Latin American Data‑Protection Regulators Issue New Rules on International Transfers and Debt‑Collection Practices

Uruguay's data‑protection authority released Resolution Nº 8/026, updating the legal framework for international transfers of personal data. The resolution clarifies obligations for entities that transmit data abroad, such as cloud‑service providers, and references the existing decree and law governing personal data protection. The private law firm Posadas announced a webinar on 28 July to explain the new requirements and possible penalties for non‑compliance.

Costa Rica's Data Protection Agency (Prodhab) issued a new directive, PRODHAB‑DIR‑DN‑001‑2026, to regulate the use of personal data in debt‑collection processes. The rule, prompted by 77 complaints of third‑party contact since 2021, mandates that debt collectors may only request data of the debtor and must obtain informed consent to involve any third party. It also bans sending collection notices to unrelated individuals, restricts the use of work‑contact details without a court order, and requires clear identification of the data controller in all communications.