Latin America Regulation and Compliance, September 2026

Monthly reference modules

These modules are filled automatically with verified dated facts from within the period. Each one states its source base and counting criteria so the figures reconcile across modules. They are the recurring month-to-month read, and the analysis that follows develops the cases without repeating this summary.

Indicator window: 849 dated facts in September 2026 · 143 from earlier months (comparison frame, not monthly volume) · 8 after the period (excluded). Facts from earlier months are used only as a comparison frame in the analysis, never as volume for this period.

Executive summary

The period under review showed an unusual mix of regulatory movement and institutional refinement across three areas that are becoming increasingly intertwined for security and compliance teams: data protection, platform oversight and cybercrime. The clearest development came in Brazil, where the ANPD moved ahead with a public hearing and a public consultation to recalibrate its oversight and sanctioning framework, while media coverage continued to show more active use of preventive powers in cases tied to minors and digital environments. At the same time, Argentina consolidated a criminal policy and state modernization agenda with the creation of PRONACIB and a bill that brings cybersecurity and critical infrastructure into a National Security System. Added to that were significant signals in Peru, Ecuador, Paraguay and Entre Ríos, where compliance timelines, legislative debates and digital administration reforms are pushing organizations to review governance, traceability and internal accountability.

From a CISO perspective, the key point is not just that there are more rules or proposals, but that the mechanisms for state intervention are being defined more clearly: incident reporting within short deadlines, precautionary powers over features, transparency and auditability criteria for AI, and obligations to preserve digital evidence. That means controls are no longer judged only by whether they exist on paper, but by whether they can support regulatory decisions, respond to incidents and demonstrate reasonable diligence in the face of possible investigations. The convergence of data protection, cybersecurity, digital consumer protection and criminal policy creates an environment where a single technical weakness can trigger administrative, reputational and procedural consequences at the same time.

Overview

The month’s regulatory map confirmed that Latin America continues to move away from a fragmented view of digital security. In Brazil, the ANPD launched an explicit discussion on how to supervise more proportionally, preventively, and at scale, with different procedures depending on the severity of the violation and the economic size of the data controller. The proposal goes beyond sanctions. It also introduces precautionary preventive measures, compliance adjustment deadlines, and priority remediation plans, suggesting a regulator that is less focused on ex post punishment and more oriented toward changing behavior in real time. For companies, the operational message is clear: the absence of a serious incident does not eliminate scrutiny if there are imminent risks to users, especially children and adolescents.

Argentina, meanwhile, showed a two-track state response. On one hand, the Ministry of Justice created PRONACIB to organize diagnostics, preserve evidence, and coordinate capabilities against cybercrime with an evidence-based approach. On the other, the Executive Branch sent Congress a 133-article bill to create a National Security System with explicit responsibilities for cybersecurity and critical infrastructure. That combination matters because it links the operational response to crime with a broader regulatory architecture designed to protect assets and facilities whose systemic impact could affect health, the economy, defense, or the functioning of the state. The signal for regulated sectors is that cybersecurity is no longer a standalone technical function and is becoming part of national security and the continuity of essential services.

Peru offered a reference point for maturity in personal data compliance. Under Regulation of Law 29733, medium-sized companies have a reference date of November 30, 2026, to complete the designation of the Personal Data Officer. Beyond the specific date, the detail shows that compliance is being phased in by layer, based on organization size and nature, rather than as a uniform obligation across the market. For a CISO or privacy lead, that means compliance cannot be solved with a general policy alone. It requires clear role assignment, a treatment inventory, incident response, and real internal oversight capacity.

At the same time, Brazil’s press and public agencies reflected a particularly sensitive debate about child protection and digital platforms. While some of the coverage relied on specific cases and some on proposals still under discussion, the pattern is consistent. Regulators appear willing to demand more intrusive measures when they see material risks to children and adolescents, including stronger parental controls, tighter privacy settings, and powers to temporarily suspend specific features. For platforms and their technology providers, the implication is direct: default settings, age segmentation, and the traceability of algorithmic decisions are moving from best practices to verifiable expectations.

