What you will find here
Trazza can be set up for businesses in 27 countries and territories in the Americas and Europe. For each one, this page summarizes the data protection, consumer, and accessibility laws most relevant to a beauty business that uses a cloud service.
This is general information, current as of October 2026, and does not constitute legal advice. Laws change, and some sources we could not verify against the official text; when that is the case, we say so.
Who is responsible for what
Each business is responsible for complying with the laws of its country toward its customers and its team.
Trazza acts as a processor, which depending on the country is also called an operator, a data processor, or a service provider: it processes data on the business's behalf and according to its instructions, as explained in the Data Processing Agreement.
How to read each country
We group countries by region. For each one you will see seven points: the data protection law, the authority, individuals' rights, international transfers, incident notification, consumer and e-commerce rules, and accessibility.
When a law has been passed but does not yet apply, or when only a bill exists, we say so expressly. A bill binds no one until it is passed and published.
Open a country to see its details. You can open several at once.
South America
Argentina
- Data protection
- Ley 25.326 de Protección de los Datos Personales (Personal Data Protection Law, 2000) applies, regulated by Decreto 1558/2001, and Ley 27.699 approved Convention 108+. There are reform bills in Congress, such as file 3397-D-2026, not enacted as of October 2026.
- Authority
- Agencia de Acceso a la Información Pública (AAIP, Agency for Access to Public Information): https://www.argentina.gob.ar/aaip
- Individuals' rights
- Access (free of charge every six months), rectification, updating, deletion, and confidentiality, exercised before the controller. If it does not respond, a complaint can be filed with the AAIP or a habeas data action brought.
- International transfers
- The law prohibits transfers to countries without adequate protection, except with consent or contractual safeguards. The authority approved model clauses (Disposición 60-E/2016 and Resolución AAIP 198/2023), and the United States is not on the list of adequate countries.
- Incident notification
- There is no legal duty to notify incidents. Resolución AAIP 47/2018 recommends notifying them to the AAIP and documenting them.
- Consumer protection and e-commerce
- Ley 24.240 de Defensa del Consumidor (Consumer Protection Law) and the Código Civil y Comercial (Civil and Commercial Code), which gives 10 days to revoke distance contracts. The rules on the withdrawal button (botón de arrepentimiento) and the cancellation button (botón de baja) apply to online sales to consumers, and Ley 25.506 governs digital signatures.
- Accessibility
- Ley 26.653 on web accessibility, with Decreto 656/2019 and the WCAG 2.0 AA standard. It binds the State and certain companies linked to it, not private companies in general.
Bolivia
- Data protection
- There is no general personal data protection law. The Constitution applies, protecting privacy and providing for the Acción de Protección de Privacidad (Privacy Protection Action, Arts. 130 and 131), along with sector rules such as Ley 164 on Telecommunications and ICT. There are bills in progress, none enacted as of October 2026.
- Authority
- There is no data protection authority. AGETIC (https://www.agetic.gob.bo) and ATT (https://www.att.gob.bo) have sector-specific powers.
- Individuals' rights
- The Privacy Protection Action allows people to learn about, object to, rectify, or delete data held in public or private databases, before judges and constitutional guarantee courts.
- International transfers
- There are no specific rules on international transfers.
- Incident notification
- There is no general duty to notify incidents; sector rules may apply.
- Consumer protection and e-commerce
- Ley 453 General de los Derechos de las Usuarias y los Usuarios y de las Consumidoras y los Consumidores (General Law on User and Consumer Rights, 2013), regulated by DS 2130. Ley 164 and its regulations (DS 1793 and DS 3527) give legal value to digital documents and signatures.
- Accessibility
- Ley 223 General para Personas con Discapacidad (General Law for Persons with Disabilities, 2012). AGETIC set guidelines for State websites; we did not verify a WCAG obligation for private parties.
Brazil
- Data protection
- The Lei Geral de Proteção de Dados (LGPD, General Data Protection Law, Lei 13.709/2018) applies, with sanctions since August 2021. Lei 15.352 of 2026 turned the ANPD into a regulatory agency without changing the substantive obligations. The processor (operador) handles data according to the controller's lawful instructions, applies security measures, and is jointly liable if it fails to comply with them.
- Authority
- Agência Nacional de Proteção de Dados (ANPD, National Data Protection Authority): https://www.gov.br/anpd/pt-br
- Individuals' rights
- Confirmation and access, correction, anonymization, blocking or deletion, portability, information about with whom data is shared, revocation of consent, objection, and review of automated decisions. They are exercised free of charge before the controller and then before the ANPD.
- International transfers
- Through adequacy, with the ANPD's standard contractual clauses (Resolução 19/2024), or through other mechanisms. The European Union and Brazil recognized each other as adequate in January 2026; the United States has no adequacy decision.
- Incident notification
- The controller notifies the ANPD and the data subjects, within 3 business days, of incidents that may cause relevant risk or harm (Resolução 15/2024), and records all incidents.
