Brazil and Latin America

• Public and private controllers and processors handling personal data in the situations covered by the law
• ANPD is the national supervisory and sanctioning authority, subject to the law’s allocation of powers.

Biometric data linked to a natural person are **sensitive personal data**. Sensitive-data processing requires a legal basis under the LGPD’s specific regime. Controllers must observe purpose, necessity, transparency, security, prevention, non-discrimination and accountability principles. A data subject may request human review of a decision made solely by automated processing that affects their interests the controller must provide clear information on criteria and procedures, subject to trade-secret limits. The ANPD may audit for discriminatory aspects where information is withheld on trade-secret grounds.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• LGPD controllers/processors and their responsible officers
• the ANPD.

Resolution 15 establishes security-incident communication procedures. A controller must notify the ANPD and affected data subjects where an incident may cause relevant risk or harm, including situations involving sensitive, financial, authentication, children’s or large-scale data. The ANPD states that incident records must be retained for at least five years. Resolution 18 details the data-protection officer’s identity, contact disclosure, duties and conflicts. Resolution 19 regulates international transfers, adequacy and ANPD-approved standard contractual clauses its standard clauses include a three-business-day incident-communication clause.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Electoral propagandists, candidates, parties, application providers and providers offering AI systems in the context of 2026 election propaganda.

Retains explicit labelling requirements and adds a blackout around the election: publication, republication and paid boosting of **new** synthetic content made or altered by AI/equivalent technology using the image, voice or manifestation of a candidate or public person is prohibited from 72 hours before the election through 24 hours after it, even if labelled. Providers offering AI systems may not, at the user’s request, rank, recommend, suggest or prioritize candidates in the covered election context. The consolidated rule also includes provider controls concerning prohibited or noncompliant synthetic electoral content.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Internet connection and application providers, especially providers intermediating third-party content
• authorities and users.

The original framework includes privacy/security duties, six-month application-access-log retention for qualifying commercial application providers, and the general judicial-order model for intermediary civil liability, with a specific notice-and-takedown rule for unauthorized intimate sexual material. Decree 12.975 adds provider representation/channel duties, systemic-risk monitoring and management, and immediate availability/removal rules for specified categories of criminal or unlawful content, including paid ads and artificial distribution networks.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Criminal-law actors, internet application providers, platforms, victims and authorities
• content involving women and intimate material.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Technology products/services directed to or likely to be accessed by children and adolescents, including generative-content and conversational systems.

Providers must manage risks and protect children/adolescents. Systems capable of generating content and interacting through natural-language instructions must be transparent that the interaction is synthetic and automated. The decree treats automated sexual-content interaction/generation as within the pornographic-content control framework and requires protective measures.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Criminal law
• anyone committing electronic theft/fraud or related computer offences.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• National cybersecurity governance, government and critical services
• international cybercrime cooperation under the Convention.

PNCiber establishes national cybersecurity policy and committee, with goals including incident prevention, critical-infrastructure protection, cybercrime response and risk management. The Budapest Convention supplies criminalization, procedural and international-cooperation mechanisms for computer crimes.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Covered financial and other obliged entities
• BCB-supervised institutions
• COAF and sector regulators.

Identify and keep customer records current verify/validate customer identity collect minimum identity data qualify customers and identify beneficial owners monitor risk retain records report qualifying suspicious transactions to COAF within 24 hours without tipping off the customer. Circular 3.978 allows identity verification against public/private databases when necessary and requires robust beneficiary-owner procedures.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Financial institutions, other BCB-authorized institutions and payment institutions as allocated by each instrument.

Cybersecurity policy proportionate to size, risk profile, business model, operations and data sensitivity controls for confidentiality, integrity and availability incident response and governance requirements for outsourced processing, storage and cloud services.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Pix participants, payment institutions and other covered financial institutions.

Participants must protect Pix integrity and security, manage fraud risk, keep auditability, use secure communications and digital signatures, and reject or handle transactions where there is well-founded fraud suspicion or authentication problems. The Pix security manual requires TLS and mutual authentication Pix by approximation requires password or biometric authentication plus transaction confirmation.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Virtual-asset service providers, BCB, CVM where relevant, consumer and AML authorities.

