Regulationsby GlyphCanada and Latin America data protection laws
Canada, Quebec, Brazil, Chile, Mexico and more.
5 countries and blocs with tracked laws (US states on the US map). Tap one to open it.
Regulations
Add to calendar
Peru PDPL and 2024 RegulationPeru's 2011 data protection law now runs under a new regulation that replaced the 2013 rules. The regulation adds 48-hour breach notification to the authority, data protection officers phased in by company size, data portability, stronger rules for processors and cross-border transfers, and detailed sanctions procedures.Next: Nov 30 DPO required: medium companies · in 34 daysChile Personal Data Protection Law (Ley 21.719)Replaces Chile's 1999 data law with a GDPR-style regime: legal bases, data subject rights (including portability and objection to automated decisions), security and breach notification, international transfer rules, a voluntary compliance (crime-prevention-style) model, and a new independent Personal Data Protection Agency.Next: Dec 1 Law in force · in 35 daysPeru AI Law and RegulationPeru's AI law and its 2025 regulation set a risk-based framework with prohibited uses and high-risk uses (for example in credit, employment, health and education access). Developers and deployers of high-risk systems must run impact assessments, keep human oversight and give transparency. Obligations phase in by sector and company size over one to four years.Next: Sep 10, 2027 Private sector: transport, commerce, labour · in 10 monthsAlberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025Argentina Law 25.326Argentina's habeas data and personal data protection law. It covers consent, data quality, sensitive data, security and confidentiality, international transfers to countries with adequate protection, and access, rectification and deletion rights. Argentina holds EU adequacy status based on this law.No date set
Brazil AI Bill (PL 2338/2023)Risk-based AI framework inspired by the EU AI Act: prohibited (excessive-risk) uses, high-risk system obligations, algorithmic impact assessments, rights for affected persons and copyright remuneration provisions, coordinated by a national AI regulation system (SIA) led by the ANPD.No date setBrazil ECA DigitalRequires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.In effect since Mar 17, 2026Brazil LGPDBrazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.In effect since Sep 18, 2020
Canada Bill C-36 (PPCDA)Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.No date setCanada Bill C-8 / CCSPARequires designated operators in federally regulated critical sectors to establish cyber security programs, mitigate supply-chain risks, report cyber incidents and comply with government cyber security directions; also amends the Telecommunications Act to let government order telecom providers to secure their networks.No date setMexico LFPDPPP 2025New federal private-sector data protection law replacing the 2010 law after the dissolution of INAI; keeps the ARCO rights and privacy-notice model, broadens the personal data definition and moves enforcement to the Secretaría Anticorrupción y Buen Gobierno.In effect since Mar 21, 2025Ontario Bill 194Enacts the Enhancing Digital Security and Trust Act, 2024, which lets Ontario set cyber security program, incident reporting and AI governance rules for public sector entities, and rules on digital information about minors held by school boards and children's aid societies. It also amends FIPPA to require privacy impact assessments, reasonable safeguards and breach notification to the IPC and affected people where there is a real risk of significant harm.In effect since Jan 29, 2025PIPEDACanada's federal private-sector privacy law based on 10 fair information principles, with mandatory breach reporting to the OPC and notification of individuals for breaches creating a real risk of significant harm. It is proposed to be replaced by the Protecting Privacy and Consumer Data Act (Bill C-36, tabled June 2026).In effect since Jan 1, 2001
Quebec Law 25Overhauls Quebec's private-sector privacy law with GDPR-style duties: a designated person in charge of privacy, confidentiality incident reporting, privacy impact assessments (including before transfers outside Quebec), privacy by default, automated decision transparency, and data portability.In effect since Sep 22, 2022Uruguay Law 18.331Uruguay's data protection law, which treats data protection as a human right and covers consent, purpose limits, security, sensitive data, data subject rights and international transfers. Law 19.670 of 2018 added accountability duties, regulated by Decree 64/020. Uruguay holds EU adequacy status.In effect since Aug 18, 2008
Upcoming deadlines
Peru PDPL and 2024 RegulationDPO required: medium companiesCompanies with annual sales above 1,700 UIT up to 2,300 UIT.PeruChile Personal Data Protection Law (Ley 21.719)Law in forceMain obligations apply and the Personal Data Protection Agency begins supervision.ChilePeru AI Law and RegulationPrivate sector: transport, commerce, labourObligations apply two years after publication.PeruPeru PDPL and 2024 RegulationDPO required: small companiesCompanies with annual sales above 150 UIT up to 1,700 UIT.PeruChile Personal Data Protection Law (Ley 21.719)Proposed postponement of entry into forceGovernment bill Boletin 18623-07 (filed 1 Sep 2026, 'suma' urgency) would replace the 24-month vacatio legis in transitional Art 1 with a fixed date of 1 Dec 2027; in first committee stage in the Senate, not law.ChilePeru AI Law and RegulationPrivate sector: production, agriculture, energy, miningObligations apply three years after publication.PeruPeru PDPL and 2024 RegulationDPO required: micro companiesMicro companies with annual sales up to 150 UIT.PeruPeru AI Law and RegulationPrivate sector: all other usesObligations apply four years after publication.Peru