- Consumer protection and e-commerce
- Código de Defesa do Consumidor (Consumer Protection Code, Lei 8.078/1990), with a 7-day withdrawal period for distance contracts, which may also protect small businesses; Decreto 7.962/2013 on e-commerce; and the Marco Civil da Internet (Brazilian Internet Civil Rights Framework, Lei 12.965/2014). Electronic signatures are governed by MP 2.200-2/2001 and Lei 14.063/2020.
- Accessibility
- The Lei Brasileira de Inclusão (Brazilian Inclusion Law, Lei 13.146/2015, Art. 63) requires accessibility on the websites of companies headquartered or represented in Brazil. Standard ABNT NBR 17225:2025 is based on WCAG 2.2.
Chile
- Data protection
- Ley 19.628 sobre Protección de la Vida Privada (Privacy Protection Law, 1999) currently applies, and the Constitution has protected personal data since 2018 (Art. 19 No. 4). Ley 21.719, published in December 2024, comprehensively amends Ley 19.628, creates the Personal Data Protection Agency (Agencia de Protección de Datos Personales), and takes effect on December 1, 2026. A bill to postpone it by one year (Boletín 18.623-07) was still pending in the Senate, not passed, as of October 2026.
- Authority
- There is currently no dedicated authority: individuals bring claims in the courts, and SERNAC, the national consumer agency, acts in consumer relationships (https://www.sernac.cl). Ley 21.719 creates the Agencia de Protección de Datos Personales (Personal Data Protection Agency), which has not yet been set up.
- Individuals' rights
- Under Ley 19.628: access, rectification, cancellation, and blocking, plus the judicial habeas data action. Ley 21.719 adds objection, portability, and the right not to be subject to automated decisions, which are exercised before the controller.
- International transfers
- Ley 19.628 has no specific regime. Ley 21.719 will allow transfers to adequate countries or with safeguards, such as model contractual clauses; the list of countries and the clauses have not yet been issued.
- Incident notification
- There is currently no general duty to notify. Under Ley 21.719, the controller must report to the Agency without undue delay and inform data subjects in certain cases; the cybersecurity law, Ley 21.663, sets its own deadlines for essential services.
- Consumer protection and e-commerce
- Ley 19.496 de Protección de los Derechos de los Consumidores (Consumer Rights Protection Law), strengthened by Ley 21.398 (2021), with a right of withdrawal in distance contracts, and the Reglamento de Comercio Electrónico (E-Commerce Regulation, DS 6/2021). Ley 20.416 extends certain protections to micro and small businesses, and Ley 19.799 governs electronic documents and signatures.
- Accessibility
- Ley 20.422 (2010) on equal opportunities for persons with disabilities. The WCAG-based web technical standard (DS 1/2015) binds state bodies; for private companies there is no general WCAG obligation.
Colombia
- Data protection
- Ley Estatutaria 1581 de 2012 (Statutory Law 1581 of 2012) and its implementing decrees apply, compiled in Decreto Único 1074 de 2015, together with habeas data under Art. 15 of the Constitution. There are reform bills in Congress, none passed as of October 2026.
- Authority
- Superintendencia de Industria y Comercio (SIC, Superintendence of Industry and Commerce), Delegatura para la Protección de Datos Personales (Personal Data Protection Office): https://www.sic.gov.co
- Individuals' rights
- To know, update, rectify, and delete data, revoke the authorization, request proof of it, and file complaints with the SIC. Inquiries are answered within 10 business days and claims within 15, and before going to the SIC one must file a claim with the controller or the processor.
- International transfers
- Only to countries with an adequate level according to the SIC, with exceptions. Sending data to a processor abroad (transmisión, or transmission) does not require the data subject's authorization if there is a transmission contract, and in 2025 the SIC adopted voluntary model clauses.
- Incident notification
- The controller and the processor must report violations of security codes to the SIC, through the Registro Nacional de Bases de Datos (National Database Registry), within 15 business days of becoming aware of them.
- Consumer protection and e-commerce
- Ley 1480 de 2011, the Estatuto del Consumidor (Consumer Statute), with a 5-business-day withdrawal right for distance sales and e-commerce rules. Ley 527 de 1999 governs data messages and digital signatures, and Ley 2300 de 2023 limits the hours and channels for contacting consumers.
- Accessibility
- Ley Estatutaria 1618 de 2013. MinTIC Resolución 1519 de 2020 requires WCAG 2.1 AA of public entities.
Ecuador
- Data protection
- The Ley Orgánica de Protección de Datos Personales (LOPDP, Organic Law on Personal Data Protection, 2021) applies, with a sanctions regime since May 2023 and a General Regulation from November 2023. The Superintendency issued supplementary rules in 2025 and 2026, including on transfers, artificial intelligence, and breach notification.
- Authority
- Superintendencia de Protección de Datos Personales (SPDP, Superintendency of Personal Data Protection): https://spdp.gob.ec
- Individuals' rights
- Information, access, rectification and updating, deletion, objection, portability, suspension of processing, and not being subject to decisions based solely on automated assessments. They are exercised before the controller and then before the SPDP or through a habeas data action.
- International transfers
- Transfers are allowed to adequate countries or, if they are not adequate, with safeguards such as standard contractual clauses or binding corporate rules, under the Norma General de Transferencias (General Transfer Rule) of January 2026.
