective age verification, and group-control tools). A related outcome of the same 2026 meeting was approval of a regional reference framework for the design, deployment and ethical supervision of artificial-intelligence systems and other emerging technologies. Separately, the Organization of American States' Updated Principles on Privacy and Personal Data Protection, adopted in November 2021, continue to stand as a general, non-binding soft-law reference point on lawful processing and cross-border data flow. None of these instruments binds any state directly. #### Outlook Whether the RIPD's 2026 standards are formally adopted at the Ibero-American Summit of Heads of State expected in Madrid in the second half of 2026 remains unresolved. Individual member-state adequacy and Convention 108+ status is tracked separately at the national level and is not part of this regional-bloc position. Read full brief · 198 words Key regulatory facts for Latin America bloc Regulatory Dimension Latin America bloc Standing Position Jurisdiction Latin America bloc (LATAM) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 77 sourced findings) Regulator & Framework No enforceable bloc-wide instrument or single supervisory authority exists; only soft-law principles and a practitioner network operate at the regional layer. Lawful Processing & Special Data Special-category and consent-exception content is well evidenced for 2026; enumerated lawful-basis and pseudonymisation/anonymisation safe-harbour text was not confirmed in retrieved sources. Data Subject Rights Core access/rectification/objection concepts are present as soft-law principles; portability and statutory deadlines are absent at the bloc level. Controller/Processor Duties Accountability, processor-contract and security content is confirmed; DPO/ROPA/breach-notification content is absent at bloc level. Primary Instruments Cited Organization of American States, AEPD, RIPD, OAS Secretariat for Legal Affairs, Department of International Law, DataGuidance Last Confirmed / Updated 2026-11-04 (39 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Latin America bloc: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No enforceable bloc-wide instrument or single supervisory authority exists; only soft-law principles and a practitioner network operate at the regional layer. Primary framework OAS Updated Principles on Privacy and Personal Data Protection (2021) — non-binding soft law Supervisory authority [OAS Department of International Law / Secretariat for Legal Affairs (technical secretariat for the Updated Principles; not an enforcement regulator)](https://www.oas.org/en/sla/dil/personal_data_protection.asp) Traffic-light rationale — Red No enforceable bloc-wide instrument or single supervisory authority exists; only soft-law principles and a practitioner network operate at the regional layer. #### Sub-modules (5) #### Regulator And AuthorityRed OAS DIL is a technical secretariat, not an enforcement regulator; RIPD is an Ibero-American (not purely Latin American) convening network of national DPAs, secretariat held by Spain's AEPD. Claims (5): - The OAS Inter-American Juridical Committee approved the Updated Principles on Privacy and Personal Data Protection on 9 April 2021, and the OAS General Assembly formally adopted them via resolution AG/RES.2974 (LI-O/21) in November 2021, with the OAS itself describing the instrument as inter-American soft law rather than binding treaty text. - RIPD is an Ibero-American practitioner network of data-protection authorities whose permanent secretariat is held by Spain's AEPD, and whose membership of roughly 18 states includes Spain and Portugal, making it distinct from a purely Latin American mechanism. - Spain's AEPD; RIPD membership includes Spain and Portugal, making it Ibero-American rather than purely Latin American - The OAS adopted Americas-wide soft-law privacy principles in 2021, distinct from the separate Ibero-American RIPD practitioner network. - OAS Updated Principles on Privacy and Personal Data Protection — Adopted by OAS General Assembly Resolution AG/RES.2974 (LI-O/21) on 11 November 2021 as inter-American soft law, distinct from the Ibero-American RIPD network (secretariat held by Spain's AEPD). #### Act And InstrumentsAmber Primary bloc-level instruments are the OAS Updated Principles (2021) and the RIPD Ibero-American Standards, updated 26 May 2026. Claims (6): - The RIPD approved an updated version of the 'Estándares de Protección de Datos para los Estados Iberoamericanos' on 26 May 2026 at its XV Ibero-American Data Protection Meeting held in Cartagena de Indias, Colombia. - The updated RIPD Standards were, as of dispatch, still pending referral to SEGIB for possible formal adoption at the Ibero-American Summit of Heads of State and Government scheduled for 4-5 November 2026 in Madrid, and had not yet received summit-level political endorsement. - RIPD — Updated Estándares de Protección de Datos para los Estados Iberoamericanos, replacing the 2017 standards - RIPD Estándares de Protección de Datos de los Estados Iberoamericanos — RIPD approved and presented a new version of its Estándares on 26 May 2026 at the XV Ibero-American Data Protection Meeting in Cartagena de Indias, Colombia, explicitly replacing the 2017 version - OAS Updated Principles on Privacy and Personal Data Protection — Adopted by the OAS General Assembly via resolution AG/RES. 2974 (LI-O/21) in November 2021, based on the Inter-American Juridical Committee's April 2021 text; characterised by the OAS itself as inter-American soft law - Organization of American States — The OAS Updated Principles on Privacy and Personal Data Protection (AG/RES.2974, 11 Nov 2021) are inter-American soft law, not a binding treaty. #### Material ScopeAmber OAS Principles apply broadly to public- and private-sector personal-data processing across OAS membership, not to a LATAM-only footprint. Claims (1): - The OAS Updated Principles are framed to apply to both public- and private-sector processing of personal data across OAS member states, a footprint that spans the Americas (including the US and Canada) rather than Latin America alone. #### Territorial ScopeAmber RIPD's Standards apply to 'Estados Iberoamericanos', a grouping including Spain and Portugal — must not be described as purely Latin American. Claims (2): - The RIPD Standards are addressed to 'Estados Iberoamericanos', a membership grouping that includes Spain and Portugal alongside Latin American states, and should not be characterised as bloc-wide Latin American law. - Colombia (Bill 282/2026C) — Filed 26 August 2026 to amend Law 1581 of 2012, would extend the law's scope to organisations outside Colombia wherever data subjects are located, with 72-hour breach notification and fines up to 10,000 SMMLV or 5% of prior-year operating income. #### Regulator Registration And FilingRed No bloc-wide controller registration/filing obligation exists under either instrument; registration regimes (where they exist) are set at national level only. Claims (1): - No bloc-wide controller registration or filing regime was identified under either the OAS Principles or the RIPD Standards; any such obligations exist only under individual national statutes, which are outside the scope of this bloc-level row. There is no bloc-wide, binding LATAM regulator or omnibus