South America: compliance context

Regional regulatory landscape

South American requirements are country-specific and evolving. Brazil's LGPD is a common anchor, while local privacy, financial, consumer, and critical-infrastructure rules may change the operating model.

7 relevant framework guides across 5 coverage categories.

Mandatory regulations

These requirements apply only when their legal, sector, entity, activity, data, or contract scope is met.

• LGPD for processing connected to Brazil
• Country-specific privacy and breach laws
• Sector and contractual requirements for finance, telecoms, and public services

Voluntary standards and contractual assurance

These frameworks can support a consistent control baseline but do not replace mandatory legal duties.

• ISO 27001
• SOC 2
• PCI DSS
• ISO 42001
• NIST CSF

Implementation priorities

1. Identify country, data, and service exposure
2. Translate local rights and legal bases into operational workflows
3. Track processor, transfer, retention, and incident evidence
4. Provide Portuguese or local-language accountability records where appropriate

Frameworks to explore

Information Security

• ISO 27001
• CSA STAR
• InfoSec Governance

Data Privacy

• LGPD

Financial & Critical Infrastructure

• PCI DSS

AI Governance

• ISO 42001

Business Continuity & Automotive

• ISO 22301

AssureCore workflows

Manage your controls and evidence together in a workspace.

• Start your workspace
• Compare workspace plans
• Browse all framework guides

Official regional references

• Brazil ANPD

Keep exploring

Framework coverage is educational and does not determine legal obligations. Confirm scope with qualified professionals and the relevant authority.