On 1 December 2020, the Banking (2409)/Financial (798) Regulation, which includes an updated compilation of standards, was adopted. Article 5 of Chapter 20-7 states that services may only be outsourced to countries that have an investment grade country rating and whose legislation complies with appropriate international standards for the protection and security of personal data. However, the administrative council or the body acting in its stead may grant a reasoned exemption from the requirement of an investment grade country risk rating, provided that the country to which the services are outsourced has adequate laws for the protection and security of personal data. In addition, Chapter IV sets out requirements for services provided abroad, including a data centre in Chile. [CPTPP provision 14.13.2]
Original source