statute. The operative Americas-wide layer is the OAS 'Updated Principles on Privacy and Personal Data Protection' (2021) — expressly characterised by the OAS as soft law, adopted by General Assembly resolution rather than treaty — and the separate Ibero-American practitioner network (RIPD), whose 2026 Standards are likewise non-binding guidance. RIPD is explicitly not a Latin-American-exclusive body: its permanent secretariat sits with Spain's AEPD and its ~18-member composition includes Spain and Portugal. Individual LATAM states (Argentina, Brazil, Mexico, Colombia, Chile, etc.) each run distinct, independently-enforced national statutes and DPAs, but those are out of scope for this bloc-level row per the seed disambiguation. Periodic update · new data 2026-11-04 #### Regulator & Framework The standing regional soft-law architecture for data protection across Latin America and the wider Americas continues to rest on the Organization of American States' Updated Principles on Privacy and Personal Data Protection, adopted by General Assembly resolution in November 2021. This instrument is hemispheric in scope, covering the Americas as a whole rather than Latin America alone, and it remains non-binding. It is distinct from, and should not be confused with, the separate Ibero-American Data Protection Network, known as RIPD, which operates as its own practitioner-level standard-setting body across Ibero-American states and has approved its own updated Standards covering artificial intelligence, biometrics and neurodata. The RIPD framework itself does not function as a single regulator; rather it is a network of national data protection authorities across Ibero-American states that coordinates on regional standards. Its latest Standards update, approved unanimously at Cartagena de Indias and replacing the 2017 version, has been forwarded to SEGIB, the Ibero-American General Secretariat, for a possible adoption decision at the Ibero-American Summit scheduled for 4-5 November 2026 in Madrid. That summit date falls just after the anchor point, so whether formal summit-level endorsement is granted remains an open question at the time of this assessment. Reading the two frameworks together, the regional architecture for data protection in Latin America at the level of overarching principles is best understood as two parallel, non-binding soft-law tracks: an Americas-wide track anchored in the 2021 OAS Principles, and an Ibero-American track now centred on the 2026 RIPD Standards update pending possible summit backing. Neither track supersedes or binds national legislatures, and the presence of both does not itself indicate convergence toward a single enforceable regional instrument. #### Outlook Whether the Ibero-American Summit in Madrid in early November 2026 formally endorses the updated RIPD Standards will determine whether the Ibero-American track gains the kind of heads-of-state political weight that the OAS Principles already carry at the hemispheric level. Either way, both frameworks remain non-binding, and national legislative action in individual states continues to be the actual source of enforceable data protection obligations across the region. 3 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework The Ibero-American Data Protection Network (RIPD) approved and presented a materially updated version of its Estándares de Protección de Datos de los Estados Iberoamericanos on 26 May 2026, at the network's annual meeting held in Cartagena de Indias, Colombia. The new text explicitly replaces the version that had stood since 2017. RIPD's membership spans Latin American states together with Spain and Portugal, so the update is properly described as an Ibero-American rather than purely Latin American development, though its practical reach extends across the LATAM bloc through shared membership. Separately, the Organization of American States' Updated Principles on Privacy and Personal Data Protection remain in effect as a distinct instrument, adopted by the OAS General Assembly via resolution AG/RES. 2974 (LI-O/21) in November 2021, building on text produced by the Inter-American Juridical Committee earlier that year. The OAS itself characterises the Updated Principles as an instrument of inter-American soft law intended as a reference point for member states rather than as binding regional legislation. Both the RIPD standards and the OAS Principles operate as soft law: neither instrument creates directly enforceable obligations on any individual state, and whatever binding force exists in the region continues to derive from each state's own domestic data-protection statute. #### Outlook Whether the RIPD's 2026 standards receive formal adoption at the Ibero-American Summit of Heads of State, reportedly expected in Madrid in the second half of 2026, remains unresolved on current reporting and is the development most worth tracking on this module going forward. Periodic update · new data 2026-10-19 #### Regulator & Framework The Dominican Republic's new regulator, the DGJA, is a gambling matter and has no bearing here; for data protection, the LATAM bloc's framework remains defined by two parallel soft-law bodies rather than any binding supranational regulator. The Red Iberoamericana de Proteccion de Datos (RIPD), grouping the region's national data protection authorities, unanimously approved a revised version of its Estandares de Proteccion de Datos para los Estados Iberoamericanos on 26 May 2026 at a meeting in Cartagena de Indias, Colombia. The new text replaces the version adopted in 2017 in full. Separately, the Organization of American States adopted its own Updated Principles on Privacy and Personal Data Protection via General Assembly Resolution AG/RES.2974 (LI-O/21) on 11 November 2021; the OAS itself describes the Principles as inter-American soft law rather than a binding treaty. Neither the RIPD's Estandares nor the OAS Principles bind any LATAM state directly, and neither body holds sanctioning power over its members. The practical effect of both instruments therefore depends entirely on whether and how individual national legislators and data protection authorities choose to transpose their content into domestic law. The RIPD's 2026 update is the more immediately consequential of the two for drafting purposes, given its recency and its unanimous approval across the network's membership, and its content extends well beyond a restatement of 2017-era principles into new ground on automated systems. #### Outlook Whether the RIPD's 2026 Estandares gain any higher-level political endorsement turns on their formal transmission to, or endorsement by, the Ibero-American Summit of Heads of State expected in the second half of 2026 in Madrid, under the RIPD's own 2024 roadmap. That step, if it occurs, would not convert the Estandares into binding law, but would signal stronger regional political backing for national legislatures to draw on them when updating domestic data protection statutes. Periodic update · new data 2026-10-11 #### Regulator & Framework The Red Iberoamericana de Protección de Datos (RIPD) unanimously approved an updated version of the Estándares de Protección de Datos para los Estados Iberoamericanos on 26 May 2026 in Cartagena de Indias, replacing the 2017 standards. This is the most significant regional soft-law development