Indicators

Volume and scope indicators

The period indicators should be read as a snapshot limited to the material analyzed, not as a full measure of all regional activity. In this edition, the main signal was not the raw number of technology incidents, but the density of regulation and the range of state mechanisms activated. When the material does not show a data point, that does not mean the event did not occur in the region, it only means it did not appear in the corpus reviewed for this report. In particular, if any indicator is reported as zero, it should be understood as no appearance in the material analyzed, not as the regional absence of that phenomenon.

On telemetry, every figure for attempts, blocks, scans, or detections should be understood as automated background noise, not as confirmed intrusion. For that reason, even when vendors or technical sources show striking numbers, they should not be mixed with confirmed incidents or used on their own to infer a rise in operational risk. The report keeps that separation, telemetry describes environmental pressure, while incidents describe events with verifiable impact or a defined institutional response.

Regulatory indicators

Regulatory activity during the period was concentrated in Argentina and Brazil, with notable extensions in Peru and other countries with legislative or administrative agendas in motion. Brazil's ANPD opened a public hearing and then a public consultation on updating its inspection rules and administrative sanctioning process, while the public debate expanded to include precautionary measures and differentiated procedures. In Argentina, the creation of PRONACIB and the draft National Security System aimed to institutionalize a policy to combat cybercrime and protect critical infrastructure with a focus on digital evidence. In Peru, the reference date for the Personal Data Officer consolidated a gradual timeline based on the size of the organization.

The operational reading of these moves is that the region is converging toward a more documented compliance model that is more sensitive to risk. It is no longer enough for a company to say it has a security or privacy program. It now has to show how it detects, assesses, contains, records, and reports. The growing importance of traceability as a regulatory requirement affects financial institutions, digital platforms, public agencies, and technology providers alike. That forces a review of processing records, risk matrices, incident response plans, third-party controls, and evidence mechanisms.

State response indicators

The state response showed an increasingly operational bias. In Argentina, PRONACIB was designed to identify, track, secure, seize, and analyze virtual assets and associated digital evidence, as well as to produce diagnoses on cybercrime methods. That points to an effort to build permanent capabilities, not just react case by case. The possibility of interagency working groups with public bodies, judicial authorities, security forces, companies, and other private actors points to broader governance, something especially relevant for sectors with high exposure to fraud, infrastructure abuse, and digital crime.

In Brazil, the ANPD showed a preventive logic. Precautionary measures, the temporary suspension of specific algorithmic functions, and the possibility of formalizing conduct adjustment agreements indicate that the regulator does not want to limit itself to sanctioning after the harm. It wants to intervene earlier, when the risk is identifiable and potentially harmful to vulnerable users. That shift changes risk management on platforms, because the regulatory response time can be shorter than the traditional technical remediation cycle.

Incidents

Brazil: platform oversight, child protection, and the TikTok/Discord case

Brazil was the country with the highest density of enforcement signals and regulatory debate during the period. ANPD announced, and then held, a public hearing to update its Regulation of the Inspection Process and the Administrative Sanctioning Process. It said the review is split into two stages, first the public hearing and then a public consultation on the Brasil Participativo platform. The discussion did not stay abstract. Specialized coverage said the proposal includes different procedures depending on the severity of the violation and the economic size of the data controller, as well as precautionary preventive measures for cases involving imminent risks to users’ physical or psychological integrity. For compliance teams, this means proportionality must be treated not only as a defense against the regulator, but as part of internal design, with differentiated escalation, prioritization, and evidence processes.

