Personal data protection and privacy

Assessment

Gaps against applicable regulation

We inventory databases, data flows and processors, and measure compliance against the laws of each country where you process personal data.

• Inventory of databases and data flows
• Colombia’s National Database Registry (RNBD)
• International transfers and transmissions
• Prioritized gap-closure plan

Program

Comprehensive data protection program

We design or strengthen the program that demonstrates your accountability to regulators and data subjects.

• Policies, notices and authorizations
• Procedures for inquiries, complaints and data subject rights
• Processor and vendor management
• Data protection officer as a service

ISO/IEC 27701

Privacy information management system (PIMS)

We implement the ISO/IEC 27701 privacy information management system, standalone or integrated with your ISO/IEC 27001 ISMS.

• Gap assessment against ISO/IEC 27701:2025
• Controls for controllers and processors
• Internal audit and certification readiness

Risk

Privacy by design and data breaches

We assess the impact of new projects and prepare the response when personal data is compromised.

• Privacy impact assessments (DPIA)
• Privacy by design and by default
• Forensic investigation of personal data breaches
• Technical support for notifying regulators and individuals

• COColombia

  • Ley 1581 de 2012
  • Decreto 1377 de 2013, compilado en el Decreto 1074 de 2015
  • Ley 1266 de 2008 (hábeas data financiero)

  AuthoritySuperintendencia de Industria y Comercio (SIC)

• BRBrazil

  • Lei 13.709/2018 (LGPD)

  AuthorityAutoridade Nacional de Proteção de Dados (ANPD)

• MXMexico

  • Ley Federal de Protección de Datos Personales en Posesión de los Particulares (2025)

  AuthoritySecretaría Anticorrupción y Buen Gobierno

• CLChile

  • Ley 19.628, reformada por la Ley 21.719

  AuthorityAgencia de Protección de Datos Personales

• PEPeru

  • Ley 29733 y su Reglamento (D.S. 016-2024-JUS)

  AuthorityAutoridad Nacional de Protección de Datos Personales

• ARArgentina

  • Ley 25.326

  AuthorityAgencia de Acceso a la Información Pública (AAIP)

• ECEcuador

  • Ley Orgánica de Protección de Datos Personales (2021)

  AuthoritySuperintendencia de Protección de Datos Personales

• UYUruguay

  • Ley 18.331

  AuthorityUnidad Reguladora y de Control de Datos Personales (URCDP)

• PAPanama

  • Ley 81 de 2019

  AuthorityAutoridad Nacional de Transparencia y Acceso a la Información (ANTAI)

• CRCosta Rica

  • Ley 8968

  AuthorityAgencia de Protección de Datos de los Habitantes (PRODHAB)

We do not replace legal advice: we provide the technical, process and evidence components that regulation requires, working alongside your legal team.

• ISO/IEC 27701:2025Privacy information management system.
• ISO/IEC 29100Privacy framework and principles.
• ISO/IEC 29134Privacy impact assessment.
• ISO/IEC 27018Personal data in public clouds.
• GDPRFor processing data of European Union residents.
• CCPA/CPRAAnd other U.S. state privacy laws.