- Incident notification
- The processor notifies the controller within 2 days at most, and the controller notifies the SPDP within 5 days at most and informs data subjects in clear language (Art. 43 of the LOPDP and a technical standard from September 2026).
- Consumer protection and e-commerce
- Ley Orgánica de Defensa del Consumidor (Organic Consumer Protection Law, 2000) and Ley de Comercio Electrónico, Firmas Electrónicas y Mensajes de Datos (Law on E-Commerce, Electronic Signatures, and Data Messages, 2002), which requires the consumer's consent to use electronic means.
- Accessibility
- Ley Orgánica de Discapacidades (Organic Law on Disabilities, 2012). Technical regulation RTE INEN 288 on web content, equivalent to WCAG 2.0, is aimed mainly at the public sector.
Guyana
- Data protection
- The Data Protection Act 2023 (Act No. 18 of 2023), similar in approach to the GDPR, has been enacted, but it takes effect by ministerial order, and we did not find that order published as of October 2026. In the meantime, constitutional privacy protection and the common law apply.
- Authority
- The law provides for a Data Protection Commissioner, an office that has not yet been established. The Ministry of Legal Affairs coordinates its implementation: https://mola.gov.gy
- Individuals' rights
- The law recognizes access, rectification, erasure, restriction, portability, objection, and rights regarding automated decisions, which are not yet operational.
- International transfers
- The law regulates transfers outside Guyana with adequate protection or safeguards, but that part is not yet operational.
- Incident notification
- The law provides for notifying the Commissioner and data subjects. We did not verify the deadline, and there is currently no operational channel.
- Consumer protection and e-commerce
- Consumer Affairs Act 2011, enforced by the Competition and Consumer Affairs Commission, and the Electronic Communications and Transactions Act 2023 on electronic contracts and signatures.
- Accessibility
- Persons with Disabilities Act 2010, with no verified web-specific obligation.
Paraguay
- Data protection
- Ley 7593/2025 de Protección de Datos Personales (Personal Data Protection Law), enacted in November 2025, is the country's first general law. It has a two-year transition, so full enforceability is expected around the end of 2027, subject to implementing regulations. Until then, constitutional habeas data and sector-specific laws apply, such as Ley 6534/2020 on credit data.
- Authority
- Ley 7593 creates the Agencia Nacional de Protección de Datos Personales (National Personal Data Protection Agency) within MITIC, which is still being formed: https://www.mitic.gov.py
- Individuals' rights
- Ley 7593 recognizes access, rectification, deletion, objection, portability, and review of automated decisions, among others. Until it is fully enforceable, the habeas data action under Art. 135 of the Constitution is used.
- International transfers
- Ley 7593 allows transfers to adequate countries or with safeguards, such as contractual clauses; the details depend on the pending implementing regulations.
- Incident notification
- Secondary sources indicate that Ley 7593 requires notifying the authority and the affected people within 72 hours, but we did not verify this in the official text. Before it is fully in force, there is no general duty.
- Consumer protection and e-commerce
- Ley 1334/1998 de Defensa del Consumidor y del Usuario (Consumer and User Protection Law), enforced by SEDECO, and Ley 4868/2013 de Comercio Electrónico (E-Commerce Law). Ley 6822/2021 governs electronic signatures and trust services.
- Accessibility
- We did not verify any mandatory web accessibility law or technical standard.
Peru
- Data protection
- Ley 29733 de Protección de Datos Personales (Personal Data Protection Law, 2011) applies, along with its new Regulation (DS 016-2024-JUS), in force since March 30, 2025, which adds proactive accountability, portability, and a Personal Data Officer (Oficial de Datos Personales) that is mandatory when large volumes of data or sensitive data are processed, with deadlines staggered by company size. Controllers register their databases in the National Registry.
- Authority
- Autoridad Nacional de Protección de Datos Personales (ANPD, National Personal Data Protection Authority), part of the Ministry of Justice and Human Rights: https://www.gob.pe/institucion/anpd
- Individuals' rights
- ARCO rights (access, rectification, cancellation, and objection), plus information, portability, and objective processing in the face of automated decisions. They are exercised before the database owner and, if it does not respond, a protection proceeding (tutela) before the ANPD is available.
- International transfers
- Cross-border flows are allowed to adequate countries or with safeguards, such as the ANPD's model clauses, and must be reported to the authority. Failing to report them has been sanctioned.
- Incident notification
- Serious incidents, such as those affecting large volumes or sensitive data, must be reported to the ANPD within 48 hours, and the affected data subjects must be informed. All incidents are documented.
- Consumer protection and e-commerce
- Código de Protección y Defensa del Consumidor (Consumer Protection and Defense Code, Ley 29571), overseen by INDECOPI. Ley 32495 (2025) extends the Libro de Reclamaciones (complaints book) to e-commerce platforms, and Ley 27269 governs digital signatures and certificates.
- Accessibility
- Ley 29973 General de la Persona con Discapacidad (General Law on Persons with Disabilities). A 2025 guideline based on WCAG 2.2 is mandatory for public entities.