of this cycle, adding neurodata as a special category for the first time and incorporating AI and biometric governance references. The updated standards are scheduled to be forwarded to SEGIB for possible adoption at the Ibero-American Summit of Heads of State and Government in Madrid, 4-5 November 2026; that adoption stage had not been reached as at this cycle's close. The RIPD standards sit alongside the earlier OAS Updated Principles on Privacy and Protection of Personal Data, adopted by the OAS General Assembly via Resolution AG/RES.2974 (LI-O/21) on 11 November 2021. Both instruments are characterised by their issuing bodies as soft law rather than binding treaty text, meaning neither directly compels any Ibero-American state to amend domestic legislation, though both function as reference points that national lawmakers and regulators may draw upon. #### Outlook The 4-5 November 2026 Ibero-American Summit is the key date to watch for whether the updated RIPD standards receive formal political endorsement. Whether and how individual states subsequently incorporate the standards into binding domestic law remains an open question not resolved this cycle. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (15) - [Organization of American States](http://www.oas.org/en/sla/dil/docs/AG-RES_2974_LI-O-21.pdf) — The OAS Inter-American Juridical Committee approved the Updated Principles on Privacy and Personal Data Protection on 9 April 2021, and the OAS General Assembly formally adopted them via resolution AG/RES.2974 (LI-O/21) in November 2021, with the OAS itself describing the instrument as inter-American soft law rather than binding treaty text. - [AEPD](https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/red-iberoamericana-actualiza-marco-comun-privacidad) — RIPD is an Ibero-American practitioner network of data-protection authorities whose permanent secretariat is held by Spain's AEPD, and whose membership of roughly 18 states includes Spain and Portugal, making it distinct from a purely Latin American mechanism. - [RIPD](https://www.redipd.org/documento/estandares-iberoamericanos-2026.pdf) — The RIPD approved an updated version of the 'Estándares de Protección de Datos para los Estados Iberoamericanos' on 26 May 2026 at its XV Ibero-American Data Protection Meeting held in Cartagena de Indias, Colombia. - [AEPD](https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/red-iberoamericana-actualiza-marco-comun-privacidad) — The updated RIPD Standards were, as of dispatch, still pending referral to SEGIB for possible formal adoption at the Ibero-American Summit of Heads of State and Government scheduled for 4-5 November 2026 in Madrid, and had not yet received summit-level political endorsement. - [OAS Secretariat for Legal Affairs, Department of International Law](https://www.oas.org/en/sla/iajc/docs/Publication_Updated_Principles_on_Privacy_and_Protection_of_Personal_Data_2021.pdf) — The OAS Updated Principles are framed to apply to both public- and private-sector processing of personal data across OAS member states, a footprint that spans the Americas (including the US and Canada) rather than Latin America alone. - [RIPD](https://www.redipd.org/documento/estandares-iberoamericanos-2026.pdf) — The RIPD Standards are addressed to 'Estados Iberoamericanos', a membership grouping that includes Spain and Portugal alongside Latin American states, and should not be characterised as bloc-wide Latin American law. - [OAS Secretariat for Legal Affairs, Department of International Law](https://www.oas.org/en/sla/iajc/docs/Publication_Updated_Principles_on_Privacy_and_Protection_of_Personal_Data_2021.pdf) — No bloc-wide controller registration or filing regime was identified under either the OAS Principles or the RIPD Standards; any such obligations exist only under individual national statutes, which are outside the scope of this bloc-level row. - [Organization of American States](https://www.oas.org/en/sla/iajc/docs/Publication_Updated_Principles_on_Privacy_and_Protection_of_Personal_Data_2021.pdf) — RIPD — Updated Estándares de Protección de Datos para los Estados Iberoamericanos, replacing the 2017 standards - [DataGuidance](https://www.dataguidance.com/news/colombia-bill-amend-data-protection-law-introduced) — Spain's AEPD; RIPD membership includes Spain and Portugal, making it Ibero-American rather than purely Latin American - [https://www.oas.org/en/sla/iajc/docs/Publication_Updated_Principles_on_Privacy_and_Protection_of_Personal_Data_2021.pdf](https://www.oas.org/en/sla/iajc/docs/Publication_Updated_Principles_on_Privacy_and_Protection_of_Personal_Data_2021.pdf) — The OAS adopted Americas-wide soft-law privacy principles in 2021, distinct from the separate Ibero-American RIPD practitioner network. - [Organization of American States](https://www.oas.org/en/sla/iajc/docs/Publication_Updated_Principles_on_Privacy_and_Protection_of_Personal_Data_2021.pdf) — OAS Updated Principles on Privacy and Personal Data Protection — Adopted by OAS General Assembly Resolution AG/RES.2974 (LI-O/21) on 11 November 2021 as inter-American soft law, distinct from the Ibero-American RIPD network (secretariat held by Spain's AEPD). - [Diario Constitucional](https://www.diarioconstitucional.cl/2026/06/17/red-iberoamericana-de-proteccion-de-datos-actualiza-estandares-de-proteccion-de-datos-ante-la-ia/) — RIPD Estándares de Protección de Datos de los Estados Iberoamericanos — RIPD approved and presented a new version of its Estándares on 26 May 2026 at the XV Ibero-American Data Protection Meeting in Cartagena de Indias, Colombia, explicitly replacing the 2017 version - [DataGuidance](https://www.dataguidance.com/news/colombia-bill-amend-data-protection-law-introduced) — Colombia (Bill 282/2026C) — Filed 26 August 2026 to amend Law 1581 of 2012, would extend the law's scope to organisations outside Colombia wherever data subjects are located, with 72-hour breach notification and fines up to 10,000 SMMLV or 5% of prior-year operating income. - [https://www.oas.org/en/sla/iajc/docs/Publication_Updated_Principles_on_Privacy_and_Protection_of_Personal_Data_2021.pdf](https://www.oas.org/en/sla/iajc/docs/Publication_Updated_Principles_on_Privacy_and_Protection_of_Personal_Data_2021.pdf) — OAS Updated Principles on Privacy and Personal Data Protection — Adopted by the OAS General Assembly via resolution AG/RES. 2974 (LI-O/21) in November 2021, based on the Inter-American Juridical Committee's April 2021 text; characterised by the OAS itself as inter-American soft law - [Organization of American States](https://www.oas.org/en/sla/iajc/docs/Publication_Updated_Principles_on_Privacy_and_Protection_of_Personal_Data_2021.pdf) — Organization of American States — The OAS Updated Principles on Privacy and Personal Data Protection (AG/RES.2974, 11 Nov 2021) are inter-American soft law, not a binding treaty. ### Latin America bloc: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Special-category and consent-exception content is well evidenced for 2026; enumerated lawful-basis and pseudonymisation/anonymisation safe-harbour text was not confirmed in retrieved sources. Primary framework RIPD Estándares de Protección de Datos para los Estados Iberoamericanos (2026) Traffic-light rationale — Amber Special-category and consent-exception content is well evidenced for 2026; enumerated