Chile's Data Protection Law: What Law 21,719 Requires and How to Prepare Your Company
Chile's new data protection law (Law 21,719) completely changes how Chilean companies may collect, use, store, and share information about customers, employees, and suppliers, and it does so with an enforcement and penalty regime that did not exist until now. The law rewrites almost all of the former Law 19,628, which is renamed the Personal Data Protection Law. It also creates a Personal Data Protection Agency (Agencia de Protección de Datos Personales) with power to impose sanctions, and sets fines that can exceed CLP 1.4 billion per violation. In this article, we explain what the law requires, how its procedures and penalties work, and why it pays to prepare your company with legal counsel before the law takes effect. You can read the official text (in Spanish) at leychile.cl.
1. When does Chile's new personal data law take effect?
Under its first transitory article, Law 21,719, published on December 13, 2024, takes effect on December 1, 2026. That is still the legal effective date today.
However, on September 1, 2026, the Government submitted Bill No. 18.623-07 to the Senate. The bill would postpone the effective date to December 1, 2027, and expand the Agency's board from three to five members. On October 19, 2026, the Senate Constitution Committee approved the bill in general by a unanimous vote, and the Executive announced it would raise the bill's urgency to "immediate discussion." Even so, the bill is still in its first legislative stage. Lawmakers are debating whether the postponement should be total or phased in, and opposition senators have argued it should not exceed six months. Until that bill is passed and published, the date does not change.
The background is that the Agency has not yet been set up. In May 2026, the Senate rejected the Government's nominees for the Agency's board because they did not obtain the required two-thirds of sitting senators, and the board has still not been formed. With or without a postponement, the message for companies is the same: getting compliant takes months, and the work should start now. If your company needs to update its corporate governance for this change, visit our corporate law practice area.
2. Who does Law 21,719 apply to?
The law covers every individual or legal entity that processes personal data, including government agencies (Art. 1). It makes no distinction by company size: a small business with a customer spreadsheet or a payroll list is already processing personal data. The only exclusion is processing by individuals for purely personal activities.
The law also has extraterritorial reach (Art. 1 bis). It applies to foreign companies that offer goods or services to people in Chile or that monitor their behavior, for example through profiling or online tracking.
The categories that call for the most care are:
Sensitive data: health, human biological profile, biometric data (fingerprints, iris, facial features, voice), ethnic or racial origin, political, union, or trade association membership, socioeconomic status, ideological or philosophical beliefs, religious beliefs, sex life, sexual orientation, and gender identity (Art. 2(g)). As a general rule, processing requires express consent (Art. 16).
Data of children and adolescents: may only be processed in the child's best interest and with respect for their evolving autonomy. Data of children under 14 requires the consent of their parents or legal guardians, and the same applies to sensitive data of adolescents under 16 (Art. 16 quater).
Geolocation data (Art. 16 sexies) and automated decision-making or profiling, which data subjects may object to and for which they may demand human review (Art. 8 bis).
3. Your company's new obligations
The law moves from a regime of good intentions to one of demonstrable accountability: complying is not enough; you must be able to prove it. The core obligations are:
A lawful basis for each processing activity: prior, freely given, informed, specific, and unambiguous consent (Art. 12), or one of the other grounds in Art. 13 (performance of a contract, a legal obligation, legitimate interest, or the exercise or defense of rights before courts or public bodies, among others). The company must be able to prove it.
Duty of notice and transparency (Art. 14 ter): a published privacy policy covering purposes, recipients, retention periods, and a channel for exercising rights.
Data protection by design and by default (Art. 14 quater).
Security measures appropriate to the risk (Art. 14 quinquies) and a duty to report security breaches to the Agency through the fastest available means and without undue delay whenever there is a reasonable risk to data subjects. If a breach involves sensitive data, data of children under 14, or data on economic, financial, banking, or commercial obligations, the affected individuals must also be notified (Art. 14 sexies).
Contracts with service providers that process data on the company's behalf (Art. 15 bis), with mandatory minimum terms.
Data protection impact assessments before high-risk processing, such as large-scale processing, profiling, or sensitive data (Art. 15 ter).
International data transfers only to countries with adequate protection or under safeguards such as contractual clauses (Arts. 27 and 28), which directly affects the use of cloud services.
4. Data subject rights and response deadlines
Individuals may exercise the rights of access, rectification, erasure, objection, portability, and blocking of their data (Art. 4). The company must provide simple, prompt mechanisms to receive these requests. Rectification, erasure, and objection are always free of charge, and access must be free at least once every quarter (Art. 10).
Once a request is received, the company has 30 calendar days to respond, which may be extended only once for up to another 30 days (Art. 11). If the request is denied, the response must state the reasons and inform the data subject that they may file a complaint with the Agency within 30 business days. Responding late or incompletely is already a minor violation, and obstructing these rights is a serious violation. In addition, if the data subject asks for their data to be temporarily blocked while the request is pending, the company must answer within just two business days.
5. Proceedings before the Agency and the courts
The Personal Data Protection Agency will have authority to audit companies, issue administrative interpretations of the law, adopt binding instructions and general rules, and impose sanctions (Art. 30 bis). There are two administrative proceedings:
Rights protection proceeding (Art. 41): begins with a complaint the data subject files within 30 business days. The company has 30 calendar days, which may be extended, to respond, and a 10-business-day evidentiary period may be opened. The proceeding may not last more than six months.