Suriname
- Data protection
- There is no general data protection law; a bill introduced in 2018 is still pending according to the available information. Art. 17 of the Constitution on private life, the Wet Elektronisch Rechtsverkeer 2017 (Electronic Legal Transactions Act) on data collected by electronic service providers, and the new Civil Code, in force since May 2025, apply.
- Authority
- There is no data protection authority.
- Individuals' rights
- There is no statutory list of rights. Privacy is protected through the courts and through civil liability.
- International transfers
- There are no specific legal restrictions on international transfers.
- Incident notification
- There is no general legal obligation to notify incidents.
- Consumer protection and e-commerce
- The Wet Elektronisch Rechtsverkeer 2017 governs electronic contracts and messages. A 2020 consumer protection bill is not on record as passed.
- Accessibility
- There is no digital accessibility law or standard. Suriname ratified the UN Convention on the Rights of Persons with Disabilities in 2017.
Uruguay
- Data protection
- Ley 18.331 de Protección de Datos Personales (Personal Data Protection Law, 2008) applies, with Decreto 414/009, updated by Ley 19.670 and Decreto 64/020. The European Union recognizes Uruguay as a country with adequate protection.
- Authority
- Unidad Reguladora y de Control de Datos Personales (URCDP, Personal Data Regulatory and Control Unit), part of AGESIC: https://www.gub.uy/unidad-reguladora-control-datos-personales
- Individuals' rights
- Access, rectification, updating, inclusion, and deletion, plus the right to be informed. They are exercised before the controller and, if it does not respond, a habeas data action or a complaint to the URCDP is available.
- International transfers
- Only to adequate countries or with contractual safeguards, according to URCDP resolutions; since 2023, organizations that adhere to the U.S. Data Privacy Framework count as adequate. Ley 20.075 requires informing people that there will be an international transfer.
- Incident notification
- Decreto 64/020 requires starting measures within 24 hours, reporting the incident to the URCDP within 72 hours at most, and informing data subjects when their rights are significantly affected. The processor notifies the controller immediately.
- Consumer protection and e-commerce
- Ley 17.250 de Relaciones de Consumo (Consumer Relations Law), with a right of withdrawal for off-premises sales, including those made by computer, and Decreto 167/021 on information in e-commerce. Ley 18.600 governs electronic documents and signatures.
- Accessibility
- Ley 18.651 on the comprehensive protection of persons with disabilities. Decreto 406/022 requires WCAG 2.1 A and AA of the State and of non-state public entities; it is not mandatory for private parties.
Venezuela
- Data protection
- There is no general personal data protection law. The 1999 Constitution (Art. 28, habeas data, and Art. 60, privacy), case law of the Tribunal Supremo de Justicia (Supreme Tribunal of Justice), and sector rules such as the Ley Especial contra los Delitos Informáticos (Special Law against Computer Crimes, 2001) apply.
- Authority
- There is no data protection authority: the courts and the Defensoría del Pueblo (Ombudsman's Office) act. SUSCERTE is the electronic signature authority: https://www.suscerte.gob.ve
- Individuals' rights
- Habeas data (Art. 28 of the Constitution): accessing one's own data, knowing its use and purpose, and requesting its updating, rectification, or destruction when it is inaccurate or affects rights.
- International transfers
- There are no specific rules on international transfers.
- Incident notification
- There is no general duty to notify incidents.
- Consumer protection and e-commerce
- Ley Orgánica de Precios Justos (Organic Law on Fair Prices, 2015), overseen by SUNDDE, with a reform under discussion in 2026 whose status we did not verify. The Decreto-Ley sobre Mensajes de Datos y Firmas Electrónicas (Decree-Law on Data Messages and Electronic Signatures, 2001) gives data messages evidentiary value.
- Accessibility
- Ley Orgánica para la Inclusión, Igualdad y Desarrollo Integral de las Personas con Discapacidad (Organic Law for the Inclusion, Equality, and Comprehensive Development of Persons with Disabilities, 2024). We did not verify a mandatory WCAG standard.
Central America and the Caribbean
Belize
- Data protection
- The Data Protection Act 2021 (Act No. 45 of 2021), similar in approach to the GDPR, has been enacted, but it takes effect by ministerial order, and we did not verify that the order had been published as of October 2026. In the meantime, constitutional protection of private life and the common law apply.
- Authority
- The law provides for a Data Protection Commissioner, who has not been appointed.
- Individuals' rights
- The law recognizes access, rectification, erasure, restriction, portability, objection, including objection to direct marketing, and rights regarding automated decisions; they are not yet operational.
- International transfers
- The law regulates transfers outside Belize with adequate protection, safeguards, or binding corporate rules, but that part is not yet operational.
- Incident notification
- A secondary source indicates that the authority must be notified within 72 hours where feasible; we did not verify this in the text of the law, and there is currently no operational channel.
- Consumer protection and e-commerce
- Electronic Transactions Act 2021 on electronic contracts. There is no general consumer protection law.
- Accessibility
- Disabilities Act 2024, which covers buildings, transportation, and essential services; we did not verify obligations for websites.
