A Bogotá litigator defending a European pharmaceutical company in Colombian proceedings receives a discovery-equivalent request for documents from opposing counsel. The requested materials include clinical trial data held by the parent company in Germany. Complying fully would violate the EU's GDPR. Refusing outright may result in adverse evidentiary inferences under Colombian procedure. Navigating this conflict is now a standard competency for Latin American litigators in cross-border matters.
Data privacy law has become a central competency for commercial litigators across Latin America. Where cases involve multinational parties, foreign-held evidence, or cross-border discovery, privacy law interacts with procedural obligations in ways that require deliberate planning — not last-minute improvisation.
LGPD — Lei Geral de Proteção de Dados (Brazil, Law 13,709/2018). Brazil's comprehensive data protection law, modelled partly on the EU's GDPR. Applies to any processing of personal data of individuals located in Brazil, regardless of where the processing entity is established.
Ley 1581 — Colombia's Personal Data Protection Law (2012), supplemented by Decree 1074/2015 and subsequent DIAN and SIC regulations. Requires registration of databases and valid legal basis for processing.
The Four Key Data Privacy Regimes Affecting LatAm Cross-Border Litigation
Litigators handling cross-border matters in Latin America must be familiar with at least four overlapping privacy regimes:
- Brazil (LGPD) — Modelled on GDPR, with the ANPD as enforcement authority. Extraterritorial in scope. Allows cross-border data transfers only where the destination country provides "adequate" protection or the firm implements SCCs, binding corporate rules, or other ANPD-approved safeguards.
- Colombia (Ley 1581 + SIC) — Requires express registration of personal data databases with the SIC (Superintendencia de Industria y Comercio). Transfers abroad require authorisation or the existence of equivalent protection in the receiving country. SIC enforcement has intensified since 2022.
- Argentina (Ley 25,326) — A 2000-era law currently under reform. Argentina holds EU adequacy status, making it the only Latin American country with an approved level of data protection from the EU's perspective. A modernisation bill incorporating GDPR-aligned concepts is expected to pass in 2026.
- GDPR (EU) — Applies to any Latin American entity processing personal data of EU residents, including as part of cross-border litigation involving EU parties or evidence. The GDPR's restrictions on "transfers to third countries" apply to evidence transmissions from EU-based parties to Latin American litigation venues.
The Litigation Discovery Problem: When Evidence Production Violates Privacy Law
Latin American procedural systems do not have US-style broad discovery. However, international arbitration, foreign court letters rogatory, and increasing regional commercial court cooperation create situations where broad evidence production requests arrive in jurisdictions with strong privacy protections.
When a Colombian court receives a letter rogatory from a US federal court seeking corporate documents held in Colombia, Colombian procedural law in principle requires compliance. But if those documents contain personal data subject to Ley 1581, compliance requires a valid legal basis under the privacy regime. "Judicial or legal obligation" is a recognised legal basis under both Ley 1581 and the LGPD—but the producing party must be able to demonstrate that the disclosure was limited to what was strictly necessary (data minimisation) and that appropriate notice was given to data subjects where feasible.
In cross-border arbitration under ICDR, ICC, or LCIA rules, parties increasingly include data privacy protocols in the procedural order governing the proceeding. These protocols specify: which privacy law governs document production, how personal data will be redacted or anonymised, and what technical safeguards (secure data rooms, access controls) apply during the arbitration.
GDPR Interaction with LatAm Litigation: Practical Scenarios
Three practical scenarios arise most frequently in LatAm cross-border practice:
Scenario 1: EU parent company evidence in LatAm proceedings. The EU company holds documents relevant to Brazilian or Colombian proceedings. Producing those documents to the Latin American court (or opposing counsel) constitutes a data transfer from the EU to a third country. Under GDPR Article 49, production under a legally binding judicial order constitutes a derogation permitting the transfer — but it must be strictly necessary, limited in scope, and the company should attempt to notify the supervisory authority of the transfer where feasible.
Scenario 2: Brazilian subsidiary evidence in EU proceedings. A Brazilian subsidiary must provide documents to EU-based proceedings. The LGPD permits transfers to the EU (as it has implemented GDPR-aligned standards) under an adequacy or contractual framework. However, the Brazilian subsidiary should document the legal basis for the transfer (judicial obligation) and implement data minimisation before transmission.
Scenario 3: Cross-border enforcement of data subject access rights during litigation. An individual data subject asserts rights under LGPD or GDPR during litigation — demanding deletion or restriction of data that forms part of the evidentiary record. Both regimes recognise that where processing is necessary for establishment, exercise, or defence of legal claims, data subject rights can be limited. Document this analysis and maintain it in the litigation file.
Building Data Privacy Compliance Into Your LatAm Litigation Workflow
The following steps should be standard practice for any cross-border commercial litigation involving Latin American jurisdictions:
- Identify applicable privacy regimes at case intake — Note the nationality and location of all parties and data subjects, and the jurisdictions where evidence is held. Map which privacy laws apply.
- Assess legal basis for evidence collection and production — Confirm that the "judicial or legal obligation" basis applies under each applicable law, and document this analysis in writing.
- Implement data minimisation — Before any evidence production, redact irrelevant personal data. Production should be limited to data that is strictly necessary for the proceedings.
- Propose a privacy protocol in arbitration — For ICC, LCIA, or ICDR proceedings, propose inclusion of a data privacy annex in the procedural order from the first case management conference.
- Advise client on cross-border transfer safeguards — Where GDPR applies to the EU side, confirm whether SCCs or a transfer impact assessment is needed to support the transfer.
Frequently Asked Questions
Can a court order override LGPD or GDPR restrictions on cross-border data transfer?
Yes, within limits. Both the LGPD and GDPR permit disclosure where it is required by a legally binding court order and where disclosure is strictly necessary for compliance. The producing party should document the legal obligation, limit disclosure to data that is strictly necessary, and notify the relevant supervisory authority where required.
Is Argentina's data protection law compatible with GDPR?
Argentina is the only Latin American country with EU adequacy status under GDPR, meaning personal data can flow from the EU to Argentina without additional transfer safeguards. Argentina's current Ley 25,326 dates from 2000; modernisation legislation bringing it closer to GDPR standards is pending in 2026.
How should a LatAm litigator handle a GDPR-restricted document in cross-border proceedings?
First, confirm the legal basis for production (judicial obligation derogation under GDPR Art. 49). Apply strict data minimisation — redact personal data not directly relevant to the proceedings. If producing to a jurisdiction without EU adequacy, document the transfer and consider whether a transfer impact assessment is required. In arbitration, propose a privacy protocol in the procedural order.
This article is published by an independent research publication for informational purposes only and does not represent or claim affiliation with any government body, bar association, or official authority.