Regulatory Compliance
Regulatory compliance in one place:
ISO 27001, Law 21.663 and data protection
One team for the international standard, US's Cybersecurity Framework Law and both USan personal data laws.
In under two years, compliance went from a nice-to-have to a legal obligation with real penalties for USan companies. Law 21.663 created the ANCI and set fines of up to 40,000 UTM. Law 21.719 replaces the older Law 19.628 and introduces a Data Protection Agency with sanctioning powers. Meanwhile, more and more public tenders require ISO 27001 as an entry condition. All three rest on the same foundation — security governance, risk management, access control and incident response — which is why they are better solved by one team than by three providers that never speak to each other.
- ISO/IEC 27001:2022 implementation and certification across the 93 Annex A controls
- Law 21.663 compliance: classification, incident reporting and ANCI readiness
- Law 21.719 and Law 19.628 alignment: data inventory, legal basis and data subject rights
- External CISO and DPO for the formal roles both laws require
- A roadmap prioritised by real risk, not a generic checklist of controls
- Year-on-year maintenance so compliance does not lapse at the next audit
What is included
in your compliance programme with Consúltame
Gap analysis
We measure where you stand against the 93 ISO/IEC 27001:2022 controls and against the laws that apply to you. The output is a concrete map, not a generic assessment.
An ISMS built for you
We build the Information Security Management System with policies, procedures and controls proportional to your company's real size and risk.
Certification and upkeep
We take you through the certification body's audit and stay on for annual maintenance, which is where most certifications are lost.
Law 21.663 and the ANCI
We determine whether you qualify as an Operator of Vital Importance, set up incident reporting within legal deadlines and the evidence trail behind every notice.
Personal data protection
Records of processing activities, legal basis per purpose, data subject rights procedures and breach protocols for Law 21.719 and Law 19.628.
CISO and DPO as a service
Both laws require a formal officer. We take on the cybersecurity delegate and data protection officer roles, without the cost of two full-time hires.
One team, not three vendors
The standard and both laws share the same governance, risk and control foundation. Solving them separately means paying three times for the same discovery work and ending up with documents that contradict each other.
Prioritised by real risk
We do not hand you a list of 93 controls to sort out yourself. We define what to close first based on your industry, your exposure and the tender or client in front of you right now.
Compliance is a cycle
Certifying once is worthless if nobody maintains the records the following year. We stay on for maintenance so the surveillance audit never catches you off guard.
All three obligations arrived together. They are best solved together.
Law 21.663 is already in force and the ANCI has begun enforcing it. Law 21.719 replaces Law 19.628 and introduces, for the first time, an agency empowered to sanction the mishandling of personal data. In parallel, more and more tenders demand ISO 27001 as an entry requirement. For a mid-sized company, tackling all three separately means tripling the effort over the same information. Consúltame maps your processes, risks and data once, and builds from there what each obligation needs: the ISMS for the standard, the evidence for the ANCI and the processing record for the data agency.
Do not wait for the first inspection to find out where you stand.
Free compliance diagnosis.
We review your position against ISO 27001, Law 21.663 and personal data regulation, and hand you a prioritised roadmap. No cost, no commitment.