Across the region, from jurisdictions operationalising their first privacy laws to those expanding existing provisions, developments in privacy and data protection continue at pace. Here’s a snapshot for companies doing business in this evolving regulatory environment to maintain awareness and ensure their compliance obligations are current.
Caribbean
Barbados enacts Passenger Data Act, St. Lucia developing digital sandbox
Barbados has enacted the Advance Passenger Information and Passenger Name Record Act for the processing of passenger data of commercial and private vessels arriving in, departing from or transiting through the country.
St. Lucia is developing a cross-sector regulatory sandbox for digital identity and financial technology, where innovative products, services and business models can be tested with oversight. The focus is on managing digital identity and payment options, including potential integration with the DigiGov platform.
Latin America
Personal data moving easier between Brazil and EU, Chile’s privacy law on hold
Brazil and the European Commission have signed a mutual adequacy agreement for personal data to flow more freely between the South American nation and the European Economic Area. This is Brazil’s first ever such agreement, and the most comprehensive the European Commission has signed under the GDPR.
In Chile, the government has introduced a bill to postpone enactment of the country’s privacy law 21.719, initially scheduled to take effect December 1, 2026. Closely modelled off the GDPR, the law also covers foreign companies offering goods or services to people in Chile, or monitoring their behaviour.
In Peru, mid-sized companies processing large amounts of sensitive data will have until November 2026 to comply with a requirement to appoint a data protection officer. The This aspect of the law has been applied in phases with the deadline for small and micro business set for November 2027 and November 2028 respectively.
In September, Mexico’s Anti-Corruption and Good Governance Secretariat was alerted to a leak of Aeromexico passenger data, including names, contact information and passport numbers. The breach has been connected to a 2025 unauthorised access incident, compromising the data of more than 15 million Aeromexico customers.
North America
Canada overhauls privacy laws, 3 US states give consumers more rights
Canada has tabled a bill intended to overhaul the country’s current privacy legislation. The proposed Protecting Privacy and Consumer Data Act (PPCDA) would be administered by a new Digital Safety and Data Protection Commission of Canada empowered to impose penalties. The bill mandates privacy programmes for organisations as well as impact assessments ahead of cross-border transfers.
At the same time, Canada has issued new guidelines on assessing the privacy practices of third-party providers. The guidance states: “Organizations should assess a third party’s privacy practices before using, or entering into an agreement to obtain, a prospective provider’s services.
“They should also ensure that the individual(s) responsible for carrying out the assessment have the appropriate training and expertise to do so effectively. In some cases, it may be necessary to secure external expertise (for example, external legal counsel or technical expertise) to address gaps in knowledge or experience.” The guidelines are open for public comment until December 4, 2026.
Delaware has expanded its privacy law, with changes slated to take effect January 2027. Among the main changes: more businesses are covered, as the required customer count has been lowered to 5,000; and “sensitive data” includes more categories such as pregnancy or immigration status and brain data.
Businesses in Connecticut must now explicitly inform consumers when they are using facial recognition technology, and give them rights covering collection, retention and destruction of genetic data. The changes are part of several in force since October 1, 2026, under amendments to the Connecticut Data Privacy Act.
Violations of a new California law governing children’s access to online services could cost businesses up to $15,000 in civil penalties per affected child. Bill AB 2246 is slated to take effect January 1, 2027, and is expected to replace the fraught California Age-Appropriate Design Code Act. Among the key provisions: default settings on online services likely to be accessed by children must offer a high level of privacy, and businesses must estimate users’ ages with reasonable certainty. In addition, businesses are prohibited from profiling a child, or collecting, selling or sharing the precise geolocation of a child, with a few exceptions.