lawful-basis and pseudonymisation/anonymisation safe-harbour text was not confirmed in retrieved sources. Periodic update · new data 2026-10-11 #### Lawful Processing & Special Data RIPD's updated 2026 Standards define neurodata, for the first time in this regional instrument, as data related to the functioning, activity or structure of the human brain that is capable of identifying a person or inferring information about their physiology, health or mental states. The standards place neurodata within the special, or sensitive, data categories, alongside the pre-existing categories carried over from the 2017 text. This is a soft-law classification rather than a binding legal category in any Ibero-American state's domestic law, but it marks the first time a regional reference instrument of this kind has addressed neurotechnology-derived data as a distinct and sensitive processing category, anticipating a processing risk that national legislation in the region has not yet generally addressed. #### Outlook Watch for whether any Ibero-American state begins incorporating a neurodata special category into domestic legislation following the standards' approval, and whether the Madrid Summit's possible endorsement in November 2026 accelerates that process. D2 · Lawful Processing — Full Module Record 4 sub-modules · 39 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latin America bloc: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ Core access/rectification/objection concepts are present as soft-law principles; portability and statutory deadlines are absent at the bloc level. Primary framework OAS Updated Principles on Privacy and Personal Data Protection (2021) Traffic-light rationale — Amber Core access/rectification/objection concepts are present as soft-law principles; portability and statutory deadlines are absent at the bloc level. #### Sub-modules (5) #### Access RightGreen OAS Principles recognise a right of access to personal data, including confirmation of holding and correction of inaccurate data. Claims (1): - The OAS Updated Principles recognise a right of access allowing individuals to confirm and obtain the personal data held about them, and to have inaccurate or damaging data corrected. #### Rectification And ErasureGreen OAS Principles recognise rights to erasure and to object to processing. Claims (1): - The OAS Updated Principles recognise an individual right to obtain erasure of personal data and to object to its processing. #### Restriction And ObjectionGreen 2026 RIPD Standards reinforce a right against decisions based exclusively/essentially on automated processing with legal or significant effect, including a right to human intervention. Claims (1): - The 2026 RIPD Standards reinforce a right for individuals not to be subject to decisions based exclusively or essentially on automated processing that produce legal effects or significant impacts, and to obtain human intervention in such cases. #### Data PortabilityRed No bloc-level data-portability right was evidenced in either instrument's retrieved text. #### Deadlines And Response WindowsRed Neither instrument specifies a concrete statutory response-window deadline; such deadlines exist only under individual national statutes, out of scope here. OAS Principles articulate access, rectification and erasure/objection rights in general terms. RIPD's 2026 update strengthens the objection right in the ADM context (human intervention). Portability and concrete response-window deadlines are not evidenced at bloc level. Sources and claims (3) - [OAS Secretariat for Legal Affairs, Department of International Law](https://www.oas.org/en/sla/iajc/docs/Publication_Updated_Principles_on_Privacy_and_Protection_of_Personal_Data_2021.pdf) — The OAS Updated Principles recognise a right of access allowing individuals to confirm and obtain the personal data held about them, and to have inaccurate or damaging data corrected. - [OAS Secretariat for Legal Affairs, Department of International Law](https://www.oas.org/en/sla/iajc/docs/Publication_Updated_Principles_on_Privacy_and_Protection_of_Personal_Data_2021.pdf) — The OAS Updated Principles recognise an individual right to obtain erasure of personal data and to object to its processing. - [AEPD](https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/red-iberoamericana-actualiza-marco-comun-privacidad) — The 2026 RIPD Standards reinforce a right for individuals not to be subject to decisions based exclusively or essentially on automated processing that produce legal effects or significant impacts, and to obtain human intervention in such cases. ### Latin America bloc: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Accountability, processor-contract and security content is confirmed; DPO/ROPA/breach-notification content is absent at bloc level. Primary framework RIPD Estándares de Protección de Datos para los Estados Iberoamericanos (2026) Traffic-light rationale — Amber Accountability, processor-contract and security content is confirmed; DPO/ROPA/breach-notification content is absent at bloc level. D4 · Controller & Processor — Full Module Record 7 sub-modules · 36 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latin America bloc: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Some concrete state-level transfer-safeguard evidence exists (RIPD model clauses, Convention 108+ accessions); no bloc-wide adequacy/localisation instrument exists. Primary framework Council of Europe Convention 108+ (individual-state accession only); RIPD model contractual clauses (individual-state adoption only) Traffic-light rationale — Amber Some concrete state-level transfer-safeguard evidence exists (RIPD model clauses, Convention 108+ accessions); no bloc-wide adequacy/localisation instrument exists. Periodic update · new data 2026-10-19 #### Cross-Border & Adequacy No bloc-wide transfer mechanism exists across the LATAM region equivalent to an adequacy regime. The RIPD's 2026 Estandares place particular emphasis on facilitating international personal-data transfers, articulating common criteria and bases intended to favour the region's social and economic development, while explicitly remaining non-binding soft law rather than a legal transfer mechanism. Separately, and independently of any RIPD or OAS initiative, a pattern of individual-state accession to the Council of Europe's Convention 108+ has continued to develop: Uruguay acceded in 2013, Mexico in 2018, and Argentina ratified on 17 April 2023. These accessions reflect choices made by individual states rather than a coordinated bloc position, and should not be read as evidence of LATAM-wide harmonisation on cross-border transfer standards. The result is a region where a state's cross-border transfer posture depends on which of these separate tracks, if any, it has joined: Convention 108+ accession, domestic legislation modelled on the RIPD's non-binding criteria, or neither. No single instrument currently supplies a transfer mechanism that operates uniformly across the bloc. #### Outlook The RIPD's transfer-facilitation language in the 2026 Estandares gives national legislators a common reference point, but converting that soft-law emphasis into an operative cross-border mechanism would require individual states to adopt implementing provisions, since the RIPD itself has no power to create a binding regional transfer regime. Further Convention 108+ accessions by other LATAM states remain a separate and independent path to watch. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 94 words · 12 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latin America bloc: D6 Sectoral Watch7 sub-modulesRedEnacted in forceModule confidence: Probable▾ No bloc-wide sectoral overlay content was found in either anchor instrument for any of the seven declared sub-modules. Traffic-light rationale — Red No bloc-wide sectoral overlay content was found in either anchor instrument for any of the seven declared sub-modules. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 54 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latin America bloc: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No general-population adtech/commercial-privacy content found; only a minors-specific cross-reference exists. Traffic-light rationale — Red No general-population adtech/commercial-privacy content found; only a minors-specific cross-reference exists. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 50 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latin America bloc: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Strong, recent (2026) soft-law content on profiling, ADM transparency, AI risk assessment and biometrics; genetic data and surveillance carveouts remain gaps. Primary framework RIPD Estándares de Protección de Datos para los Estados Iberoamericanos (2026) Traffic-light rationale — Green Strong, recent (2026) soft-law content on profiling, ADM transparency, AI risk assessment and biometrics; genetic data and surveillance carveouts remain gaps. Periodic update · new data 2026-11-04 #### Algorithmic, Biometric & Surveillance Governance The Ibero-American Data Protection Network has unanimously approved an updated set of regional Standards for Data Protection for Ibero-American States, adopted at Cartagena de Indias and replacing the 2017 version. The central substantive change is the addition of provisions addressing artificial intelligence, automated decision-making, biometrics and neurodata, categories the prior version of the Standards did not address. This is the first time this regional soft-law instrument has engaged directly with these emerging technology categories, and it signals a coordinated regulatory direction among the network's member authorities toward treating algorithmic and biometric processing as requiring distinct governance attention rather than being folded into general data protection principles. The updated Standards have been forwarded to SEGIB, the Ibero-American General Secretariat, for possible adoption at the Ibero-American Summit in Madrid on 4-5 November 2026, a date falling just after the anchor point. Until that summit decision is known, the Standards remain non-binding regional guidance: they express a unanimous convergence of view among RIPD member authorities on how artificial intelligence, automated decision-making, biometrics and neurodata should be governed, but they do not themselves create enforceable obligations in any individual state. Any binding effect would have to come from subsequent national legislation adopted consistently with the Standards, or from whatever political weight a summit-level endorsement might add. This durable structural point bears stating plainly: the significance of this development lies in the coordination itself, not in any immediate legal effect. A unanimous regional approval of standards addressing artificial intelligence and biometrics is a meaningful signal of regulatory direction for a bloc that has historically varied widely in how comprehensively its member states regulate data protection, let alone emerging technology categories specifically. It indicates that the regional conversation has moved to treat these categories as requiring dedicated standards language, which is itself new relative to the 2017 baseline. #### Outlook The near-term event to watch is the outcome of the Ibero-American Summit on 4-5 November 2026, which will determine whether the updated Standards receive head-of-state-level political endorsement. Separately, and over a longer horizon, attention should turn to whether individual Ibero-American states begin incorporating artificial intelligence, automated decision-making, biometric or neurodata provisions into their own national legislation consistently with the updated regional Standards, which would be the point at which this soft-law convergence would translate into enforceable obligations. Periodic update · new data 2026-11-03 #### Algorithmic, Biometric & Surveillance Governance The Red Iberoamericana de Protección de Datos has approved a substantial update to its Estándares de Protección de Datos para los Estados Iberoamericanos, the regional standards text it last revised in 2017. The update adds provisions covering artificial intelligence systems, automated decision-making, biometric data processing and neurodata, an emerging category covering data derived from neural or brain-computer interfaces. The approval within the network was unanimous, and the revised text has been forwarded to the Secretaría General Iberoamericana for possible formal adoption at the Ibero-American Summit of Heads of State and Government, scheduled for 4-5 November 2026 in Madrid. It is worth being precise about what this instrument is and is not. The RIPD network's membership spans Spain and Portugal alongside Latin American data protection authorities, so what is being built here is an Ibero-American standard rather than a purely Latin American one, and its legal status even on adoption would be soft law - a standard for member authorities to draw on, not a directly binding regional regulation comparable to the EU's General Data Protection Regulation. That said, the practical gap this fills is real: no bloc-wide binding authority or framework currently governs algorithmic and biometric processing across Latin American states, with substantive rules on these subjects set individually by each country that has chosen to legislate on them. A unanimously approved regional standard addressing AI and biometrics, even if non-binding, would give national regulators and legislators across the region a common reference text to draw from when building or amending their own domestic rules - a function soft-law instruments have historically served in this region, including the OAS's own earlier Updated Principles on Privacy and Personal Data Protection. The adoption question remains open as of this reporting window. The Ibero-American Summit at which SEGIB might adopt the text falls on 4-5 November 2026, just after the date this account is anchored to, so whether the Estándares update is formally adopted, adopted with amendment, or deferred cannot yet be stated. What can be stated is that the text has cleared unanimous approval within the network that drafted it, which is itself a meaningful procedural threshold for a document covering as contested a set of subjects as AI and biometric governance. #### Outlook Whether the Ibero-American Summit formally adopts the updated Estándares on 4-5 November 2026 will determine whether this text moves from a network-approved draft to a standard SEGIB member states are invited to implement. Adoption would not create binding obligations in any Latin American state directly, but it would give national legislators drafting AI or biometric rules a common regional reference point for the first time. A primary SEGIB or RIPD document confirming the Summit's outcome, rather than media reporting of network deliberations, would materially strengthen the evidentiary basis for anything said about this instrument going forward. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance The Ibero-American Data Protection Network's 2026 update to its regional standards incorporates, for the first time, specific references to artificial intelligence, automated decision-making, bias prevention, algorithmic governance and neurodata. These are new additions against the prior 2017 text, which did not address this territory, and mark the clearest extension of the region's soft-law privacy framework into algorithmic-governance subject matter identified this period. Pinpoint article-level detail of exactly how the updated text frames the automated-decision and neurodata provisions has not been obtained, so the precise operative content of these provisions cannot yet be stated beyond the fact of their inclusion. A related outcome reported from the same 2026 meeting, recounted in Argentina's own data-protection authority's account of its participation, was the approval of a regional reference framework specifically for the design, deployment and ethical supervision of artificial-intelligence systems and other emerging technologies. This reference framework sits alongside, and is distinct from, the AI-related amendments made to the Estándares themselves, though both emerged from the same 2026 gathering and reflect the same underlying regional push to bring data-protection soft law into alignment with AI-governance concerns. Neither the amended standards nor the reference framework binds any state directly. #### Outlook Obtaining pinpoint article-level detail of the automated-decision and neurodata provisions, and tracking whether the new AI reference framework is operationalised by any individual member authority, are the two developments most likely to sharpen this picture going forward. Periodic update · new data 2026-10-19 #### Algorithmic, Biometric & Surveillance Governance This is the module where the RIPD's 2026 update is most consequential. The revised Estandares, approved 26 May 2026, incorporate for the first time provisions addressing artificial intelligence, automated decision-making, biometrics, the prevention of algorithmic bias, and the data quality used by automated systems — none of which featured in the 2017 version they replace. The RIPD followed this with a dedicated instrument specifically on this ground: on 25 September 2026 it approved the Estandares Iberoamericanos sobre el uso de datos personales en sistemas de inteligencia artificial, following consultation and technical deliberation among member authorities. Together the two texts give the region's data protection authorities a common, if non-binding, reference framework for AI and automated-decision governance where previously none existed at the regional level. The same 2026 Estandares also define neurodata for the first time within the special-category framework, as data related to the functioning, activity or structure of the human brain capable of identifying a person, or of revealing information about their physiology, health or mental states. This places neurotechnology-derived data on a comparable special-category footing to other sensitive data types under the RIPD's framework, ahead of any binding national legislation addressing the category specifically. As with the rest of the RIPD's output, none of this is directly enforceable against any member state; its effect depends on national transposition. #### Outlook The near-term question is uptake: whether individual LATAM data protection authorities begin referencing the AI-specific instrument or the neurodata definition in their own guidance or enforcement practice, and whether any national legislature moves to enact binding AI or neurodata provisions modelled on the RIPD text. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance RIPD's Strategic Plan 2026-2030 establishes a regional reference framework intended to guide the design, deployment and ethical oversight of artificial-intelligence systems and other emerging technologies across Ibero-American states. The Plan also creates an Ibero-American Data Protection Observatory, intended to support ongoing regional analysis and foresight on these issues; the Observatory concept is reported as having endorsed a proposal originally put forward by Argentina. Taken together with the neurodata special-category addition described above, this signals a deliberate broadening of the region's soft-law reference framework to address AI-driven and biometric or neuro-technological processing risks, even though the instrument binds no state directly. #### Outlook The Observatory's establishment and its first areas of analytical focus are worth watching as the framework moves from strategic plan to operational activity; no operational milestones were evidenced this cycle beyond the Plan's establishment. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 44 words · 11 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latin America bloc: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong minors-specific content in 2026 Standards; parental-consent mechanics, education-settings rules and dependent-adult protections remain gaps at bloc level. Primary framework RIPD Estándares de Protección de Datos para los Estados Iberoamericanos (2026) Traffic-light rationale — Amber Strong minors-specific content in 2026 Standards; parental-consent mechanics, education-settings rules and dependent-adult protections remain gaps at bloc level. Periodic update · new data 2026-11-04 #### Children & Vulnerable Groups The same 2026 update to the Ibero-American Data Protection Network's regional Standards introduces reinforced accountability measures specifically directed at the processing of children's personal data. The measures described in reporting on the update include privacy-by-default settings for services handling children's data, limitations on access to that data, restrictions on profiling and targeted advertising directed at minors, and tools intended to support effective age verification together with mechanisms allowing users to block or mute unwanted contact. These provisions sit within the same unanimously approved Standards text adopted at Cartagena de Indias, replacing the 2017 version, and carry the same pending status as the artificial intelligence and biometrics provisions discussed elsewhere in this update: the Standards have been forwarded to SEGIB for possible adoption at the Ibero-American Summit in Madrid on 4-5 November 2026, a date that falls just after the anchor point. The confidence behind this specific set of measures is understood to be qualified rather than fully confirmed, reflecting that the detailed children's-data provisions are drawn from secondary reporting on the Standards update rather than from a directly retrieved primary text of the full instrument. The direction of the measures is nonetheless clear: age verification, profiling and advertising restrictions, and contact-blocking tools represent a substantive