That same regulatory agenda was tied to the protection of children and adolescents in digital environments. Specialized coverage reported that ANPD had ordered the suspension in Brazil of Discord’s video streaming feature and equivalent video-sharing tools, in the context of controls aimed at preventing and mitigating risks to the rights of children and adolescents. While the details of the case go beyond the scope of this report, the operational reading is clear: a data regulator can restrict specific features when it believes a platform’s design or control model does not provide enough safeguards. That forces companies to prepare responses that go beyond legal teams and include product, engineering, user experience, trust and safety, and customer support.

In the TikTok-related case, press coverage of the Brazilian matter indicated that accounts belonging to users under 16 should automatically adopt stricter privacy settings, which could be changed with guardian authorization, along with stronger parental controls. That should not be read as a general obligation for every platform in Brazil, but as the kind of measure the regulatory and judicial debate is bringing into the market. The analytical value lies in the direction of travel, stricter defaults, stronger parental oversight, and less tolerance for opaque design in mass-market products for minors. For CISOs and privacy leaders, that means reviewing how algorithmic decisions are documented, what data is collected from teenagers, and what controls exist to minimize unnecessary exposure.

The significance of the case is not limited to the sanction or the precautionary measure. It also shows how Brazil’s enforcement ecosystem is integrating data protection, security, and child protection. The reference to semiannual transparency reports for providers with more than one million children and adolescent users, while not automatically attributable to a current TikTok obligation, does reflect the kind of expectation the regulator is willing to place on the market. In practical terms, the challenge for platforms is to build accountability for risk profiles, moderation, incidents, and mitigation decisions.

Brazil: consultation on platform oversight and possible precautionary measures

ANPD’s public consultation on new rules for digital platform oversight deserves separate analysis because it marks a shift from reactive enforcement to a more sophisticated regulatory design. Coverage from Portal do Holanda said the proposed scope could include providers of tech products aimed at children and adolescents, digital platforms, and companies with likely access to minors, as well as possible investigations into internet users’ rights and the protection of women in digital environments. From a public policy perspective, this shows ANPD is thinking in terms of risk categories, not only service types.

One important point is the possibility of requiring disclosure of revenue or the number of Brazilian users, along with daily fines of up to R$ 50 million for failing to comply with precautionary measures. These mechanisms appear in a proposal that is still subject to change, so they should not be described as current rules. Even so, their presence in the debate already has operational consequences. Companies must anticipate how they would respond to financial information requests, possible suspension orders, and accelerated compliance measures. For the CISO, that means service continuity and the ability to produce regulatory evidence become as important as classic technical security.

The public hearing registered 43 participants, including specialists and representatives from the public and private sectors. That figure is not a risk indicator, but it does show there is a critical mass of interest in the topic and that ANPD is looking for technical input, not just legal analysis. The involvement of experts and business actors matters because it can crystallize de facto standards on proportionality, the legitimacy of precautionary measures, and verification criteria. Anyone waiting for the final publication before adapting will probably be late.

Brazil: LGPD, security incidents, and the duty to keep records

The Brazilian discussion on enforcement cannot be separated from the already established obligations on security incidents. A specialized LGPD compliance publication said Resolution CD/ANPD No. 15/2024 requires notification to ANPD and data subjects, within up to three business days, of incidents that may cause relevant risk or harm. It also said incidents must be recorded, including those that are not reported. That point is central to incident response practice because it creates a dual discipline, report when required and always keep records.

For security teams, this changes how the incident playbook works. Containing the event is not enough. Teams need traceability for decisions, the criteria that led to reporting or not reporting, the risk assessment, and remediation steps. In other words, documentation is no longer an administrative byproduct, it is a defense asset. If an incident is later reviewed by an authority, the company will need to reconstruct timing, responsible parties, impact analysis, and mitigation evidence. The obligation to record unreported incidents is especially relevant because it prevents organizations from selecting only the cases that are easy to present and omitting smaller events that, together, reveal systemic weaknesses.