Costa Rica
- Data protection
- Ley 8968 de Protección de la Persona frente al Tratamiento de sus Datos Personales (Law on the Protection of Individuals with Regard to the Processing of Their Personal Data, 2011) and its regulations apply. It requires informed, express, and unequivocal consent. In October 2026 a reform bill on data leaks was introduced (file no. 25.826), not passed.
- Authority
- Agencia de Protección de Datos de los Habitantes (PRODHAB, Agency for the Protection of Inhabitants' Data): http://www.prodhab.go.cr
- Individuals' rights
- Access, rectification, and deletion, and revocation of consent. Claims are filed with PRODHAB or through an amparo petition before the Sala Constitucional (Constitutional Chamber).
- International transfers
- Transferring data to third parties requires express written consent. Communications to technology providers acting on the controller's behalf are not considered transfers.
- Incident notification
- The affected person and PRODHAB must be notified within the 5 business days following discovery of the breach.
- Consumer protection and e-commerce
- Ley 7472 de Promoción de la Competencia y Defensa Efectiva del Consumidor (Law on the Promotion of Competition and Effective Consumer Protection), with e-commerce rules in its regulations, and Ley 8454 de Certificados, Firmas Digitales y Documentos Electrónicos (Law on Certificates, Digital Signatures, and Electronic Documents). Under the Ley General de Telecomunicaciones (General Telecommunications Law), unsolicited marketing requires prior consent.
- Accessibility
- Ley 7600 de Igualdad de Oportunidades para las Personas con Discapacidad (Law on Equal Opportunities for Persons with Disabilities). A 2019 directive requires WCAG 2.1 of the Executive Branch; it does not bind private parties.
Cuba
- Data protection
- Ley 149/2022 de Protección de Datos Personales (Personal Data Protection Law) applies, in force since February 2023, and distinguishes between controller and processor. Resolución 58/2022 of the Ministry of Communications sets security and registration requirements for electronic databases.
- Authority
- The Ministry of Justice as regulator, according to secondary sources, and the Ministry of Communications for the security of electronic data: https://www.mincom.gob.cu
- Individuals' rights
- Access, rectification and updating, cancellation, and objection, exercised before the controller or the processor. We did not verify the response deadlines.
- International transfers
- The law regulates international transfers, but we did not verify the final text of those rules.
- Incident notification
- We did not find a clear obligation to notify incidents in Ley 149.
- Consumer protection and e-commerce
- There is no general consumer protection law; Resolución 54/2018 of the Ministry of Domestic Trade applies. Online commerce is governed by Decreto-Ley 370/2018 and by rules from 2023 and 2026.
- Accessibility
- We did not identify an official web accessibility law or standard.
Dominican Republic
- Data protection
- Ley 172-13 sobre Protección Integral de los Datos Personales (Comprehensive Personal Data Protection Law, 2013) applies; it requires free, unequivocal, and informed consent, with exceptions, as well as security measures. A reform bill that would create an independent authority was still under discussion in 2026.
- Authority
- There is no general data protection authority for the private sector. Pro Consumidor acts in consumer relationships (https://proconsumidor.gob.do), and the courts hear habeas data actions.
- Individuals' rights
- Access, rectification, and cancellation or deletion, plus the habeas data action (Arts. 44 and 70 of the Constitution).
- International transfers
- Only with the person's express authorization or when necessary to perform a contract with them.
- Incident notification
- There is no legal obligation currently in force to notify incidents.
- Consumer protection and e-commerce
- Ley 358-05 General de Protección de los Derechos del Consumidor o Usuario (General Law on the Protection of Consumer or User Rights) and Ley 126-02 de Comercio Electrónico, Documentos y Firmas Digitales (Law on E-Commerce, Documents, and Digital Signatures). Ley 310-14 requires consent and an unsubscribe mechanism in commercial email.
- Accessibility
- Ley 5-13 sobre Discapacidad (Disability Law). The NORTIC B2 web accessibility standard is mandatory for State portals and voluntary for private ones.
El Salvador
- Data protection
- The Ley para la Protección de Datos Personales (Personal Data Protection Law, Decreto Legislativo 144 of 2024) applies, amended in September 2026 by Decreto Legislativo 659, which removed the obligation for private companies to appoint a data protection officer. It requires express consent and gives people the right to know who safeguards their data, including cloud providers.
- Authority
- Agencia de Ciberseguridad del Estado (ACE, State Cybersecurity Agency), the lead body for personal data. We did not verify an official website.
- Individuals' rights
- ARCO-POL rights: access, rectification, cancellation, objection, limitation, portability, and the right to be forgotten. They are exercised free of charge before the controller.
- International transfers
- Except in specific cases, every international transfer requires the person's prior consent, a contract with the recipient containing equivalent obligations, and informing the ACE of the data flow.
- Incident notification
- The ACE, the Fiscalía General de la República (Attorney General's Office), and the affected data subjects must be notified within 72 hours at most of learning of the breach, and a record of all breaches must be kept.