Sanctions proceeding (Art. 42): initiated by the Agency on its own motion or at the request of a party (for example, following a data subject's complaint). The Agency issues formal charges, and the company has only 15 business days to file its defense and submit evidence. This proceeding may not exceed six months either.
The Agency's decisions may be challenged through a claim of illegality before the Court of Appeals (in Santiago or where the claimant is domiciled) within 15 business days (Art. 43). Once the Agency's decision upholding the data subject's complaint becomes final, or once the court judgment becomes final if a claim of illegality was filed, affected individuals may sue for compensation for economic and non-economic damages in summary proceedings (Art. 47). These are short, technical deadlines where legal representation makes the difference; learn about our dispute resolution practice area.
6. Violations, fines, and sanctions: what your company risks
Violations are classified as minor, serious, or very serious (Arts. 34 to 34 quater). Using the October 2026 value of the UTM, Chile's Monthly Tax Unit (CLP 72,151), the maximum fines are (Art. 35):
Minor (for example, failing to publish a privacy policy or responding late): a written warning or a fine of up to 5,000 UTM (≈ CLP 361 million).
Serious (processing data without a lawful basis, breaching security duties, failing to respond to blocking requests): up to 10,000 UTM (≈ CLP 722 million).
Very serious (fraudulent processing, deliberately failing to report a breach, knowingly disclosing sensitive data, failing to carry out a required impact assessment): up to 20,000 UTM (≈ CLP 1.443 billion).
On top of this, for repeat offenders (two or more sanctions within 30 months), the fine may be tripled, and for companies that are not small or medium-sized and that repeat serious or very serious violations, it may reach 2% or 4% of their annual revenue from their line of business (Arts. 35 and 36). If the causes are not corrected within 60 days, a 50% surcharge applies. Repeated very serious violations within 24 months allow the Agency to suspend data processing operations for up to 30 days (Art. 38), and every sanction is recorded for five years in the public National Registry of Sanctions and Compliance (Art. 39).
Smaller companies get temporary relief: during the first 12 months after the law takes effect, the Agency may issue a written warning instead of a fine (sixth transitory article). The postponement bill proposes extending this relief to all companies. Employee data is also covered, so it is a good idea to review employment contracts and internal work rules with our labor and employment law practice area.
7. Why hire lawyers to comply with Chile's data protection law
Complying with Law 21,719 is not just a technology issue. Many decisions are legal by nature and require legal judgment:
Gap assessment: identifying what data the company processes, on what lawful basis, and what risks it faces.
Drafting privacy policies and notices, consent forms, and protocols for responding to data subjects.
Contract review with suppliers, customers, cloud platforms, and group companies.
Compliance program (Art. 49), with a data protection officer, certified by the Agency (Art. 51) under the regulation published on September 9, 2026. Although the program is voluntary, every company must take steps to prevent violations (Art. 48), and having a certified program is an express mitigating factor in any sanction (Art. 36).
Defense in Agency proceedings, claims of illegality, and damages lawsuits.
Experience with the European GDPR shows that companies that treat compliance as a box-checking exercise end up paying twice: in fines and in lost trust. Corporate clients are also already requiring their suppliers to demonstrate compliance as a condition of doing business.
Key takeaways
Under its current text, Law 21,719 takes effect on December 1, 2026. A bill to postpone it to 2027, approved in general by the Senate Constitution Committee, has not yet become law.
It applies to every company that processes personal data in Chile, regardless of size, and even to foreign companies.
It imposes duties of transparency, security, breach reporting, service provider contracts, and impact assessments.
Fines reach 20,000 UTM and, for repeat offenders, 4% of annual revenue, in addition to suspension of operations and a public registry of sanctions.
A certified compliance program mitigates liability and is the best tool for demonstrating compliance.
Frequently asked questions
When does Chile's personal data protection law take effect?
Under its current text, on December 1, 2026. The Government has proposed postponing it to December 1, 2027 (Bill No. 18.623-07), and the bill has already been approved in general by the Senate Constitution Committee. But until Congress passes it and it is published as law, the legal effective date does not change.
Does my small business also have to comply with Law 21,719?
Yes. The law does not exempt anyone based on size. What changes is the practical standard: the Agency will set different requirements according to company size (Art. 14 septies), and during the first year it may issue warnings instead of fines to small and medium-sized companies.
How much can a fine for violating the law cost?
Up to 5,000, 10,000, or 20,000 UTM, depending on whether the violation is minor, serious, or very serious. At October 2026 values, that is roughly CLP 361 million, CLP 722 million, and CLP 1.443 billion. For repeat offenders, the fine may be tripled and, for companies that are not small or medium-sized, may reach 2% or 4% of annual revenue.
Is it mandatory to appoint a data protection officer?
No. The law says the company "may" appoint one (Art. 50), and in small and medium-sized companies the owner or top management may take on the role. However, a data protection officer is a required element of a compliance program, and having a program certified by the Agency counts as a mitigating factor and shows diligence to clients and regulators.
What should I do if my company suffers a data breach?
You must report it to the Agency through the fastest available means and without undue delay, and keep a record of the incident. If it involves sensitive data, data of children under 14, or data on economic, financial, banking, or commercial obligations, you must also notify the affected individuals. Deliberately failing to make that notification is a very serious violation.
How Varela Abogados can help
At Varela Abogados, we advise companies on assessment, implementation, and defense in personal data protection matters, combining corporate, employment, and litigation expertise. Schedule a meeting at varelaabogados.cl and get your company ready before the Agency starts enforcing the law.
This article is for informational purposes only and does not constitute legal advice.
Comments