expansion of how the regional framework treats children as a category warranting distinct protective measures, where the prior 2017 Standards did not address these questions with comparable specificity. As with the artificial intelligence and biometrics provisions in the same update, these children's-data measures remain non-binding regional guidance pending any summit-level adoption decision. They do not themselves create an enforceable age-verification or profiling-restriction obligation in any individual Ibero-American state. Their significance lies in signalling where the region's coordinated regulatory attention is heading: toward treating children's data processing, including profiling, advertising and age verification, as warranting dedicated reinforced accountability measures rather than general-purpose data protection rules alone. #### Outlook Whether these children's-data measures gain additional political weight will depend on the outcome of the Ibero-American Summit on 4-5 November 2026. Beyond that date, the measures' practical significance will depend on whether individual states translate the age-verification, profiling-restriction and contact-blocking elements into binding national legislation, since the regional Standards themselves do not carry direct legal force absent such domestic implementation. Periodic update · new data 2026-11-03 #### Children & Vulnerable Groups The same 2026 update to the RIPD's Estándares de Protección de Datos para los Estados Iberoamericanos that addresses artificial intelligence and biometrics also introduces reinforced-accountability measures specifically for children's personal data. The provisions, as reported, include default privacy-protective configurations for services used by minors, restrictions on profiling and behavioural advertising directed at children, and requirements for effective age-verification mechanisms alongside tools allowing children or their guardians to block or mute unwanted contact. This detail is understood to form part of the unanimously approved standards text now forwarded to the Secretaría General Iberoamericana for possible adoption at the Ibero-American Summit of 4-5 November 2026. The reinforced-accountability framing is notable against the backdrop of a region where protections for children's data have, to date, been set individually and unevenly by national legislators, with no common regional baseline. If adopted, this would be the first soft-law standard reaching across Latin American states to specifically address default privacy settings, profiling restrictions and age verification for minors as a connected package, rather than leaving each element to be addressed piecemeal in domestic law. The age-verification element in particular echoes a broader global regulatory current - jurisdictions well beyond this region have moved toward requiring verifiable age checks for services accessed by children - and its appearance in a regional Ibero-American standard suggests that current is reaching Latin American standard-setting bodies as well as national legislatures. Confidence in the specifics of the children's-data provisions is somewhat more qualified than for the AI and biometric provisions in the same update, reflecting that this detail rests on the same regional media account of the network's internal deliberations rather than a primary network or SEGIB document retrieved and reviewed directly. The substance of what the update does for children's data should accordingly be read as probable rather than confirmed pending sight of the underlying text. #### Outlook As with the AI and biometric strand of the same update, whether these children's-data provisions survive into a formally adopted text depends on the outcome of the 4-5 November 2026 Ibero-American Summit, a date falling just beyond this reporting window. Sight of the primary RIPD standards document, once available, would allow the specific accountability and age-verification mechanisms described here to be confirmed against the actual text rather than against secondary reporting of the network's approval process. Periodic update · new data 2026-10-25 #### Children & Vulnerable Groups The Ibero-American Data Protection Network's 2026 update to its regional standards strengthens specific guarantees for the protection of children and adolescents in digital environments. The updated text names default protective configurations, limitations on access, restrictions on profiling and behavioural advertising directed at minors, effective age-verification measures, and tools enabling guardians to exercise group-level control over a child's digital environment, as elements of the strengthened approach. These provisions form part of the same 26 May 2026 update that replaced the network's prior 2017 standards and that, separately, introduced the network's first references to artificial intelligence and related technologies. As with the AI-facing elements of the same update, the children's-protection provisions are soft law addressed to RIPD's member authorities across Latin America, Spain and Portugal, rather than directly binding obligations on any single state. The strengthening is nonetheless a substantive move: naming effective age verification and restrictions on profiling and behavioural advertising directed at minors as named elements goes beyond general, abstract privacy principles and into specific operative territory that a member authority could draw on in its own domestic guidance. #### Outlook Whether any individual member state incorporates the strengthened children's-protection language from the 2026 standards into its own binding domestic law, and whether the standards are formally adopted at the anticipated Ibero-American Summit of Heads of State in the second half of 2026, are the developments to track on this module. Periodic update · new data 2026-10-19 #### Children & Vulnerable Groups The RIPD's 2026 Estandares introduce reinforced-responsibility measures for the processing of minors' personal data, a substantive expansion over the 2017 text they replace. These measures include default protective-privacy configurations, limitations on access to minors' data, restrictions on the construction of profiles and on behavioural advertising directed at minors, requirements for effective age verification, and tools enabling the blocking, muting and control of groups. The provisions sit within the same May 2026 update that introduced the Estandares' first treatment of artificial intelligence, automated decision-making and neurodata, reflecting a broader recognition within the update that minors face compounding risk from automated and profiling-based systems specifically. As with the rest of the RIPD framework, these measures are non-binding soft law: the RIPD has no sanctioning power over member states, and the practical protection afforded to minors in any given LATAM jurisdiction depends on whether that jurisdiction's own data protection authority or legislature adopts equivalent binding rules domestically. #### Outlook The measure to watch is domestic transposition: whether any LATAM data protection authority issues guidance or regulation incorporating the RIPD's default-privacy, age-verification or behavioural-advertising restrictions for minors, converting soft-law recommendation into enforceable domestic