- Consumer protection and e-commerce
- Ley de Protección al Consumidor (Consumer Protection Law), with e-commerce obligations, enforced by the Defensoría del Consumidor (Consumer Protection Office, https://www.defensoria.gob.sv). The Ley de Comercio Electrónico (E-Commerce Law, 2020) covers electronic contracts between businesses, and the Ley de Firma Electrónica (Electronic Signature Law, 2015) their validity.
- Accessibility
- Ley Especial de Inclusión de las Personas con Discapacidad (Special Law for the Inclusion of Persons with Disabilities). We did not identify a mandatory web standard for private parties.
Guatemala
- Data protection
- There is no general personal data protection law; there are initiatives in Congress, such as no. 6464, not passed as of October 2026. The Constitution, case law of the Corte de Constitucionalidad (Constitutional Court) on informational self-determination, and the Ley de Acceso a la Información Pública (Access to Public Information Law, Decreto 57-2008), which applies to obligated entities, are in force.
- Authority
- There is no data authority for the private sector. Under the Access to Public Information Law, the Procurador de los Derechos Humanos (Human Rights Ombudsman) acts: https://www.pdh.org.gt
- Individuals' rights
- Habeas data against obligated entities: access, updating, rectification, and protection. Against private parties there is no legal regime of ARCO rights; the avenue is a constitutional amparo action.
- International transfers
- There is no specific international transfer regime.
- Incident notification
- There is no general legal obligation to notify incidents.
- Consumer protection and e-commerce
- Ley de Protección al Consumidor y Usuario (Consumer and User Protection Law, Decreto 006-2003), enforced by DIACO, and Ley para el Reconocimiento de las Comunicaciones y Firmas Electrónicas (Law on the Recognition of Electronic Communications and Signatures, Decreto 47-2008).
- Accessibility
- Ley de Atención a las Personas con Discapacidad (Law on Care for Persons with Disabilities, Decreto 135-96). We did not identify an official mandatory web accessibility standard for private parties.
Haiti
- Data protection
- There is no general data protection law. A 2018 regulatory decree requires consent, and the 2020 Penal Code criminalizes unlawful data processing, although whether it is in force is unclear. Our confidence in this information is low.
- Authority
- There is no national data protection authority.
- Individuals' rights
- There is no statutory list of rights. The 2018 decree implies rights of access and modification, and the 1987 Constitution protects private life.
- International transfers
- There is no specific international transfer regime.
- Incident notification
- There is no obligation to notify incidents.
- Consumer protection and e-commerce
- There are 2017 laws on electronic exchanges and electronic signatures, updated in 2025. We did not identify a general consumer protection law in force.
- Accessibility
- There is a 2012 law on the integration of persons with disabilities; we did not identify an official web standard.
Honduras
- Data protection
- There is no general law in force: the Ley de Protección de Datos Personales bill promoted by the IAIP was still pending in August 2026. Habeas data under Art. 182 of the Constitution and the Ley de Transparencia y Acceso a la Información Pública (Transparency and Access to Public Information Law) apply; the latter requires express written consent to transfer confidential personal data.
- Authority
- There is no specific data protection authority. The Instituto de Acceso a la Información Pública (Institute for Access to Public Information) has partial functions: https://www.iaip.gob.hn
- Individuals' rights
- Constitutional habeas data: access, rectification, confidentiality, and deletion of false data, through an action before the Sala de lo Constitucional (Constitutional Chamber).
- International transfers
- There is no specific regime. The transparency rules require express written consent to transfer confidential personal data, with exceptions.
- Incident notification
- There is no legal obligation to notify incidents.
- Consumer protection and e-commerce
- Ley de Protección al Consumidor (Consumer Protection Law, 2008), with regulations in force since 2021, and Ley sobre Firmas Electrónicas (Electronic Signatures Law, Decreto 149-2013). There is also a 2015 e-commerce law whose number we did not verify.
- Accessibility
- Ley de Equidad y Desarrollo Integral para las Personas con Discapacidad (Law on Equity and Comprehensive Development for Persons with Disabilities, Decreto 160-2005). We did not identify an official web accessibility standard.
Nicaragua
- Data protection
- Ley 787 de Protección de Datos Personales (Personal Data Protection Law, 2012) and its regulations (Decreto 36-2012) are formally in force, but their practical application is minimal because the authority they provide for has not been established. The law requires consent for processing, especially of sensitive data.
- Authority
- Ley 787 provides for a Dirección de Protección de Datos Personales (Personal Data Protection Directorate) within the Ministry of Finance and Public Credit, which is not operational.
- Individuals' rights
- Access, rectification, modification, cancellation, and revocation of consent, under Ley 787.
- International transfers
- Disclosures require the person's prior consent, informing them of the purpose and of who receives the data. There is no operational international transfer regime.
- Incident notification
- There is no general obligation to notify incidents.
- Consumer protection and e-commerce
- Ley 842 de Protección de los Derechos de las Personas Consumidoras y Usuarias (Law on the Protection of Consumer and User Rights, 2013), amended in 2021, and Ley 729 de Firma Electrónica (Electronic Signature Law, 2010).