Past deadlines
Peru AI Law and RegulationPrivate sector: health, education, justice, security, financeHigh-risk and related obligations apply one year after publication for these sectors.PeruCanada Bill C-8 / CCSPARoyal AssentBill C-8 receives Royal Assent (S.C. 2026, c. 9); Telecommunications Act amendments take effect.CanadaCanada Bill C-36 (PPCDA)Bill C-36 tabled (first reading)Government introduces the PPCDA in the House of Commons.CanadaAlberta POPAPrivacy management programs requiredPublic bodies must establish and implement a privacy management program one year after the section comes into force (s. 25(5)).Alberta, CanadaBrazil ECA DigitalECA Digital in forceArt. 41-A (as set by Law 15.352/2026, following MP 1.319/2025) fixes entry into force on 17 March 2026.BrazilPeru AI Law and RegulationRegulation in forceRegulation enters into force 90 business days after publication. Date computed with national holidays, so tentative.PeruPeru PDPL and 2024 RegulationDPO required: large companiesCompanies with annual sales above 2,300 UIT must appoint a data protection officer where Art. 37.1(2)-(3) applies.PeruPeru PDPL and 2024 RegulationData portability appliesArticle 76 on portability takes effect six months after the regulation enters into force.PeruPeru AI Law and RegulationRegulation publishedDS 115-2025-PCM approving the AI regulation published in El Peruano.PeruBrazil LGPDDeadline to adopt ANPD standard contractual clausesAgents relying on contractual clauses for international transfers must incorporate the ANPD-approved SCCs into their contracts within 12 months of publication.BrazilOntario Bill 194FIPPA privacy amendments in forceRemaining FIPPA amendments, including privacy impact assessments, safeguards and breach notification to the IPC, come into force.Ontario, CanadaCanada Bill C-8 / CCSPABill C-8 introducedFirst reading in the House of Commons.CanadaAlberta POPAPOPA in forceAct comes into force with the Access to Information Act, proclaimed in force June 11, 2025.Alberta, CanadaPeru PDPL and 2024 RegulationNew regulation in forceRegulation enters into force 120 calendar days after publication.PeruMexico LFPDPPP 2025New LFPDPPP in forceLaw published 20 March 2025 enters into force the following day, repealing the 2010 law.MexicoOntario Bill 194Enhancing Digital Security and Trust Act in forceSchedule 1 (cyber security, AI and minors' data framework) and some FIPPA amendments come into force by OIC 361/2025.Ontario, CanadaChile Personal Data Protection Law (Ley 21.719)Published in Diario OficialLaw 21.719 published; 24-month vacatio legis begins.ChileBrazil AI Bill (PL 2338/2023)Approved by the Federal SenateSenate approves the consolidated text and sends it to the Chamber of Deputies.BrazilPeru PDPL and 2024 RegulationNew regulation publishedDS 016-2024-JUS published in El Peruano.PeruOntario Bill 194Royal AssentBill 194 receives Royal Assent as S.O. 2024, c. 24.Ontario, CanadaQuebec Law 25Phase 3: data portabilityRight to data portability in a structured, commonly used technological format applies.Quebec, CanadaBrazil LGPDInternational transfer regulation publishedResolution CD/ANPD 19/2024 on international transfers and standard contractual clauses published and in force.BrazilQuebec Law 25Phase 2: main obligations and penaltiesGovernance policies, PIAs, consent, transparency, privacy by default, ADM notices, cross-border PIAs and AMP/penal regime apply.Quebec, CanadaPeru AI Law and RegulationLaw 31814 publishedAI promotion law published.PeruQuebec Law 25Phase 1: privacy officer and incident reportingPerson in charge of personal information protection, confidentiality incident notification and register apply.Quebec, CanadaQuebec Law 25AssentBill 64 assented to as S.Q. 2021, c. 25.Quebec, CanadaBrazil LGPDANPD sanctions enforceableAdministrative sanctions (Arts. 52-54) become applicable per Law 14.010/2020.BrazilBrazil LGPDLGPD in forceMain LGPD provisions take effect.BrazilUruguay Law 18.331Decree 64/020Decree 64/020 regulates the Law 19.670 amendments.UruguayPIPEDAMandatory breach reportingBreach of security safeguards reporting, notification and record-keeping obligations take effect.CanadaUruguay Law 18.331Law 19.670 amendmentsLaw 19.670 rewrites parts of the law, including proactive accountability duties.UruguayUruguay Law 18.331Law publishedPublished in Diario Oficial.UruguayUruguay Law 18.331Law promulgatedLaw 18.331 promulgated.UruguayPIPEDAPIPEDA applies to all commercial activityExtended to commercial activity in provinces without substantially similar legislation.CanadaPIPEDAPIPEDA Part 1 in force (phase 1)Applies to federally regulated organisations.CanadaArgentina Law 25.326Published in Boletín OficialPublished in Boletín Oficial No. 29517.ArgentinaArgentina Law 25.326Law sanctionedCongress sanctions Law 25.326.Argentina