On 5 February, Law No. 21,806 was published in the Official Gazette, bringing forward the start-up of the new Personal Data Protection Agency (the “Agency”).

When will it start operating?

The Agency’s members must be appointed six months before the entry into force of the new personal data protection law, i.e., no later than 1 June 2026.

What will its functions be during this period?

During this period, the Agency will focus on interpreting the provisions of the new personal data regulations, issuing instructions and general rules for their practical application, and developing outreach programmes and actions to raise public awareness of personal data protection.

It is expected that during this period the Agency will issue guidance on, among others, the following matters:

• Parameters and mechanisms to determine the costs arising from the exercise of the rights of access and portability more than once per quarter by a data subject.
• Template contract models to govern the processing of personal data by processors or other service providers acting under mandate.
• An indicative list of the types of processing operations that do or do not require a data protection impact assessment.
• Template contractual clauses and other legal instruments for international data transfers.

The Agency’s instructions will enable data controllers and processors to align their operations with the new framework before 1 December 2026, the date on which the Agency is expected to begin actively supervising and enforcing compliance.