Regulators by country
Data protection regulators in Latin America
Short answer
- Brazil, maximum simple fine
- 2% of revenue in Brazil, capped at R$50,000,000 per infraction 1
- Brazil, breach notice
- To the ANPD and data subjects in a reasonable time set by the ANPD 1
- Colombia, maximum fine
- Up to 2,000 monthly legal minimum wages 6
- Chile, Ley 21.719 in force
- 1 December 2026 3
- Argentina, register of final sanctions
- Current to 3 July 2026 5
Brazil: ANPD and the LGPD
Brazil's General Data Protection Law, Lei 13.709 of 2018, is enforced by the national authority, the ANPD 1. Article 48 requires a controller to tell the authority and the data subject about a security incident that may cause relevant risk or damage. The notice must be given in a reasonable time, as defined by the authority 1.
Article 52 lists the sanctions. They start with a warning that sets a deadline for corrective measures. They go on to a simple fine of up to 2% of a private company's revenue in Brazil, limited to R$50,000,000 per infraction, a daily fine within the same cap, publication of the infraction, blocking of the data and deletion of the data 1.
The ANPD sets how fines are calculated by regulation. The ANPD says its current regulation on calculating sanctions dates from 2023. On 15 October 2026 the ANPD opened a public consultation on a revised version, with contributions due by 30 November and a public hearing on 29 October. The draft would cover new powers under the ECA Digital and the Marco Civil da Internet decrees 2. This is a proposal, not a rule in force 2.
Chile: a new agency from December 2026
Chile's Ley 21.719 creates the Agencia de Protección de Datos Personales. Decree 662 of the Ministry of Finance, published in the Diario Oficial on 9 September 2026, states that the law enters into force on 1 December 2026 3.
The decree sets rules for compliance programmes. The Agencia will certify infraction prevention models, certificates last three years, and certified entities are listed in a Registro Nacional de Sanciones y Cumplimiento 3.
Argentina: AAIP
The Agencia de Acceso a la Información Pública oversees personal data protection under Ley 25.326. It runs the Registro Nacional de Bases de Datos and the Registro Nacional No Llame under Ley 26.951. It is running a participatory process to update Ley 25.326 4. Voluntary fines can be paid through the national collection system 4.
The AAIP publishes a Registro de Infractores. It lists sanctions that are final under both laws. The page was first published on 6 March 2025, and the linked list is current to 3 July 2026 5.
Colombia: Superintendencia de Industria y Comercio
Colombia's Ley 1581 of 2012 names the Superintendencia de Industria y Comercio as the data protection authority, acting through a Delegatura para la Protección de Datos Personales 6.
Article 23 allows fines of up to the equivalent of 2,000 monthly legal minimum wages, which can be repeated for as long as a breach continues. It allows suspension of processing for up to six months, temporary closure, and immediate and permanent closure of operations with sensitive data. These sanctions apply to private persons. Cases about public authorities go to the Procuraduría General de la Nación 6.
Article 17 requires controllers to inform the authority when security codes are breached and there are risks to data subjects' information 6.
Side by side
| Country | Regulator | Top money sanction in law | Breach rule |
|---|---|---|---|
| Brazil 1 | ANPD 1 | 2% of revenue, up to R$50 million per infraction 1 | Reasonable time set by the ANPD 1 |
| Colombia 6 | Superintendencia de Industria y Comercio 6 | 2,000 monthly legal minimum wages 6 | Inform the authority of security breaches 6 |
| Chile 3 | Agencia de Protección de Datos Personales 3 | Not covered in Decree 662, law in force 1 December 2026 3 | Not covered in Decree 662 3 |
| Argentina 4 | AAIP 4 | Fines, payable through the national collection system 4 | Not covered on the AAIP page 4 |
Common questions
What is the maximum LGPD fine in Brazil?
A simple fine of up to 2% of a private company's revenue in Brazil, limited to R$50,000,000 per infraction 1.
When does Chile's new data protection law take effect?
On 1 December 2026, according to Decree 662 published in the Diario Oficial on 9 September 2026 3.
Who enforces data protection in Colombia?
The Superintendencia de Industria y Comercio, through its Delegatura para la Protección de Datos Personales 6.
Where can I see sanctions issued in Argentina?
The AAIP's Registro de Infractores lists final sanctions under Ley 25.326 and Ley 26.951 5.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.
Sources
- Presidência da República: Lei nº 13.709, de 14 de agosto de 2018, Lei Geral de Proteção de Dados Pessoais
- ANPD: ANPD abre consulta pública e inicia inscrições para audiência sobre Regulamento de Dosimetria e Aplicação de Sanções (15 October 2026)
- Diario Oficial de la República de Chile: Decreto Núm. 662, Ministerio de Hacienda (9 September 2026)
- Argentina.gob.ar, AAIP: Protección de datos personales
- Argentina.gob.ar: ¿Quiénes no cumplen con la Ley de Protección de Datos Personales y el Registro No Llame? (6 March 2025, updated 6 July 2026)
- Secretaría del Senado de Colombia: Ley 1581 de 2012
Related
- Breach notification rules compared
Breach notice deadlines and triggers in the EU, UK, US, Canada, Australia, Singapore, India and Brazil, from laws and regulator pages.
- Data protection regulators in Africa
Enforcement notices, infringement notices, penalty notices and annual figures from South Africa's Information Regulator, Kenya's ODPC and Nigeria's NDPC.
- Data protection regulators in Asia-Pacific
Breach figures, penalties and powers of privacy regulators in Australia, New Zealand, India, South Korea and Japan, from official releases.
- EU data protection authorities compared
Complaints, fines, breach notices, staff growth and handling times at EU data protection authorities, from the Commission and national annual reports.