GDPR: personal data from the EU in South America

In brief

The GDPR governs how personal data may be processed: names, email addresses, customer numbers, location data, health data and anything else that can be linked to a person. It has applied directly in all member states since May 25, 2018.

For companies outside the EU, there are two ways the GDPR can apply. The first is the targeting principle in Article 3(2): if you offer goods or services to people in the EU or monitor their behavior, for example through tracking on a website, you are directly subject to the GDPR. The second is more common. An EU company hires you to process data on its behalf, and it may only do so if there is a contract under Article 28 and the transfer to your country is permitted under Chapter V (Art. 44 to 50).

Chapter V offers several legal bases. The simplest is a Commission adequacy decision under Article 45: your country is then considered safe, and data flows as it would within the EU. Without one, the EU customer needs appropriate safeguards under Article 46, in practice almost always the Commission's standard contractual clauses (Implementing Decision (EU) 2021/914).

Supervisory authorities can impose fines of up to 20 million euros or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)). Enforcement is harder against companies outside the EU, but not against your EU customer. That is why your customer checks carefully whom it entrusts with data and has liability and audit rights written into the contract. A data breach at a service provider in Lima falls back legally on the client in Madrid.

Who it affects in South America

Online stores, SaaS providers, tour operators, language schools and app developers that specifically target customers in the EU are directly affected. A hotel in Cusco with a German-language booking page and prices in euros is one of them. Under Article 27, these companies must designate a representative in the EU. The only exception is occasional processing that does not involve large-scale sensitive data (Art. 27(2)).

All processors are indirectly affected: call centers in Bogotá working for a Spanish telecom operator, IT support from Córdoba, payroll, software development with real customer data, data analytics, cloud hosting.

The decision for Brazil is mutual: Brazil's data protection authority, ANPD, has in turn recognized the EU as adequate. It covers both the public and the private sector. For a software company in Florianópolis, since the decision of January 26, 2026, transfers from the EU no longer need standard contractual clauses or a transfer impact assessment. That removes much of the paperwork it used to have with every EU customer.

Deadlines

The GDPR has applied unchanged since 2018. New dates mainly concern the region: the adequacy decision for Brazil of January 26, 2026, and new national laws, for example in Chile and Paraguay, that are not yet fully applicable.

In November 2025, the Commission proposed a “Digital Omnibus” that would also amend parts of the GDPR. Until the proposal is adopted, the GDPR applies in its familiar form. Plan on the basis of the law as it stands.

There are still deadlines in day-to-day work. The EU controller has to report a data breach to the supervisory authority within 72 hours (Art. 33). As a processor, you must inform the controller “without undue delay”, and many contracts set 24 or 48 hours for this.

What EU customers actually ask for

• A data processing agreement (DPA) under Article 28, usually on the customer's template.
• For countries without adequacy, the standard contractual clauses, usually Module 2 (controller to processor) or Module 3 (processor to sub-processor).
• A transfer impact assessment that evaluates whether authorities in your country can access the data.
• A description of your technical and organizational measures (TOMs) under Article 32.
• A list of your sub-processors, such as cloud providers and ticketing systems.
• A record of processing activities for the customer's data.
• As evidence of the TOMs, often an ISO/IEC 27001 certificate, sometimes supplemented by ISO/IEC 27701 for privacy.

If you target customers in the EU directly, you also need a GDPR-compliant privacy notice, a legal basis for every processing activity, a process for access and deletion requests and, where required, the EU representative under Article 27.

First steps

1. Establish whether you target people in the EU directly or only process data for EU companies. That determines whether you need an EU representative.
2. List which personal data you receive from EU customers, where it is stored and who has access.
3. Check the law in your own country. Brazil's LGPD and the laws in Argentina and Uruguay are similar to the GDPR; in other countries, quite a lot is missing. The country pages have the details.
4. Prepare a TOM description that you can hand to any customer.
5. Set up a data breach procedure, with notice to the customer within the contractual deadline.
6. Take the free EU Readiness Check to see where the gaps are.

A GRC platform such as Sightadel helps you keep records, TOMs and contracts up to date for many customers.

How it relates to certifications

The GDPR has its own certification mechanisms under Article 42, but they are rarely used in practice. EU customers therefore rely on ISO/IEC 27001 as evidence of security of processing under Article 32. SaaS providers with US customers often have a SOC 2 report, which many EU customers also accept. If you work with AI and personal data, take a look at the AI Act. For IT service providers to banks, DORA comes on top, and for many others NIS2.

A certificate does not replace a case-by-case review. It does show that access rights, encryption, logging and incident handling are in place and are regularly checked by outsiders. Those are exactly the points the customer asks about in its TOM review. With the certificate, you answer with a reference instead of twenty pages of explanation.

FAQ