Argentina: PRONACIB creation and an institutional leap in cybercrime

On September 25, 2026, Argentina’s Ministry of Justice created the National Program for Criminal Policy on Cybercrime and Digital Evidence, known as PRONACIB, under the Undersecretariat for Criminal Policy of the Secretariat of Justice. The resolution was signed by Justice Minister Juan Bautista Mahiques and published in the Official Gazette, which also stated that any processing of personal data carried out under the program must comply with Law 25.326, its regulatory decree, and all applicable complementary rules. That detail matters because it sets an explicit limit, even in a criminal policy focused on digital evidence, data processing is not exempt from privacy rules.

PRONACIB includes work streams on identification, tracking, traceability, securing, seizure, and analysis of virtual assets and digital evidence. It also covers preservation and analysis of digital evidence, cybersecurity applied to investigations, virtual assets, and the impact of artificial intelligence and other emerging technologies on criminal methods. From a public policy standpoint, this shows the Argentine state recognizes that criminal investigations can no longer rely only on traditional tools. They need digital forensic skills, technical analysis capabilities, and an understanding of new attack surfaces.

The appointment of Mariano Tomás Rivas as ad honorem coordinator adds another relevant detail. The program does not appear to be a purely bureaucratic structure, but a coordination node with specific leadership. The possibility of forming interinstitutional working groups with public and private actors also suggests the government wants to build coordinated response capacity. For companies, this has a concrete consequence, cooperation with investigations and digital evidence requests will become more structured, and it will be worth preparing internal processes for preservation, chain of custody, and response to official orders.

Argentina: National Security System bill and critical infrastructure

In parallel with PRONACIB, Argentina’s Executive Branch sent Congress a 133-article bill organized into eight chapters that creates a National Security System and adds cybersecurity and protection of public and private critical infrastructure. According to the coverage reviewed, the bill entered the Chamber of Deputies on September 17, 2026, began committee debate on September 30, and the ruling party expects a second meeting on October 6 to bring it to the floor on October 21. That legislative calendar matters because it helps estimate when the discussion on institutional scope and obligations for critical actors could start taking shape.

The definition of critical infrastructure included in the bill covers public or private facilities, networks, systems, services, and assets whose interruption or destruction could significantly affect security, defense, health, the economy, essential services, or the functioning of the state. That wording is broad enough to cover sectors with very different exposure profiles, from energy and health to telecommunications and financial services. The breadth also forces attention on interdependencies. A failure at a technology provider can spill over into logistics chains, basic services, or state functions.

A critical reading cited by some sources says the new National Security System and its National Security Council, chaired by the President, would also cover critical infrastructure protection, although that institutional reach should be checked against the full legislative text. It is therefore wise to be cautious when interpreting the final architecture. Even with that caveat, the message is clear, cybersecurity is being folded into a national security logic, not just an information crime agenda. For strategic sectors, that can translate into higher expectations for coordination, operational continuity, and reporting of significant incidents.

Argentina: cybercrime program, digital evidence, and AI

Coverage of PRONACIB also showed a methodological dimension. The program is expected to produce diagnoses of cybercrime patterns, identify priority problems, and promote evidence-based criminal policy. That approach matters because it suggests authorities do not want to operate blindly or only under media pressure. They intend to generate structured information on crime patterns, attacker techniques, and institutional capability gaps. In the medium term, that could mean more frequent data requests, technical cooperation, and coordination with private actors that operate platforms, cloud services, payment gateways, or evidence infrastructure.

The explicit reference to artificial intelligence and emerging technologies also deserves attention. The resolution contemplates their use in crime prevention, detection, and investigation, under criteria of legality, transparency, traceability, auditability, non-discrimination, and personal data protection. That list is not decorative. In practice, it sets the minimum regulatory framework for AI to be not just an automation tool, but a system that can be audited and explained. For a CISO, this opens two fronts, first, checking that internal detection or scoring tools do not create bias or traceability problems, and second, preparing the company for a public investigation ecosystem that will also use algorithmic models.

