On December 26, General Instructions Nos. 2, 3, and 4 issued by the National Cybersecurity Agency (Agencia Nacional de Ciberseguridad – “ANCI”) were published in the Official Gazette. These instructions establish new obligations for institutions that provide services classified as essential and for those designated as Operators of Vital Importance (“OIV”), within the framework of the Cybersecurity Framework Law No. 21,663.

In particular, ANCI issued the following instructions:

• General Instruction No. 2, which authorizes the appointment of a cybersecurity officer without a Clave Única;

• General Instruction No. 3, which establishes the requirements and mechanisms for the appointment of a cybersecurity delegate by OIVs; and

• General Instruction No. 4, which sets forth the measures that OIVs must adopt to reduce the impact and spread of cybersecurity incidents.

Below, our Technology and Data Protection team has prepared a summary of the content of these General Instructions.

Read the full document here.