Sovereign Cloud in Latin America: Spending Set to Nearly Double in 2026

Sovereign cloud infrastructure-as-a-service (IaaS) spending in Latin America will rise from US$278 million in 2025 to US$506 million in 2026, and could reach US$946 million in 2027, according to Gartner's February 2026 forecast. By GAITECX's calculation, that is an 82% increase in 2026 and 87% in 2027, even though the region will remain only about 0.6% of the US$80 billion Gartner expects worldwide. For the board, the consequence is direct: local supply is taking shape now, and the terms you negotiate today will shape your contracts for years.

Where the money is going

Who is buying sovereign cloud

Gartner identifies governments as the main buyers, followed by regulated industries and critical infrastructure, and attributes part of the increase to geopolitical tensions. This is a global finding: Gartner does not publish a Latin American breakdown by industry or country. Even so, in GAITECX’s reading, that profile matches the sectors that concentrate sensitive data in the region: banking, energy, healthcare and telecommunications.

Two figures from the same Gartner forecast change the budget conversation. The push toward “geopatriation” would move 20% of current workloads from global providers to local ones. And 80% of sovereign spending will come from new solutions or from legacy systems that have not yet migrated. The sovereignty decision is made before migrating, not after.

Why companies buy: security ahead of migration

The buying motive is shifting. The IDC Latin America IT Investment Trends 2026 survey, covering 507 organizations and reported by El Tiempo, ranks information and cloud security as the top strategic information technology (IT) initiative, at 37%, followed by generative AI (30.8%). In Mexico, according to the same survey as picked up by Yahoo Noticias, cloud platforms and infrastructure modernization slip behind those two priorities.

These are IDC figures known through press coverage, so they should be checked against the full report. GAITECX's reading: cloud is increasingly justified by compliance and security, and less by the migration project itself.

Where regulation tightens

Without a common regional framework, sovereignty stops being only a question of where the data center sits. It becomes a contract clause, and each country drafts it at its own pace.

Brazil. Under the General Data Protection Law (LGPD) and Resolution CD/ANPD 19/2024, the deadline to incorporate the standard clauses of the National Data Protection Authority (ANPD) expired on August 23, 2025. Since then, if an international transfer relies on contractual clauses, only the ANPD's clauses or specific clauses approved by the authority are valid. Among other things, those clauses require notifying data subjects and the ANPD within 3 business days of detecting a security incident.

Chile. Law 21.719 was published on December 13, 2024, and its legal effective date remains set for December 1, 2026, according to Carey. On September 1, 2026, the Government submitted a bill to postpone it by one year and to expand the Agency's Council from 3 to 5 members (bulletin 18.623-07).

On November 5, 2026, the Chamber's Constitution Committee approved in general the postponement of the effective date to October 15, 2027. The bill is still moving through Congress and is not yet law. In that session, the undersecretary cited a survey of 127 obligated organizations in which 72% did not consider themselves prepared for the original date.

The sensitive point for cloud is transfers. Under the new law, data may only leave the country for jurisdictions with an adequate level of protection or with safeguards such as standard clauses or certifications, according to an analysis by XMS Latam. A 2025 resolution from the Ministry of Economy had already warned that the Agency might not be able to regulate some of those mechanisms in time.

Mexico. The new Federal Law on the Protection of Personal Data Held by Private Parties has been in force since March 21, 2025. It dissolved the National Institute for Transparency, Access to Information and Personal Data Protection (INAI) and transferred its functions to the Ministry of Anti-Corruption and Good Governance, which reports to the Executive. The law removed the express obligation to disclose transfers in the privacy notice, but the implementing regulations keep it, and the authority's rulings can be challenged through amparo.

The situation by country:

Country	Rule and authority	Status as of November 2026	Effect on provider selection
Brazil	LGPD and Resolution CD/ANPD 19/2024	Standard clauses mandatory since August 23, 2025	If data leaves the country, the contract must include the standard clauses and incident notice within 3 business days.
Chile	Law 21.719 and the future Data Protection Agency	Legal effective date: December 1, 2026. Postponement pending in Congress.	Uncertainty over dates and transfer mechanisms. Favor adjustable contracts.
Mexico	New federal law and the Ministry of Anti-Corruption and Good Governance	In force since March 21, 2025. INAI dissolved.	The regulatory counterpart changes. Review privacy notices and transfers under the implementing regulations.

What buyers are looking for

Technology committees in the region do not buy the “sovereign” label. They buy evidence of control. These are the capabilities to demand and the questions to put to each provider, global or local:

Capability	Question for the provider
Data location	Where do the data and its backups reside, and can you guarantee it by contract?
Key control	Who manages the encryption keys: your company or the provider?
Support	From which countries is support delivered, and who accesses the systems?
Government requests	How do you respond to requests from foreign authorities, and how will you tell us?
Country compliance	Does the contract include the ANPD standard clauses, and how do you meet the 3-business-day incident notice?
Exit	How quickly, and in what format, will our data be returned if we change providers?

In GAITECX's view, the usual objection will be cost. Combining a global provider with a local one can lower regulatory risk, but it adds integration, operations and teams to manage. It is also GAITECX's reading that local supply, because it starts from such a small base, still shows uneven catalogs and operational maturity across providers.

To bring the topic to the board with a concrete proposal:

Map data flows and contracts by country within 60 days. Owners: the CIO (chief information officer), the DPO (data protection officer) and the legal team. Confirm the ANPD clauses in Brazil, and do not freeze the Chilean program: until the postponement becomes law, the legal date is December 1, 2026.
Classify workloads by sensitivity before approving new migrations. Owners: the CIO and the CISO (chief information security officer). Define what must stay in-country or under local control.
Quantify the cost of a mixed portfolio. Owners: the CFO (chief financial officer) and the CIO. Compare the regulatory risk avoided with the added operating cost.

What this means for providers

For vendors, integrators and cloud operators, the commercial window lies in workloads that have not yet moved. If 80% of sovereign spending comes from new solutions or unmigrated systems, the sale is won at the design stage, not at renewal.

Rene Buest, a Gartner analyst, argues that large providers must address each country's sovereignty requirements to compete for local customers. In Latin America, that means three moves:

Offer sovereignty as an auditable package: data location, key control, local support and documented exit rights. Buyers need proof they can show their regulator.
Prepare contracts that are ready by jurisdiction: ANPD standard clauses for Brazil, an adjustable regime for Chile's transition, and a transfer review aligned with Mexico's implementing regulations.
Focus the offering on government, regulated industries and critical infrastructure, the segments Gartner identifies as the main buyers.

There is a nuance for commercial messaging. If security is the top IT priority in the region according to the IDC survey, sovereignty sells better as part of a security and compliance proposal than as a standalone infrastructure product. Providers that reduce the customer's legal workload will have a stronger argument than those competing on price alone.

Signals to watch

Over the next 6 to 12 months, these indicators will show whether the trend is consolidating:

Chile's postponement law: the final text, the effective date that results and the appointment of the Agency's Council.
Chilean rules on international transfers: which mechanisms the Agency enables and when.
ANPD decisions in Brazil: recognition of equivalent clauses from other countries or adequacy determinations.
The criteria of Mexico's new authority on transfers and privacy notices.
Delivery against Gartner's forecast: whether the region approaches US$946 million in 2027 or growth moderates.

The GAITECX view

At GAITECX, we see that data sovereignty is no longer a technical debate but a contract and board decision. The advantage will go to companies that decide where their data lives and who controls the keys before their next migration, not after. That is why this topic is part of our Digital Transformation track, where the region’s CIOs, CISOs and legal leaders compare how they are choosing providers.