Argentina Adopts Regional Model Clauses for Cross-Border Data
Argentina’s adoption of Ibero-American model clauses gives organisations another standard route for protecting personal data sent to jurisdictions without an adequate level of protection.
Argentina’s Agency for Access to Public Information issued Resolution No. 198/2023 on 13 October 2023. Published on 18 October, it approved model contractual clauses and an implementation guide developed by the Ibero-American Data Protection Network.
Argentina already had contractual models for international transfers. The new resolution adds regionally developed alternatives for controller-to-controller and controller-to-processor relationships and supports greater alignment across Ibero-America.
Start with the destination
Argentine law generally restricts transfers of personal data to countries or international bodies that do not provide an adequate level of protection. The regulator maintains a list of destinations it considers adequate.
The first control is therefore a current map of where data goes. “Global cloud” is not a destination. The inventory should identify the recipient, country, purpose, data categories, onward transfers and parties’ roles.
Where the destination is not adequate and no statutory exception applies, the exporter needs safeguards. Approved model clauses provide one of the most practical mechanisms.
Choose the correct relationship
The Ibero-American models address two common structures:
- a controller transfers data to another controller that determines its own purposes and means; or
- a controller transfers data to a processor acting on documented instructions.
Confusing those relationships creates unreliable obligations. A recipient that reuses data for product development, advertising or its own compliance purposes may be acting as a controller for those activities even if the commercial contract calls it a processor.
Teams should map actual decision-making before selecting the module. The label should follow the processing, not the procurement template.
The annexes are where the transfer becomes real
Standard clauses do not eliminate the need to describe the transaction. The parties must complete the details of the exporter, importer, categories of data and people, purposes, frequency, retention and security measures.
Vague annexes such as “customer data for business purposes” weaken the evidence that the parties understood and limited the transfer. The description should be specific enough for a security team, regulator and affected individual to understand the flow.
The models also give individuals enforceable protections as third-party beneficiaries. Contract management should therefore ensure that operational teams can comply with restrictions, rights requests, security and deletion obligations—not merely that signatures were collected.
Non-standard language may require regulatory review
Argentina also allows organisations to use contracts that differ from approved models, but those arrangements may need to be submitted to the authority within the applicable period so their safeguards can be assessed.
This makes uncontrolled negotiation risky. A sales team should not remove or contradict transfer protections to close a deal without privacy review. A clause library should identify which text is mandatory, which fields must be completed and which changes trigger escalation.
One contract does not cover the supply chain automatically
An exporter should identify onward transfers and subprocessors. If the first importer sends the data to another country, the protection needs to continue through that next relationship.
Cloud architecture and contract architecture should match. A data-flow diagram showing backup, support and analytics locations is often the fastest way to discover recipients missing from the legal register.
A practical transfer review
- Inventory Argentina-origin data flows and destination countries.
- Check the regulator’s current adequacy list.
- Identify controller and processor roles by actual behaviour.
- Select and complete the appropriate approved model.
- Describe data, purposes, retention, security and onward transfers precisely.
- Prevent conflicting terms elsewhere in the commercial agreement.
- Track subprocessors and changes in hosting location.
- Retain executed versions and link them to the processing record.
Argentina’s resolution is part of a regional movement toward usable, interoperable transfer tools. The benefit comes only when standard legal text is connected to an accurate description of the technology and the parties that operate it.
Official sources
This article provides general information and is not legal advice.
Continue the series: LATAM Cyber & Digital Law Series index
