On February 2, 2026, the Data Protection Authority (“DPA”) issued Resolution No. SPDP-SPD-2026-0005-R containing the General Regulation on Large-Scale Personal Data Processing (“Large-Scale Regulation”), with the aim of establishing guidelines and criteria for identifying large-scale personal data processing.
Below, we detail the most relevant aspects of the Large-Scale Regulation:
- Key concepts
The Large-Scale Standard defines the following terms:
- Geographic scope: territorial extent or impact of the processing. It is classified as:
- Local: processing carried out within a province, canton, or city.
- National: processing carried out in more than one province, canton, or city.
- Cross-border: processing carried out in a country, international organization, legal entity, or international economic territory.
- Global: processing carried out in more than one country, international organization, legal entity, or international economic territory.
- Frequency of treatment: regularity or continuity with which treatment activities are carried out, considering the repetition, accumulation, and continuity of the operation, which may be single, periodic, or continuous.
- Duration of processing: the period during which personal data is subject to processing activities. It is classified as follows:
- Occasional: processing is carried out on an exceptional, one-off, or sporadic
- Temporary: processing is carried out for a period of less than three (3) years.
- Extended: processing is carried out for a period of more than three (3) years.
- Data volume: total amount of personal data processed in each processing operation.
- Large-Scale Technical Model (“MTGE”)
The MTGE is a technical-legal instrument that allows the level of risk and magnitude of a given personal data processing activity to be assessed.
To calculate this, the MTGE takes the following variables into account:
- Number of personal data subjects:
- From 0 to 1,000 data subjects: 1 point.
- From 1,001 to 10,000 subjects: 2 points.
- From 10,001 to 100,000 data subjects: 3 points.
- More than 100,000 data subjects: 4 points.
- Volume of personal data:
- Up to 10 types of data: 0.5 points.
- Between 11 and 30 types of data: 1 point.
- Between 31 and 100 types of data: 2 points.
- More than 100 types of data: 3 points.
- Categories of personal data:
- One basic category of data: 0.5 points.
- One special category: 2 points.
- More than one special category: 3 points
- Frequency of personal data processing:
- Occasional: 0.5 points.
- Periodic or recurring: 1 point.
- Continuous or real-time: 2 points
- Duration of personal data processing:
- Occasional: 0.5 points.
- Temporary: 1 point.
- Prolonged: 2 points.
- Geographic scope:
- Local: 1 point.
- National: 2 points.
- Global or cross-border: 3 points.
The total MTGE score will be calculated by adding the values of the variables. If the result is equal to or greater than six (6) points, it will be considered a large-scale treatment.
- Direct qualification for Large-Scale Treatment (“Direct Qualification”)
Notwithstanding the calculation obtained through the MTGE, the DPA establishes that the following will be directly and mandatorily considered large-scale treatments:
- Processing of health data.
- Systematic and exhaustive evaluation of personal aspects of data subjects based on automated processing.
- Systematic surveillance or monitoring of data subjects in public access areas, carried out using video surveillance systems.
- Processing of biometric data.
- Geolocation activities.
- Structural processing of personal data within the framework of credit, financial, or economic risk assessment information systems.
- Systematic processing of data on children and adolescents, when carried out in institutional, educational, digital, or service provision environments aimed at these priority groups.
- Systematic transfers of personal data.
- Processing data in express or courier messaging services.
- Effects of the calculation obtained from the MTGE and the Direct Qualification.
The results of the MTGE and Direct Qualification cases are binding for:
- Determine the obligation to carry out impact assessments.
- Mandatory appointment of a Data Protection Officer (“DPO”).
- Incorporate processing operations into the Record of Processing Activities (“RoPA”).
- Activate enhanced measures of proactive accountability, security, and oversight.
If a controller or processor is required to appoint a DPO under the provisions of the Large-Scale Regulation, they will have ninety (90) days to make such an appointment and register it with the DPA.
Those who carry out large-scale data processing must include the following elements in their RoPA, in addition to the requirements set forth in Article 38 of the Regulations of the Data Protection Law: (i) a description of the processing; (ii) the frequency; and (iii) the duration of the processing.
Controllers or processors carrying out large-scale processing activities must undergo internal or external audits at least once every twelve (12) months, or when there are significant changes in nature, scope, purposes, technologies used, or level of risk identified. Each audit report must be retained for a minimum of five (5) years.
Furthermore, in the case of large-scale processing, controllers or processors must expressly identify such processing in their privacy policies and indicate its purposes, the categories of personal data processed, and the data subjects concerned.