- Accessibility
- Ley 763 de los Derechos de las Personas con Discapacidad (Law on the Rights of Persons with Disabilities, 2011). We did not identify an official web accessibility standard.
Panama
- Data protection
- Ley 81 de 2019 sobre Protección de Datos Personales (Personal Data Protection Law) applies, in force since March 2021 and regulated by Decreto Ejecutivo 285 de 2021. The processor acts according to the controller's instructions and must notify it immediately of an incident.
- Authority
- Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI, National Authority for Transparency and Access to Information), Dirección de Protección de Datos Personales (Personal Data Protection Directorate): https://www.antai.gob.pa
- Individuals' rights
- Access, rectification, cancellation, objection, and portability. They are exercised before the controller and, if it does not respond, a complaint is filed with ANTAI.
- International transfers
- The general rule is prior, informed consent. Transfers are allowed to countries with adequate protection, between companies in the same group, or with contractual safeguards.
- Incident notification
- ANTAI and the affected data subjects must be notified immediately and within 72 hours, documenting the causes, the effects, and the measures taken.
- Consumer protection and e-commerce
- Ley 45 de 2007 on consumer protection, enforced by ACODECO (https://www.acodeco.gob.pa), and Ley 51 de 2008 on electronic documents, signatures, and commerce, which requires prior consent and an unsubscribe option in commercial email.
- Accessibility
- Ley 42 de 1999 on equal opportunities, amended by Ley 15 de 2016. There is no mandatory web standard.
Puerto Rico
- Data protection
- There is no general privacy law, either federal or in Puerto Rico. Sector laws apply, such as Ley 111-2005 on breach notification, as well as federal laws such as the FTC Act, CAN-SPAM, the TCPA for automated messages and calls, and COPPA for children under 13.
- Authority
- Departamento de Asuntos del Consumidor (DACO, Department of Consumer Affairs): https://www.daco.pr.gov. Federal Trade Commission (FTC): https://www.ftc.gov
- Individuals' rights
- The law provides no general ARCO rights. The Constitution of Puerto Rico protects private life, including against private parties, and there are sector-specific rights.
- International transfers
- There are no general restrictions on international transfers.
- Incident notification
- If someone gains unauthorized access to certain unencrypted personal information, the affected people must be notified as soon as possible and a report filed with DACO within 10 days of detection (Ley 111-2005).
- Consumer protection and e-commerce
- The Ley Orgánica del DACO (DACO Organic Law) and its regulations against deceptive practices, Ley 148-2006 de Transacciones Electrónicas (Electronic Transactions Law), and the federal E-SIGN Act. For subscriptions with automatic renewal, ROSCA and the FTC's Negative Option Rule apply.
- Accessibility
- Ley 229-2003 requires government agencies to follow the WCAG guidelines. For private parties, interpretations of the ADA (Title III) are divided, and WCAG 2.1 AA is used as a reference.
North America
Mexico
- Data protection
- The Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on the Protection of Personal Data Held by Private Parties), published on March 20, 2025, applies and replaced the 2010 law; the 2011 regulations still apply insofar as they do not conflict with it. The processor handles data only according to the controller's instructions and deletes or returns it when the relationship ends.
- Authority
- Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), which in 2025 took over the functions of the now-defunct INAI: https://www.gob.mx/buengobierno
- Individuals' rights
- ARCO rights (access, rectification, cancellation, and objection) and revocation of consent. The controller has up to 20 days to respond; after that, the rights protection procedure before the authority is available.
- International transfers
- Transferring data to a third party other than the processor requires consent, except for legal exceptions. Sending data to processors (remisión), even if they are in another country, does not require consent if there is a contract and instructions.
- Incident notification
- The controller must immediately inform data subjects of breaches that significantly affect their property or moral rights. The law does not provide for notifying the authority.
- Consumer protection and e-commerce
- Ley Federal de Protección al Consumidor (Federal Consumer Protection Law), with e-commerce rules and, since December 2025, duties regarding recurring charges, renewal notices, and simple cancellation. An accredited microbusiness can file claims with PROFECO, and the Código de Comercio (Commercial Code) governs data messages and electronic signatures.
- Accessibility
- Ley General para la Inclusión de las Personas con Discapacidad (General Law for the Inclusion of Persons with Disabilities, 2011). The 2015 web accessibility provisions bind only the Federal Public Administration; there is no mandatory standard for private parties.
United States
- Data protection
- There is no general federal privacy law; the FTC sanctions unfair or deceptive practices, including broken privacy promises. About twenty states have general laws in force, such as California (CCPA and CPRA), Virginia, Colorado, and Texas, with thresholds that many small businesses do not meet.
- Authority
- Federal Trade Commission (FTC): https://www.ftc.gov. In California, the California Privacy Protection Agency (https://cppa.ca.gov); in the other states, their attorneys general.
- Individuals' rights
- In California: to know and access, delete, correct, opt out of the sale or sharing of data, and limit the use of sensitive information. In the other states with a general law: access, correction, deletion, portability, and opting out of targeted advertising and profiling.
