Mendoza approves cybersecurity law

Mendoza’s Chamber of Deputies gave final approval in the week of August 31 to September 4, 2026, to an executive-branch bill that creates a comprehensive framework to prevent, manage, and respond to cybersecurity incidents. According to the legislature’s official summary, the law is intended to protect personal data, maintain the continuity of digital public services, and safeguard provincial critical infrastructure.

What changes with the new Mendoza law?

The law creates a Cybersecurity Strategic Steering Committee as the enforcement authority, adds a Provincial Cybersecurity Incident Registry, and sets minimum security standards for agencies and vendors. It also establishes a progressive sanctions regime for those who conceal relevant incidents.

Local media reported that the registry will remain restricted when disclosure could compromise security. The law also adds a data governance framework, as the province seeks to organize its institutional response to events affecting digital systems and services.

What other provinces and countries are moving on data and AI frameworks?

Paraguay, Argentina, Peru, Mexico, Brazil, and Bolivia are also seeing legislative progress or debates on data protection, cybersecurity, and artificial intelligence, while in Chile there is still uncertainty over an extension that has not been approved and should not be treated as in force.

In Paraguay, Law No. 7,593/2025 was enacted and published on November 27, 2025, creating the National Personal Data Protection Agency within the Ministry of Information and Communication Technologies. In Argentina, the AAIP submitted a bill to Congress to update Law 25,326, and a separate debate is also moving forward on changes to the Criminal Code to address cybercrime and digital privacy.

In Peru, Congress approved Bill 2775/2022-CR, the first law whose central goal is to promote the use of artificial intelligence. Hiperderecho said the text entered in August, received favorable opinions from two committees, went through a substitute version and a final amendment, and was approved by an almost unanimous vote. La República added that the new law sets staggered compliance deadlines, with September 10, 2026, as the first milestone for six priority sectors.

In Mexico, the Senate received draft measures seeking to punish the AI generation of intimate content without consent and strengthen protections for children and teenagers against cyberbullying, digital violence, and the misuse of personal data on platforms and apps. Excélsior reported that the proposal includes prison terms for those who share sexually explicit images or videos created with AI, and also requires the Ministry of the Interior to issue classification guidelines for content and digital stores to disclose the classification of video games and applications.

Brazil showed two parallel developments. On September 3, 2026, the Chamber’s Commission on Science, Technology and Innovation introduced a substitute for PL 6,706/2025, which proposes extending to AI systems the data protection and processing rules in Article 11 of the Internet Civil Framework. The legislative record describes the idea as preventive algorithmic auditing, although the transcribed text focuses on applying those rules. In the Senate, PL 1828/2023 is still moving, with its status marked as awaiting action since September 1, 2026, and it sets rules for facial recognition and biometric identification in public agencies and operators of essential services.

Bolivia, meanwhile, approved in the Senate the proposed Access to Information Law backed by Soledad Chapetón. The bill now moves to the Chamber of Deputies and allows access to be restricted when information has been classified as reserved, secret, or confidential, although requests can still be made verbally or in writing to the custodian entity. In Chile, several compliance reports warn that companies should still prepare around the December 1, 2026 date, because bulletin 18,623-07 was not approved and assuming an extension already exists could leave teams out of compliance if Congress does not vote in time.