On September 9, 2026, Decree No. 662/2025 of the Ministry of Finance was published, approving the Regulation on Infringement Prevention Models pursuant to Article 49, as incorporated into Law No. 19,628 on the Protection of Private Life by Law No. 21,719 (the “Regulation”).

The Regulation establishes a prevention framework for controllers aimed at ensuring compliance with applicable data protection requirements and protecting data subjects’ rights. It also sets forth the requirements and procedures for the implementation, certification, registration and supervision of such models, and serves as a practical guide for regulatory compliance.

The adoption of a certified infringement prevention model constitutes, pursuant to Article 35(5) of Law No. 21,719, a mitigating circumstance in relation to sanctions that may be imposed by the Personal Data Protection Agency (the “Agency”).

The Regulation consists of 20 articles organized into three Titles and primarily addresses the following matters:

• Compliance Program: The Regulation establishes the minimum elements of a compliance program, including: identification of the controller and its legal representative; appointment of a Data Protection Officer (“DPO”) with defined resources and powers; records of the categories of personal data processed and the processing operations carried out; a risk matrix identifying activities that may give rise to infringements; internal policies and procedures for prevention, reporting, complaints and sanctions; and any other measures necessary to ensure compliance with applicable data protection requirements.
• Data Protection Officer: The Regulation establishes the role of the DPO, whose appointment is mandatory where a compliance program is adopted. The DPO’s main responsibilities include advising the controller, monitoring compliance with applicable data protection requirements, managing the compliance program, cooperating with the data protection authority, and handling data subjects’ enquiries. The DPO may be an employee of the controller or provide services on an external basis and must perform their duties independently of the controller’s management. In the case of micro, small and medium-sized enterprises, these functions may be performed directly by the owner or by the persons holding the highest management positions.
• Certification: The Agency will be responsible for certifying infringement prevention models that meet the requirements established under Law No. 19,628 and the Regulation. The certification procedure will be initiated upon application by the interested party and will be subject to the rules set forth in Law No. 19,880 governing administrative procedures. Certificates will be valid for three years and may be renewed. Once certification has been granted, the model will be entered in the National Registry of Sanctions and Compliance, which will provide public access to the certificates issued.
• Supervision: The Agency may supervise certified models and request any information necessary to verify compliance. Failure to provide such information, or the provision of false, incomplete or manifestly erroneous information, will be subject to sanctions in accordance with the law.
• Expiry and Revocation: Certification will cease to be effective upon revocation by the Agency, the death of the controller, dissolution of the legal entity, a final and enforceable court judgment, or voluntary cessation of activities. The Agency may initiate revocation proceedings of its own motion or at the request of an interested party where the controller fails to comply with any of the requirements established by law or the Regulation or if is sanctioned for any of the infringements set forth in Articles 34 bis, 34 ter or 34 quáter of Law No. 19,628. Once the circumstances giving rise to the revocation have been remedied, a new certification may be requested.
• Internal Policies and Dissemination: The obligations established under the compliance program must be incorporated into employment and service agreements, including those applicable to senior executives. The controller must also inform its employees and service providers of the existence of the compliance program.

Next steps: The Regulation will enter into force with the amendments introduced by Law No. 21,719 to Law No. 19,628, which are currently scheduled to enter into force on December 1, 2026. However, it should be noted that, on September 1, the Government submitted to the Senate a bill proposing to postpone the entry into force of such amendments until December 1, 2027.