- International transfers
- There is no general restriction. A Department of Justice rule in effect since April 2025 limits giving certain countries access to bulk sensitive data of people in the United States, among them China, Russia, Iran, North Korea, and Cuba. Venezuela was also on the list; check whether it still is.
- Incident notification
- Every state has a breach notification law, with deadlines ranging from without unreasonable delay to 30 to 60 days. Anyone who processes data on behalf of another must notify the data owner immediately.
- Consumer protection and e-commerce
- The FTC Act and ROSCA, which requires informed consent and a simple way to cancel subscriptions; the federal click-to-cancel rule was vacated in 2025. California has its own automatic renewal law, and the E-SIGN Act and UETA give legal validity to electronic contracts and signatures.
- Accessibility
- Interpretations of the ADA (Title III) are divided as to private websites, and in practice WCAG 2.1 AA is used as a reference. For state and local governments, a Department of Justice rule based on WCAG 2.1 AA applies.
Europe
Portugal
- Data protection
- The GDPR and Lei 58/2019, which implements it in Portugal, apply; the authority decided not to apply some of its provisions because it considers them incompatible with the GDPR. The subcontratante, as the processor is called there, needs a contract with the content required by Art. 28 of the GDPR.
- Authority
- Comissão Nacional de Proteção de Dados (CNPD, National Data Protection Commission): https://www.cnpd.pt
- Individuals' rights
- Access, rectification, erasure, restriction, portability, objection, and not being subject to automated decisions. They are exercised before the controller, who responds within one month (extendable), and complaints are filed with the CNPD.
- International transfers
- The same GDPR rules as in Spain: adequacy, standard contractual clauses with an impact assessment, or binding corporate rules.
- Incident notification
- The controller notifies the CNPD within 72 hours, and the data subjects if the risk is high. The processor notifies the controller without undue delay.
- Consumer protection and e-commerce
- Lei 24/96 de Defesa do Consumidor (Consumer Protection Law), Decreto-Lei 24/2014 on distance contracts, with 14 days for consumers, Decreto-Lei 7/2004 on e-commerce, and Decreto-Lei 446/85 on standard contract terms, which also applies between businesses. The electronic Livro de Reclamações (complaints book) applies to anyone who provides services to consumers.
- Accessibility
- Decreto-Lei 82/2022, which transposes the European Accessibility Act as of June 2025, and Decreto-Lei 83/2018 for the public sector (WCAG 2.1 AA).
Spain
- Data protection
- The EU General Data Protection Regulation (GDPR, Regulation 2016/679) and Ley Orgánica 3/2018 (LOPDGDD) apply. The processor needs a contract with the content required by Art. 28 of the GDPR. The GDPR reform known as the Digital Omnibus is still in progress, not passed.
- Authority
- Agencia Española de Protección de Datos (AEPD, Spanish Data Protection Agency): https://www.aepd.es
- Individuals' rights
- Access, rectification, erasure, restriction, portability, objection, and not being subject to automated individual decisions. They are exercised free of charge before the controller, who responds within one month (extendable), and complaints are filed with the AEPD.
- International transfers
- Outside the European Economic Area, only to countries with an adequacy decision, such as Argentina, Uruguay, Brazil since 2026, or U.S. companies certified under the Data Privacy Framework, or with standard contractual clauses and an impact assessment. Chile and most of Latin America do not have adequacy.
- Incident notification
- The controller notifies the AEPD within 72 hours, unless a risk is unlikely, and informs the affected people if the risk is high. The processor notifies the controller without undue delay.
- Consumer protection and e-commerce
- Ley General para la Defensa de los Consumidores y Usuarios (General Law for the Protection of Consumers and Users, Real Decreto Legislativo 1/2007), with a 14-day withdrawal period for consumers, and Ley 34/2002 de servicios de la sociedad de la información (Information Society Services Law), which governs commercial communications and cookies. Ley 7/1998 sobre condiciones generales de la contratación (Standard Contract Terms Law) also applies between businesses.
- Accessibility
- Ley 11/2023, which transposes the European Accessibility Act and has applied since June 2025 to e-commerce services for consumers, with an exemption for microenterprises that provide services. The technical standard is EN 301 549.
Why transfers matter
Trazza's application and database run in São Paulo (Brazil), and some providers are in the United States. That is why it is worth checking what the law of each country requires for sending data abroad.
Many laws in the region allow sending data to a processor in another country if a contract backs it up. Others also require the person's consent or notifying the authority.
What repeats in almost every country
Tell people what data is collected and why, with a privacy policy or privacy notice.
Ask for consent for promotional messages and respect anyone who asks not to receive them.
Have a contract with whoever processes data on your behalf, such as Trazza.
Protect data with reasonable security measures and know what to do in the event of an incident.
Updates
We review this page periodically. If you see outdated information, let us know through the contact channel listed at the end of this page.
Before making important decisions, consult the official source or a lawyer in your country.
Other legal documents
Back to the Legal CenterContact
If you have questions about this document or about your data, write to us at contacto@trazza.pro.
Who operates Trazza
The Trazza Pro service is operated from Santiago, Chile. For legal or privacy questions, or questions about your data, write to us at contacto@trazza.pro.