If your agency is taking an event to Latin America, attendee data is governed by the law of the country where you collect it, and if you are established in Europe, by the GDPR as well. The map changed in 2026: the European Commission now lists Brazil among the countries with an adequacy decision, alongside Argentina and Uruguay, so a registration list can move there from the EU without extra contracts. Chile has a new law whose start date is being debated, and Mexico has had a new authority since 2025. The practical rule is the same everywhere: collect only what the door needs, say what it is for, and keep registration separate from everything else.
Which law applies to event data?
It sounds like a question for lawyers, but it comes down to two facts: where the data is collected and from where it is managed. A registration form for a conference in Santiago collects data in Chile, so Chilean law applies. If the agency running it is based in London, Madrid or Milan, data protection rules at home still apply to the agency itself.
An international event usually has three players with different roles:
- Controller: the brand or agency that decides what the data is used for. It owns the list.
- Processor: whoever runs registration and the door on the controller’s behalf, such as the accreditation provider. It uses the data for that purpose only.
- Third parties: sponsors, exhibitors, the hotel. They only receive data if the attendee agreed.
That split has to be written into the contract before registration opens. We cover the basics of how we handle the list in our note on attendee data and privacy.
This guide is for information only and does not replace legal advice in each country.
Country by country: what changed and what to check
- Argentina. It has held an EU adequacy decision since 2003, which the Commission reviewed and kept in its report of 15 January 2024 along with ten other jurisdictions, according to Hunton, which lists both Argentina and Uruguay.
- Uruguay. Also on the Commission’s official list and in that same 2024 review.
- Brazil. The LGPD applies. On 27 January 2026 the EU and Brazil announced mutual adequacy: the Commission’s decision for Brazil and ANPD Resolution 32/2026 for the EU, with a review after four years, according to Mayer Brown. The firm notes the decision is not an automatic compliance seal: the rest of the LGPD and the GDPR still has to be met.
- Chile. Law 21.719 replaces the old regime and creates a Data Protection Agency. It is due to take effect on 1 December 2026, but on 28 October the Senate voted 33 to 6 to postpone it to 15 October 2027, and the bill moved to the Chamber of Deputies, according to La Tercera. If your event in Chile is in 2027, plan it under the new law anyway.
- Mexico. The new federal law on personal data held by private parties was published on 20 March 2025 and took effect the next day. Oversight moved to the Ministry of Anti-Corruption and Good Governance, and the privacy notice must be available from the moment data is collected, according to Garrigues.
How to move the registration list between countries
Many agencies build registration on their own platform and then hand the list to the local team. That hand-over is an international transfer, and it has rules.
From the EU to a country with adequacy (Argentina, Uruguay, Brazil), data can flow without any further safeguard, in the Commission’s own words. To a country without adequacy, such as Chile or Mexico, you need another GDPR mechanism; the most common one is the standard contractual clauses, the model contracts the Commission issued on 4 June 2021.
What to settle before anything moves:
- What travels. For accreditation, name, company, email and guest type are enough. An ID number only if the venue or security requires it.
- Where the list lives. One platform with role-based access beats spreadsheets going back and forth by email.
- Who sees what. The door team needs to look up a name and print a badge, not download the whole list.
- When it is deleted. Set a retention period in the contract and stick to it.
Trade shows: badge scanning and exhibitors
Trade shows add a layer, because besides the organiser there are exhibitors who want the contacts of everyone who visited their stand. The rule is to separate purposes: entering the show is one thing, receiving emails from an exhibitor is another. The form needs that second option on its own, unticked.
The cleanest approach is for exhibitors to scan the badge at their stand, with a visible notice, instead of receiving the full list. Each contact then carries its own consent, and the organiser does not hand out data it has no business sharing.
Biometric data calls for extra care. The GDPR treats it as a special category in Article 9 and requires explicit consent for specified purposes; Brazil’s LGPD defines it as sensitive data and asks for “specific and highlighted” consent. If you plan to use facial recognition at the door, always offer a QR alternative.
How we handle it when the event is in another country
Two published cases show both ends. At FILGUA 2025, the Guatemala International Book Fair, we ran access control for 90,000 visitors over 13 days remotely from Buenos Aires, with a local team we hired and trained. In that set-up, deciding who sees which data from each country is part of the planning, not a final formality.
At Databricks Live Argentina 2026, the company ran a prize draw during the day: the list that was downloaded included only the people who had already entered plus same-day registrations, nothing else. Using only the slice of the list each task needs is the same logic the region’s laws ask for.
If you are an agency or brand from abroad planning an event in Argentina, Chile, Uruguay, Brazil or Mexico, we work with local partners across the region and set up registration and the door under these rules from day one. See how our strategic partnerships work, or ask for a proposal for event access control and accreditation.