GRC and AI Governance Jobs in Argentina

By F. Jay Hall, Founder and Publisher, GRC Careers · Updated November 9, 2026 · Leer en español

Are there GRC jobs in Argentina?

Yes. When we checked on November 9, 2026, GRC Careers listed four open roles in Argentina from two employers, and three of them were remote. All four sit where personal data meets money. Three are fraud roles and one is in compliance:

• Sezzle: Fraud & Risk Operations Team Lead, remote
• Sezzle: Fraud Data Analyst, remote
• Sezzle: Fraud Operations Analyst (Argentina)
• OKX: Senior Compliance Analyst, remote

Each listing links to the employer's own application page, and all four were open there on the same day. Argentina roles also appear in our international GRC jobs list, next to other global openings, and in remote GRC jobs. Risk jobs and compliance jobs carry more seats like these, and a job alert will send new ones to you.

What law protects personal data in Argentina?

Ley 25.326, the Personal Data Protection Law of 2000. The Agencia de Acceso a la Información Pública (AAIP) enforces it, and since 2003 the European Union has treated Argentina as a country that protects personal data adequately.

• InfoLEG, Ley 25.326, updated text: sanctioned on October 4, 2000 and partially promulgated on October 30, 2000; it covers personal data in public files and in private databases that exist to provide reports.
• Constitution, Article 43 (1994 reform): any person can find out what data about them sits in public registers or in private databases that provide reports, and demand that false or discriminatory data be deleted, corrected, kept confidential or updated.
• Ley 25.326, Article 33: names that court action hábeas data.
• Ley 25.326, Article 2: personal data is information about people "físicas o de existencia ideal", which takes in companies and other legal persons.
• GDPR, Article 4(1): the EU definition covers natural persons only, so the two laws part ways on the first definition.
• Ley 25.326, Article 12: transfers of personal data to countries that do not protect it adequately are barred.

Who enforces Argentina's data protection law?

The AAIP. The same agency handles access to public information, and it has started on AI.

• Ley 27.275, Article 19, as replaced by Decreto 746/2017 (Boletín Oficial, September 26, 2017): the agency is to "actuar como Autoridad de Aplicación de la Ley de Protección de Datos Personales N° 25.326".
• Ley 27.275 (sanctioned September 14, 2016): created the agency inside the Chief of Cabinet's office, with functional autonomy.
• AAIP, September 27, 2024: a preliminary guide for public and private entities on transparency and personal data protection for responsible AI, open for comment until October 30, 2024.

Anyone after AI governance jobs in Argentina should start with that guide and with Ley 25.326.

Why does the EU's adequacy decision matter for jobs?

Because personal data can move from the EU to Argentina without the standard contractual clauses or other safeguards that a transfer to a country with no adequacy decision needs. My read is that this makes Argentine teams an easier choice for European work.

• GDPR, Articles 45 and 46: a transfer covered by an adequacy decision needs no specific authorization; without one, it needs safeguards such as standard contractual clauses.
• Commission Decision 2003/490/EC, Article 1 (June 30, 2003): Argentina "is regarded as providing an adequate level of protection for personal data transferred from the Community".
• GDPR, Article 45(9): decisions like this stay in force until the Commission amends, replaces or repeals them.
• European Commission, COM(2024) 7, section 4.2 (January 15, 2024): "Argentina continues to provide an adequate level of protection". The report also pointed to the draft data protection bill then before Congress as a chance to write protections into law.
• European Commission adequacy list: its South American entries are Argentina (2003), Uruguay (2012, Decision 2012/484/EU) and Brazil (2026, Decision (EU) 2026/179), so Argentina's is the oldest.
• EU AI Act, Article 2(1)(c): the AI Act applies to providers and deployers outside the EU "where the output produced by the AI system is used in the Union".

The candidates who get these seats can put Ley 25.326 and the GDPR side by side and say where they differ.

What should you be ready to answer in an interview?

A good practice question: a client in Germany wants to send customer records to your team in Buenos Aires and asks you what that takes. A strong answer does four things:

• names the EU adequacy decision for Argentina and the review that kept it;
• says the decision covers the transfer, while the client's other GDPR duties stay with the client;
• notes that the Buenos Aires team handles the data under Argentina's own data protection law, with the AAIP as the authority;
• asks where the data goes next, because Argentine law bars transfers to countries that do not protect personal data adequately.

How does Argentina connect to Brazil and Germany?

Through the same EU decisions: personal data from Germany and the rest of the EU can go to Argentina under the 2003 decision and to Brazil under the 2026 one. The three countries share a stadium story as well. The FA's match report records that Germany beat Argentina 1-0 after extra time in the World Cup final at the Maracanã in Rio de Janeiro on July 13, 2014. I watched that final at a friend's apartment in Buenos Aires, where I lived for four years. Two years later, World of Volley reported, Brazil beat Argentina 3-1 in the men's volleyball quarterfinal of the Rio 2016 Olympics, at the Maracanãzinho arena, also in Rio.