Virtual-asset services must follow consumer protection, operational soundness and AML/CFT/proliferation-financing principles. Virtual-asset service providers were added to the AML-obliged-entity regime BCB is empowered to regulate, authorize and supervise them.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Public-service databases, federal identity governance, state identity issuers, CPF/CIN ecosystem and public-sector identity services.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Fixed-odds betting operators and bettors.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Private-sector controllers/processors under the federal private-sector data regime
• Secretaría Anticorrupción y Buen Gobierno.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Digital violence and sexual-intimacy protections
• victims, perpetrators, prosecutors/judges and platforms.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Federal public-administration digital services, Agencia de Transformación Digital y Telecomunicaciones and users of Llave MX.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Banks, electronic banking users and electronic-payment-fund institutions
• CNBV and Banco de México.

Authentication factors may include physical characteristics. Banking rules require authentication controls and protections for biometric-derived authentication information. Payment-fund institutions must authenticate clients, encrypt personal/sensitive information and biometric information, and obtain regulatory authorization for certain alternative authentication factors.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Mexican fintech institutions and financial authorities.

ITFs must maintain client-identification operational/control processes, fraud-prevention policies, AML/CFT controls, and customer-risk information the law is technology-neutral.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Public and private data controllers/processors and data subjects
• new Agencia de Protección de Datos Personales.

Establishes a modern personal-data regime and agency. Biometric data are expressly defined in article 16 ter as technical-processed physical, physiological or behavioural characteristics enabling or confirming unique identification, including fingerprint, iris, hand/facial features and voice. The responsible party must give specific notice of the biometric system, purpose, use period and rights channels sensitive-data rules and security/rights duties apply.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Payment issuers/emisores subject to Law 20.009 and CMF supervision.

Strong customer authentication (ARC) uses at least two independent factors from knowledge, possession and inherence. Biometric face, fingerprint, voice or behavioural data are examples of inherence. ARC is mandatory for specified electronic transfers, digital enrolment, personal-data changes, authentication-key changes and trusted-device changes. NCG 568 permits narrowly defined issuer-selected groups—such as older adults, people with disabilities or people lacking suitable devices—to continue using printed mechanisms, with risk information.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Public/private data controllers, data subjects and Agencia de Acceso a la Información Pública (AAIP).

Law 25.326 governs lawful personal-data collection/use, access, correction, deletion and confidentiality. Resolution 4/2019’s mandatory criteria define biometric data and state that identifying biometrics are sensitive when they can reveal additional information whose use could be potentially discriminatory, such as ethnicity or health. Its criteria also address video-surveillance access and automated treatment that produces significant adverse effects.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Financial entities opening accounts electronically
• BCRA-supervised banking and payment ecosystems.

Non-presential account-opening procedures must comply with AML/KYC, identity and customer-knowledge rules and preserve integrity, authenticity and confidentiality of the documents/information used. The consolidated text permits electronic/non-presential opening and allows public/private database comparison for identity verification, with rules for legal-person documentation and branch assignment.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Public/private data controllers and processors
• data subjects
• Superintendencia de Industria y Comercio (SIC).

Biometric data are expressly listed as sensitive. Sensitive-data processing is prohibited except for statutory exceptions, including explicit authorization. The controller must inform the person that sensitive-data authorization is not mandatory, state the sensitive data and purpose explicitly and obtain express authorization no activity may be conditioned on supplying sensitive data under SIC guidance.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Financial entities supervised by the Superintendencia Financiera de Colombia
• banking/service channels
• SARLAFT functions.

Biometric authentication may be used as a strong authentication factor. Identity should be checked against Registraduría, authorized digital-identity/citizen-service operators or the entity’s own database. Controls include liveness testing, direct capture from the data subject, separation of demographic data from biometric templates, cryptographic/tokenized linkage, secure handling and alternative procedures where a customer cannot use biometrics. SARLAFT requires effective customer identity verification in physical and non-physical onboarding.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Criminal law protecting information/data and information systems.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Criminal law, government policy actors, Fiscalía, Policía, Ministerio de Justicia and MinTIC.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Public and private data-bank holders and processors, including entities outside Peru that use means in Peru or analyse/profile people in Peru
• the Autoridad Nacional de Protección de Datos Personales in the Ministry of Justice.

The regulation expressly treats biometric and genetic data as sensitive data. It expands information duties concerning automated decisions and profiling, recognizes portability in applicable cases, and contemplates impact assessments for large-scale, sensitive or rights-affecting processing. A face/voice matcher, liveness system, KYC model or training corpus containing identifiable media therefore needs a documented purpose, legal basis, notice, security and retention analysis.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• SBS-supervised financial, insurance and pension entities
• UIF-Peru and covered obliged entities
• users of digital channels.