Peru: data protection compliance timeline

In Peru, compliance analysis noted that under Regulation of Law 29733, mid-sized companies have a reference date of November 30, 2026, to complete the appointment of the Personal Data Officer. The relevant point is not only the date, but the regulatory pattern it reflects, gradual, segmented compliance based on organizational size and type. That means the regulator starts from the premise that market capabilities differ and uses staggered deadlines to organize compliance.

For organizations, this milestone requires reviewing whether the appointment of the officer was limited to a formal compliance step or actually translated into supervision, advisory, and follow-up functions. In many companies, the risk is naming someone without giving them independence, access to information, or resources. If the November 2026 deadline is treated as a formality, reputational and regulatory risk can remain. The operational value of the appointment depends on having real capacity to map processing activities, respond to internal questions, and escalate incidents with sound judgment.

Paraguay and Ecuador: critical infrastructure and legislative agenda

The Paraguayan press reported that the Critical Infrastructure Protection bill was approved with amendments in committee and was among the items the Senate was due to review on September 23, 2026. The coverage mentions the energy, water, telecommunications, health, transportation, finance, and technology services sectors. While the final status of the bill is not developed in depth in the available material, that sector list alone shows a broad view of criticality and reinforces the regional trend of treating technological dependence as part of the security problem.

In Ecuador, the National Assembly considered a nonbinding report on the partial objection to the Draft Organic Law to Strengthen Cybersecurity and approved the corresponding resolution motion. Operationally, this kind of parliamentary progress indicates that cybersecurity remains on the legislative radar and that public and private sectors should monitor the final content to anticipate requirements on coordination, infrastructure, and responsibilities. Regional experience shows that when cybersecurity enters the legislative cycle, reporting obligations and expectations for cross-sector coordination tend to grow.

Entre Ríos: state digital transformation and data governance

Entre Ríos delivered an important signal on administrative modernization with the first legislative approval of the Digital Transformation and Innovation Bill promoted by the provincial Executive Branch. The initiative includes provisions on procedures, case files, signatures, and digital domiciles, data governance, and emerging technologies. It also establishes principles of security, confidentiality, traceability, and personal data protection. That kind of law matters because it does not simply digitize paperwork. It tries to build a framework for public administration to operate with traceability and stronger controls.

According to the approved text, public databases are assets under state ownership, custody, and management, and it includes transparency, audit, human oversight, and bias prevention guidelines for artificial intelligence systems used by public agencies. In other words, state digitalization is paired with a governance theory, data are not an administrative residue but an asset that requires custody, and AI cannot operate without human oversight and controls to avoid bias. For private-sector companies that contract with the state, this can mean stronger requirements on platform integrity, interoperability, security, and documentation.

Local coverage also said the bill applies to all three provincial branches, autonomous and self-governing agencies, state-owned companies, and other public-sector entities, with municipalities and communes able to join. That suggests the scope is not limited to the provincial executive branch. If adoption expands, the digital standard could become a cross-cutting reference point for Entre Ríos public administration. For security teams, the challenge will be twofold, protecting their own systems and adapting to procurement and operating requirements that demand greater traceability and security by design.

Mexico: public consultation on clearinghouses

In Mexico, Banco de México held a prior public consultation for the issuance of Annex 5 of the draft rules applicable to the organization, operation, and functioning of clearinghouses for card payments, concerning the exchange of financial transaction messages. Although this is a consultation and not a final rule, its existence shows that payment infrastructure remains under meaningful technical scrutiny. For operators, that often means reviewing message architecture, interoperability standards, integrity controls, and resilience mechanisms.

The security relevance is significant. Clearinghouses and message exchanges are part of the backbone of electronic payments, and any change in how they operate can affect response times, validations, reconciliation, and fraud monitoring. Security and fraud teams should view this kind of consultation not as a regulatory formality, but as an early signal of adjustments that could affect design, logging, and the ability to investigate disputes or anomalies.