In the business world, information has become a valuable asset. Data consists of intangible assets: They have no physical form, but they have value; they can be stored, transmitted, processed, and analyzed, and based on them, we can make decisions that are critical to our companies.
Although the 2024 Act already established the requirement for its appointment, the new guidelines issued by the State Cybersecurity Agency (ACE) and published in the Official Gazette on August 11, 2026, elaborate on fundamental aspects of their operation, including their profile, requirements, appointment, certification, and powers. This represents the implementation of the data protection provisions set forth in the Personal Data Protection Act (LPDP).
In light of these new guidelines, the following questions arise: Who is subject to these obligations? Is my company subject to this new obligation? It's time to answer these questions: From the moment a company engages in data processing, which is understood to mean any operation or activity performed on personal data, from the time they are collected until they are disposed of. This provision is governed by Article 2 of the LPDP, which establishes its framework of application.
Any operation that collects, stores, or uses information that can identify an individual constitutes a processing of personal data. This includes actions such as collect, record, organize, store, access, use, modify, share, transfer, block, or delete information about a person. In the day-to-day operations of businesses, it recopila collects a customer's name, DUI, phone number, and email address, as well as employment or medical records, purchase histories, and contracts of any kind, and subsequently uses this information to provide a service or contact the customer. This is why it is essential to appoint a Data Protection Officer (DPO) in your companies or organizations.
Now that this point has been clarified, the following question arises: ¿What does a delegate do? The Data Protection Officer (DPO) oversees and guides an organization to ensure that the processing of personal data is carried out in accordance with the law, identifying risks, promoting protective measures, and serving as a liaison on data protection matters. And under the new guidelines, the DPO acts as a liaison between your organization and the ACE.
Who can be a delegate?
The Guidelines establish requirements regarding the delegate's profile, which are as follows:
A) Hold a college degree, preferably in legal studies.
B) Be at least 21 years old
C) Demonstrate professional or work experience in data protection, administrative procedures, regulatory compliance, risk management, information technology, information security, or cybersecurity.
D) Have no final, non-appealable criminal convictions.
E) Approve the «Personal Data Protection Officer Certification Program» to be implemented by the ACE
The appointment must be made by resolution of the organization’s highest authority and must be reported by the person in charge to the Agency’s Office of Personal Data Protection. The deadline for reporting this appointment is September 17 of this year; failure to report the appointment may result in a violation.
At Legal Spot, we are ready to help you comply with these new regulations and assist you in implementing data protection policies and procedures, assessing regulatory compliance, adapting internal processes, and providing guidance on the appointment and duties of the Data Protection Officer.