Resolution SBS 504-2021 requires digital-channel enrollment to verify identity and reduce impersonation risk using two independent authentication factors from different categories the regulation defines knowledge, possession and inherence/biometric factors. The SBS AML regulation, Resolution 2660-2015 and the UIF framework require risk-based customer identification, records, compliance systems and suspicious-transaction reporting. A current SBS identity-verification rule for electronic money also requires documentary/DNI or equivalent verification through RENIEC, Migraciones, Foreign Affairs or another documented method in the relevant product regime.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Public and private controllers/processors
• Unidad Reguladora y de Control de Datos Personales (URCDP)
• AGESIC for digital/AI governance.

“Datos biométricos” includes technical processing of physical, physiological or behavioural characteristics enabling unique identification, such as fingerprints, image recognition or voice recognition. The processing must fit the personal-data legal-basis regime and be preceded by the applicable impact assessment. Law 20.212 articles 74–75 assign AGESIC a national data/AI strategy based on equity, non-discrimination, responsibility, accountability, transparency, auditability, safe innovation and data protection. Decreto 276/025 creates minimum governance for controlled testing environments and data spaces involving data and AI.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• BCU-supervised financial entities, other obliged subjects, UIAF and the Secretaría Nacional para la Lucha contra el Lavado de Activos.

Law 19.574 requires customer and beneficial-owner identification, prohibits anonymous or fictitious-name accounts and requires suspicious/inusual transaction reporting. Decreto 379/018 treats non-face-to-face operations and new or developing technologies that favour anonymity as heightened-risk factors requiring intensified due diligence. The BCU’s UIAF receives and analyses suspicious-transaction information.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Political parties and presidential candidates submitting programs of government
• Tribunal Supremo de Elecciones and the electoral administration.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Tribunal Electoral, parties, candidates, media, voters and the Fiscalía Electoral under the Electoral Code and campaign/veda rules.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Public and private controllers/processors
• ANTAI’s Dirección de Protección de Datos Personales
• the Tribunal Electoral’s identity and civil-registry systems.

The regime is based on consent, purpose, security, confidentiality and data-subject rights. Official ANTAI materials define biometric data as technical processing of physical, physiological or behavioural characteristics enabling unique identification and treat it as sensitive. The implementing decree covers collection requirements, the data-protection officer and sanctions. ANTAI’s official FAQ describes access, rectification, cancellation, opposition and portability rights.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• CNBS-supervised financial institutions, electronic-wallet providers, authorized transaction centres and obliged entities under Honduras’s AML framework.

CNBS Circular 017/2024 requires a biometric authentication factor, such as fingerprint or facial recognition, for customer linkage and transactions through mobile applications where technically available. Where the device cannot support biometrics, the institution must use two-factor authentication and liveness testing for linkage. For electronic-wallet transactions, the rule requires DNI capture and real-time comparison with national facial/fingerprint records within the relevant implementation conditions. CNBS Resolution GRD 365/2023 requires a cyber-fraud mitigation strategy and preventive, detective and corrective controls, including monitoring transaction amount, device, browser, location and IP and confirming suspicious transactions.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Public/private data-file controllers and processors
• the Consejo Supremo Electoral (CSE)
• identity holders and electoral organizations.

Law 787 requires lawful, adequate, proportionate and necessary collection, consent unless an exception applies, notice and data-subject access/rectification/opposition/cancellation rights. Law 1.241 defines identification as biographic and biometric data that uniquely distinguish a person. It authorizes the CSE to collect biographic and biometric data and requires protection of data origin and avoidance of new-technology automated decisions that affect rights. Access is restricted to the holder, lawful authorities, CSE rules or judicial order.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

• Data controllers/processors established in Belize and relevant processing activities
• data subjects and the statutory data-protection authority framework.

The Act defines biometric data as technical processing of physical, physiological or behavioural characteristics that enable unique identification and lists biometrics as sensitive personal data. Sensitive-data processing is generally prohibited unless a statutory condition, including consent, applies. A data subject has a right not to be subject to a decision based solely on automated processing/profiling that produces legal or similarly significant effects, subject to the Act’s exceptions.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.