Operating in LatAm: One Company, Three Data Protection Regimes

Date & Time

Tuesday, 15 September 2026 | 16:00 BST

Details

This is a Client and Member Event

Brazil, Chile and Colombia compared — the second session in AGA’s Operating in LatAm series

A company operating across Latin America is rarely dealing with one set of rules on personal data. Brazil, Colombia and Chile each regulate it differently, and a business with customers, suppliers or staff in all three is running three sets of obligations at once — often without realising how far apart they sit.

Chile's framework is in fact the oldest of the three, dating from 1999, but it has operated without a dedicated regulator — that changes on 1 December, when a new authority begins work with meaningful penalties for the first time. Colombia's laws came later, in 2008 and 2012, and have been actively enforced by a supervisory authority ever since. Brazil's LGPD arrived in 2020 and has built up a body of practice and guidance since. Three markets, three quite different stages of development, and a moving target for anyone trying to run a single policy across them.

The obligations also reach well beyond the region. Chile’s new law applies to any organisation processing the data of people in Chile, wherever that organisation is based, and Brazil’s works in a similar way. For a company in Peru, the United States or Europe with customers or operations in Latin America, that means exposure without necessarily having an entity on the ground.

For anyone operating across several markets, the practical question is the same: can one approach satisfy all of them, or does each market have to be built separately?

You’ll hear directly from:

·       Bernardo Santos, Madrona Advogados (Brazil) — on the compliance challenges that emerged when the LGPD took effect, and where regulatory and enforcement practice is heading

·       Yoab Bitran, Albagli Zaliasnik (Chile) — on what changes in Chile this year, who it reaches beyond Chilean borders, and what companies should have in place

·       Maria Fernanda Gonzalez, Peña Mancero Abogados (Colombia) — on an established regime, and what it means for data moving between the three markets

·       Jorge Gavilán, General Counsel and Chief Compliance Officer, Sodexo Latin America — moderating, and bringing the in-house view of managing several regimes at once

The session closes with one practical step from each speaker for companies operating across the region.

Call to Action

We encourage members to invite clients to this event - via email and social media. Please also share with your colleagues so they can do the same.

To assist you, please navigate to the "Assets-Online Events" folder in our AGAOne business development toolkit. Inside, you will find a folder labelled "Operating in LatAm: One Company, Three Data Protection Regimes".

From here you can download:

• Example text (including registration link) to help invite clients to the event via email and social channels
• Graphics to add alongside your promotion
• An alternative set of graphics with QR code if needed to aid ease of registration.

PLEASE NOTE: You will need your AGAOne password to access these.

An individual version of the graphic with QR code can also be saved from here.

AGA is committed to supporting its members and their clients through periods of change and uncertainty. This event is part of a broader effort to provide valuable resources and foster a community of informed, proactive professionals.

Register

Register HERE