obligation. Periodic update · new data 2026-10-11 #### Children & Vulnerable Groups RIPD's 2026 Standards strengthen the region's reference provisions on consent for children's and adolescents' personal data. The standards require that, in obtaining such consent, the controller secure authorisation from the holder of parental authority or guardianship, applied under the representation rules of each Ibero-American state's own domestic law -- meaning the precise mechanics of parental authorisation remain nationally determined even as the standard itself is regional. A further, more specific provision, at point 14.3 of the standards, requires that processing for profile-building for advertising purposes obtain a specific consent kept separate from consent given for other processing. This separate-consent requirement is targeted at preventing a single, bundled consent from covering commercial advertising-profiling of minors, addressing a processing practice that general consent frameworks often fail to isolate. #### Outlook As with the other 2026 Standards provisions, the practical effect of these children's-consent and profiling-consent rules depends on domestic transposition by individual Ibero-American states; no such transposition was evidenced this cycle. Periodic update · new data 2026-09-28 #### Children & Vulnerable Groups Protection of children and adolescents in digital environments has been named among the principal innovations of the RIPD's 2026 Estandares update, sitting alongside the algorithmic-governance and neurodata additions discussed elsewhere in this cycle's coverage as one of the headline axes of the revised regional standard. This finding is reported at a probable, rather than confirmed, confidence tier, since it traces to a characterisation of the update's principal innovations rather than to a direct citation of the specific children's-protection provisions themselves; the underlying source establishes that this is a named priority of the update without necessarily detailing every specific mechanism the update introduces for this population. The inclusion of children and adolescents' digital-environment protection as a principal innovation is notable given the RIPD's function as a regional soft-law benchmark spanning Ibero-American, not purely Latin American, member states: a standard-setting body of this kind naming a vulnerable-groups protection as one of its headline updates signals that the issue has achieved sufficient regional consensus to warrant explicit treatment in the benchmark document, even though, as with the algorithmic-governance provisions, any binding effect depends on subsequent domestic legislative or regulatory action by individual member states. No LATAM-specific national-level development on children's or vulnerable-groups data protection, distinct from this regional benchmark update, was located this cycle; the finding here is confined to the regional-standard level. #### Outlook Given this is reported at a probable rather than confirmed confidence tier and traces only to a characterisation of the update's principal innovations, a dedicated review of the Estandares' specific children's-protection text would materially improve confidence in exactly what mechanisms this innovation comprises. Whether individual LATAM member states subsequently draw on this regional benchmark to strengthen their own domestic children's-data-protection provisions is the item to watch in coming cycles. D9 · Children's Privacy — Full Module Record 5 sub-modules · 37 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latin America bloc: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ No bloc-wide penalty/enforcement-activity content exists; DPA-capacity and judicial-recourse principles are evidenced, and recent (≤180d) developments are well documented. Primary framework RIPD Estándares de Protección de Datos para los Estados Iberoamericanos (2026) Traffic-light rationale — Amber No bloc-wide penalty/enforcement-activity content exists; DPA-capacity and judicial-recourse principles are evidenced, and recent (≤180d) developments are well documented. Periodic update · new data 2026-09-28 #### Enforcement & Redress Brazil's ANPD underwent a significant capacity and institutional-standing shift this cycle. Lei No. 15.352/2026 converted the ANPD into an autonomous regulatory agency with its own legal personality and financial autonomy, a material change from its prior institutional status. Concretely reflecting that new capacity, the ANPD's first public hiring competition, for 50 positions, was authorised on 24 June 2026, suggesting the agency is moving to build out staffing commensurate with its expanded autonomous mandate. That expanded capacity appears to be translating into enforcement activity: in June 2026 the ANPD opened 19 new administrative sanctioning proceedings, described as the largest such batch in the authority's history. This is a material escalation-of-activity signal, though it should be read against the authority's enforcement record to date, which remains thin in absolute terms: Brazil has, as of this cycle's sourcing, a single public LGPD fine applied to a private company, R$14,400 against Telekall Infoservice for processing without legal basis. That fine sits far below the maximum sanctioning power available to the ANPD under LGPD Article 52, which authorises fines of up to R$50 million or 2% of the company's Brazilian revenue per infraction, whichever is lower, alongside non-monetary sanctions including warnings, publicisation, data blocking or deletion, and processing suspension. All of the Brazilian enforcement findings in this module are reported at a probable, rather than confirmed, confidence tier, since they trace to Brazilian legal-blog and compliance-industry sourcing rather than to a directly retrieved ANPD primary-source page; this is a material sourcing gap given that ANPD enforcement is the strongest enforcement-activity signal in this cycle's LATAM data-protection coverage, and a primary-source retrieval in a future cycle would be the single most valuable improvement to confidence here. The combination of newly gained institutional autonomy, an enlarged hiring plan, and the largest-ever sanctioning batch together describe a regulator moving from a comparatively quiet enforcement posture toward a more active one, even though the absolute enforcement record, one public fine to date, has not yet caught up with that shift in institutional capacity and activity volume. #### Outlook Whether the 19 sanctioning proceedings opened in June 2026 result in published fines, and at what scale relative to the LGPD Article 52 ceiling, is the central item to track for Brazil's enforcement trajectory in coming cycles; a wave of published outcomes from this batch would be the clearest signal yet of whether the ANPD's new autonomy is translating into materially increased sanctioning activity. Separately, retrieving ANPD's own primary-source enforcement records directly, rather than relying on Brazilian legal-blog secondary sourcing, would meaningfully strengthen the evidentiary basis for tracking this module going forward. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 42 words · 11 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) data localisation Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties