Countries · Overview
Your country next to
EU law
For each of the nine countries, we show where local law stands, how it differs from the GDPR and NIS2, and which agreement with the EU applies.
Country · Mercosur
Argentina
Ley 25.326, EU adequacy, no cybersecurity law and the EU-Mercosur Agreement: what EU customers expect from companies based in Argentina.
Country · Mercosur
Brazil
What EU customers ask of Brazilian companies: the LGPD next to the GDPR, adequacy since 2026, reporting deadlines and the EU-Mercosur Agreement.
Country · Mercosur
Paraguay
Ley 7593/2025 fully applies from late 2027 and there is no cyber law: what EU customers ask of companies in Paraguay today and how to be prepared.
Country · Mercosur
Uruguay
Ley 18.331, EU adequacy, 24-hour incident reporting for critical sectors and the EU-Mercosur Agreement: what EU customers expect from Uruguay.
Country · Mercosur
Bolivia
Bolivia has no data protection or cyber law and is not part of the EU-Mercosur Agreement. What EU customers still ask for and how you can prove it.
Country · Mercosur associate
Chile
New data protection law, a NIS2-style cyber law with a 3-hour early warning, EU trade deal since 2025: what EU customers expect from Chilean firms.
Country · Mercosur associate
Colombia
Ley 1581/2012, breach reports within 15 business days, no cyber law, EU trade deal since 2013: what EU customers expect from companies in Colombia.
Country · Mercosur associate
Peru
Ley 29733 with new regulations, 48-hour breach reporting, duties under DS 126-2025-PCM: what EU customers expect from companies based in Peru.
Country · Mercosur associate
Ecuador
LOPDP with a 5-day breach deadline, a new cybersecurity law since May 2026, EU trade deal since 2017: what EU customers expect from Ecuadorian firms.
The nine countries at a glance
| Country | Data protection law | Cybersecurity law | EU adequacy | Trade agreement with the EU |
|---|---|---|---|---|
| Argentina | Ley 25.326 (2000), reform in Congress | none | yes (2003) | EU-Mercosur, provisional since May 1, 2026 |
| Brazil | LGPD, Lei 13.709/2018 | none, bill PL 4.752/2025 | yes (since Jan 2026) | EU-Mercosur, provisional since May 1, 2026 |
| Paraguay | Ley 7593/2025, fully applicable from late Nov 2027 | none | no | EU-Mercosur, provisional since May 1, 2026 |
| Uruguay | Ley 18.331 (2008), Ley 19.670 | Ley 20.212 Art. 78 ff., Decreto 66/025 | yes (2012) | EU-Mercosur, provisional since May 1, 2026 |
| Bolivia | none | none | no | none; tariff preferences under GSP+ |
| Chile | Ley 21.719, in force from Dec 1, 2026 (postponement requested) | Ley 21.663 (2024) | no | Interim Trade Agreement since Feb 1, 2025 |
| Colombia | Ley 1581 de 2012 | none, Decreto 338/2022 | no | Trade Agreement since 2013 |
| Peru | Ley 29733, DS 016-2024-JUS | framework under DU 007-2020 and DS 126-2025-PCM | no | Trade Agreement since 2013 |
| Ecuador | LOPDP (2021) | Ley Orgánica para el Fortalecimiento de la Ciberseguridad (2026) | no | Trade Agreement since 2017 |
What adequacy changes for you
For Argentina, Uruguay and, since January 2026, Brazil, the EU has found that data protection is equivalent. Your EU customers can transfer data there without signing standard contractual clauses. For the other six countries, they need those clauses plus a transfer impact assessment. You need a data processing agreement under the GDPR in all nine countries.
Cybersecurity: few laws, many contracts
Chile comes closest to NIS2, with an early warning due after just three hours. Uruguay requires critical sectors to report within 24 hours. Ecuador has had its own law since May 2026, and Peru regulates reporting for digital services by decree. In the remaining countries, the main rules come from banking supervisors.
For suppliers, local law is only part of the picture anyway. EU customers pass their obligations under NIS2, DORA and the Cyber Resilience Act down to you by contract, whatever country you are based in. A GRC platform such as Sightadel lets you keep the policies and evidence for these clauses in one place and reuse them for each customer.
Agreements and the supply chain
The EU-Mercosur agreement has applied provisionally with Argentina, Brazil, Paraguay and Uruguay since May 1, 2026. Bolivia is a Mercosur member but not a party. Chile, Colombia, Peru and Ecuador have their own agreements. None of them exempts you from the EUDR or CBAM.
The free EU readiness check shows where your company stands.
FAQ
Which countries have an EU adequacy decision?
Does the EU-Mercosur agreement apply to Bolivia?
Which country has the strictest reporting deadlines for cyber incidents?
Which tools help with evidence for EU customers?
- European Commission: Adequacy decisions
- European Commission, DG Trade: Mercosur
- European Commission, DG Trade: Chile
- European Commission, DG Trade: Andean Community
General information, not legal advice. The official texts are authoritative.
Trade · Agreements
EU-Mercosur Agreement
The EU-Mercosur Agreement has applied provisionally since May 1, 2026. What it offers exporters, what it leaves unchanged, and the Andean countries.
EU rule · Data protection
GDPR
When the GDPR applies to South American firms, what adequacy means for Argentina, Brazil and Uruguay, and which contracts EU customers ask for.
Free check
EU Readiness Check
See in 10 minutes which EU rules apply to your company and where the gaps are. Free, with a detailed PDF report sent to you by email.
