We invite you to read the opinion piece by our Director of New Technologies and AI, Juan Pablo González, along with Gimena Areal, an associate on Ferrere’s Intellectual Property team, on the landscape and regulatory developments in cybersecurity in the region.
Overview of Cybersecurity in the Region
In just a few years, cybersecurity has evolved from an exclusively technical matter into an issue of corporate governance, regulatory compliance, and public policy. Latin America’s rapid digital transformation—driven by the migration to the cloud, the digitization of public and financial services, and the expansion of remote work—has expanded the attack surface at a faster rate than the development of security controls, governance models, and institutional capabilities. In this context, various specialized reports agree that there has been a sustained increase in cyberattacks in the region[1].
Ransomware remains one of the most disruptive threats. According to Intel 471, data leaks published by ransomware groups in the region increased by 78% between 2024 and 2025[2]. Added to this are increasingly sophisticated phishing campaigns, powered by the use of artificial intelligence.
This situation has led countries in the region to strengthen their cybersecurity regulatory frameworks, establishing new obligations regarding the prevention, management, and reporting of incidents. Chile and Uruguay are two examples of this trend, although each has followed a different regulatory path.
The Cybersecurity Framework in Uruguay
Uruguay has achieved a high level of digital development, the result of a sustained policy of government modernization and the incorporation of technologies into the delivery of public services. This progress is reflected in the United Nations’ E-Government Survey 2024, which ranked the country as a leader in digital government in Latin America and the Caribbean and second in the Americas, behind only the United States[3].
However, this digitization process also poses significant cybersecurity challenges. The growing reliance on computer systems, the interconnection between public and private entities, and the volume of information managed through digital platforms increase exposure to potential security incidents. These incidents can compromise not only organizations’ information but also the continuity of essential services, individuals’ rights, and the functioning of activities critical to the country.
In light of this situation, Uruguay has gradually developed its cybersecurity framework through regulations of varying levels, without, to date, having a single overarching law on the matter.
At the heart of this system is the Agency for E-Government and the Information and Knowledge Society (Agesic), which operates through its Directorate of Information Security and the National Computer Security Incident Response Center (CERTuy). Since 2020, Law 19,924 has granted Agesic the authority to regulate, oversee, and audit information security in both public entities and private entities linked to critical services or sectors. With regard to personal data, Law 19,670 requires that security breaches be reported immediately to the Personal Data Regulatory and Control Unit (URCDP), which coordinates the response with CERTuy.
A particularly significant development occurred with Articles 78 through 84 of Law 20,212 of 2023. The law imposed on public entities and certain private entities involved in critical sectors the obligation to adopt security measures, appoint an information security officer, and report cybersecurity incidents to AGESIC within 24 hours of their detection. It also established the National Registry of Cybersecurity Incidents.
The framework was subsequently regulated by Decree 66/025, which established the mandatory application of the Uruguayan Cybersecurity Framework, aligned with the NIST Cybersecurity Framework. More recently, in July 2026, Decree 168/026 introduced new obligations for the Central Administration. In the event of a cybersecurity incident, the affected entity must immediately initiate the corresponding administrative procedures and, when the incident stems from a lack of foresight or the use of obsolete systems, make the necessary adjustments and notify Agesic.
Progress has also been made in the criminal justice sphere. Law 20,327 of August 2024 incorporated crimes such as computer damage, unauthorized access, unlawful interception, and identity theft into Uruguayan law, adapting the criminal framework to the requirements necessary to advance Uruguay’s accession to the Budapest Convention.
These developments are part of Uruguay’s National Cybersecurity Strategy 2024–2030 | Agesic, organized around eight pillars and aimed at strengthening national capabilities for the prevention, detection, and response to digital threats. Among its objectives are the identification of the country’s critical information infrastructure and the strengthening of cooperation between the public and private sectors.
General Overview of Chile
Chile is the first country in Latin America to have specific cybersecurity legislation, Law No. 21,663—the Cybersecurity Framework—which, among other provisions, calls for the creation of a National Cybersecurity Agency (ANCI), a National Computer Security Incident Response Team (CSIRT), and a National Defense Council, a Multisectoral Council, and the legal recognition of the Interministerial Cybersecurity Committee, a body that brings together various undersecretariats with a role in this area.
This regulation, which draws on several elements of the European Directive (NIS2), includes among its most distinctive features the definition of regulated entities—namely, providers of essential services—and establishes a series of economic sectors that are required to adopt measures to prevent and contain cybersecurity incidents; and furthermore, the designation of Operators of Vital Importance (OVI), which are specific institutions within the country that, due to their role, “the disruption, interception, interruption, or destruction of their services has a significant impact on public safety and order, on the continuous and regular provision of essential services, on the effective fulfillment of the State’s functions, or, in general, on the services that the State must provide or guarantee.” This designation is made through a regulated administrative process, which includes the right to file an appeal against the resolution designating an organization, as well as the right to challenge the legality of the resolution before the competent Court of Appeals.
In addition, one of the cross-cutting obligations under the regulations is the duty to report incidents with a significant impact, which applies to both essential service providers and OIVs. The deadlines established for this obligation are: within 3 hours of becoming aware of the incident (early warning); within 72 hours (24 hours for OIVs) for an initial assessment of the incident; and within 15 calendar days of the early warning for a final report. An incident is considered to have a significant impact when “it is capable of disrupting the continuity of an essential service or affecting the physical integrity or health of individuals, as well as in cases where it affects computer systems containing personal data.”
Finally, ANCI has oversight and enforcement powers, and the Act itself establishes a differentiated system of minor, serious, and very serious violations for both essential service providers and OIVs. For the former, these include minor violations (up to 5,000 UTM), serious violations (up to 10,000 UTM), and extremely serious violations (up to 20,000 UTM); and for OIVs, minor (up to 10,000 UTM), serious (up to 20,000 UTM), and extremely serious (up to 40,000 UTM).
In conclusion, the progress of regulation in Chile reflects a government policy of promoting cybersecurity as a cross-cutting issue, which is reflected in the update of the Cybersecurity Policy, now in its second version (2023–2028).
Challenges for the Region
One of the main challenges Chile has had to overcome is the lack of digital literacy in the regions and, in particular, the lack of a culture of digital engagement, despite high levels of Internet access. Thus, while cybersecurity regulations are in place, this implies not only a preventive and regulatory approach through the ANCI but also requires significant adjustments to educational curricula and the promotion of public awareness programs.
In the case of Uruguay, although the country has made significant progress in building its regulatory and institutional framework, the main challenge remains to support its digital development with effective incident prevention and response capabilities. To this end, it is essential that organizations incorporate cybersecurity as part of their day-to-day management and not merely as a regulatory compliance obligation.
At the regional level, the work of initiatives such as the OAS’s CSIRT Americas has enabled several countries to collaborate on cyber threats and, consequently, incidents, sharing information through a threat intelligence approach; however, at the regulatory level, fragmentation prevents the establishment of similar frameworks to promote collaboration beyond the technical sphere. In this regard, initiatives from LAC4 (Latin American and Caribbean Cyber Competence Center), such as the CyberPolicy Bootcamp, undoubtedly facilitate dialogue at the regulatory level regarding cybersecurity legislative initiatives in the region.
Column written by:
Juan Pablo González | Director of New Technologies and AI | jgonzalez@az.cl
Gimena Areal | Intellectual Property Associate at Ferrere
