Brazil's Bill 4,675/2025 Advances on Cybersecurity

Brazil’s Bill 4,675/2025, which creates a specific regime for economically significant actors in digital markets and expands CADE’s authority to regulate large platforms, is formally ready for a vote in the Chamber of Deputies. The bill is moving under an urgency procedure and is listed as "Pronta para Pauta no Plenário" and "Aguardando Despacho do Presidente da Câmara".

What changes in Brazil?

The bill is meant to organize how major platforms operate under a separate framework for actors deemed systemic. According to the research material, it is also tied to a broader cybersecurity framework that includes a National Cybersecurity Policy and a National Cybersecurity Committee, with an emphasis on the link between cyber defense and national security.

That legal framework in Brazil points to possible impacts on risk management obligations, critical infrastructure protection and interagency coordination. At the same time, coverage from Café com Bytes says that, despite the urgency procedure, regulation of big tech companies could be pushed to 2027.

What other fronts are moving in the region?

Chile, Mexico and Colombia also have pending initiatives that address personal data, digital violence and content generated with artificial intelligence. In Chile, the Chamber of Deputies approved the bill against deepfakes in general terms. It creates a right to "digital integrity," sets fines between 5,000 and 10,000 UTM, and sends the text back to committee for further review.

In Mexico, federal deputy Mónica Elizabeth Sandoval Hernández introduced a reform to Article 47 of the General Law on the Rights of Girls, Boys and Adolescents. The proposal would establish coordinated mechanisms for prevention, reporting and response to digital violence against minors. It also includes coordination duties among federal, state, municipal and Mexico City authorities.

In Colombia, a specialized analysis describes Statutory Bill 282 of 2026 as a proposal that would impose fines of up to 5% of annual operating revenue, extend territorial scope with a model inspired by Europe and add two compliance changes, treating location data as sensitive and granting an explicit right to refuse advertising profiling. The text appeared in the Congressional Gazette on September 8, 2026.

What about Uruguay and Bolivia?

In Uruguay, lawmakers are discussing regulations for the Anti-Money Laundering Law with input from the College of Accountants and other involved sectors. The process is still in a review and consultation stage before the final draft of the decree moves forward. This is not a cybersecurity-specific law, but it does affect compliance obligations for anti-money laundering prevention.

In Bolivia, an analysis of the data protection framework says the country has no personal data protection law and no supervisory authority. According to that text, this means there are no specific legal obligations on transparency, data deletion or incident notification, although the material does not mention any bills underway to close that gap.