Law 21.719 - What Must Companies in Chile Do Before December 1, 2026?

Chile has a new Personal Data Protection Law. Law N° 21.719, published in the Official Gazette on December 13, 2024, replaces the old Law N° 19.628 of 1999, until now one of the most outdated data protection regulations in the region, and will enter into force on December 1, 2026, after a period of legal vacancy of 24 months. For companies operating in Chile, that date is not just another administrative procedure, but marks the shift from a regime with practically nonexistent enforcement to one with a specialized agency, real sanctioning powers, and fines that can reach a percentage of the company's annual revenue.

With only three months left before its entry into force, it is advisable that companies, especially those that process data of clients, workers, or suppliers, understand what changes and what they must implement before that date.

What the new law creates

Law 21.719 creates the Agency for the Protection of Personal Data (APDP), a new public body with powers to oversee compliance with the regulation, instruct companies, and apply administrative sanctions. This replaces the previous scheme, in which enforcement of Law 19.628 fell, in a limited and partial way, to the Council for Transparency, without a dedicated authority or a deterrent sanctioning regime.

Together with the new institutional framework, the law modernizes the core concepts of data protection law in Chile, aligning itself, although with its own nuances, with standards such as the European Union's General Data Protection Regulation (GDPR); stricter lawful bases, new rights for data subjects, and specific documentation obligations for those who process that data.

Lawful bases for processing

Under the new law, processing personal data requires having an enabling lawful basis. Among those the law provides for are:

• The consent of the data subject, which must be free, informed, specific as to its purpose, prior, and unambiguous.
• Compliance with a legal obligation.
• The performance of a contract or the adoption of pre-contractual measures requested by the data subject.
• The legitimate interest of the controller.
• The exercise or defense of rights before courts or public bodies.

Legitimate interest deserves special attention, because unlike consent it is not enough to simply invoke it. The company must be able to demonstrate an analysis that weighs the purpose pursued, the necessity of the processing, its impact on data subjects, and the safeguards adopted. In practice, this means that legitimate interest cannot be used as a catch-all; it requires prior documentation that supports its validity.

New rights and deadlines for data subjects

The law strengthens the traditional ARCO rights (access, rectification, cancellation, and objection) and adds the right to data portability. Companies must respond to these requests within 30 calendar days from their submission, a period extendable once for up to 30 additional calendar days.

A mechanism for the temporary blocking of data is also provided for certain requests, with a period of 2 business days. The data subject may file a complaint with the Agency within the 30 business days following the request if not satisfied with the response.

This requires companies to have, before December 2026, a formal and traceable channel to receive and process these requests; it is not enough to respond "in good faith" by email with no record or deadline tracking.

Operational obligations for companies

Beyond the principles, the law imposes specific compliance burdens:

1. Record of Processing Activities (RAT): a documented inventory of what data is processed, for what purpose, under what lawful basis, and with what security measures.

2. Impact assessment: required for high-risk processing for the rights of data subjects, such as the large-scale use of sensitive data or the systematic evaluation of individuals.

3. Data Protection Officer: the law provides for this figure, although its designation is not automatically mandatory for every company; it depends on the volume, nature, and risk of the processing it carries out. Even so, it is advisable that every organization formally define who responds to the Agency and to data subjects, whether or not the strict obligation to appoint a Data Protection Officer exists.

4. Contracts with data processors: external providers that process data on behalf of the company (payroll services, marketing, cloud storage, etc.) must be subject to agreements that regulate that processing.

5. Notification of security breaches: in the event of an incident that compromises personal data, the company must notify the Agency without undue delay and by the most expeditious means possible. The law does not set a fixed deadline in hours, unlike the European GDPR, but it requires being able to demonstrate that there was no unjustified delay. When the breach involves sensitive data, information of minors under 14 years of age, or economic-financial data, affected data subjects must also be informed directly.

Enforcement and penalties

The sanctioning regime is the most deterrent change compared to Law 19.628. Violations are classified as minor (fine of up to 5,000 UTM), serious (up to 10,000 UTM), and very serious (up to 20,000 UTM), and in cases of repeat serious or very serious violations the fine can be calculated as a percentage between 2% and 4% of the company's annual revenue in Chile. The Agency can also impose corrective measures and, in the most serious cases, temporary suspensions of up to 30 days. Violations expire after 4 years, and sanctions already applied, after 3 years from when the ruling becomes final.

A relevant point for small and medium-sized companies is that during the first 12 months the law is in force (that is, until approximately December 2027), the Agency has the authority to apply a written warning instead of fines for certain violations, which in practice operates as a more flexible adaptation period for SMEs. This does not exempt them from compliance, but it does moderate the immediate sanctioning risk for those adapting in good faith.

A necessary warning

It is advisable to be clear about the current state of this matter. Law 21.719 has not yet entered into force and the Agency for the Protection of Personal Data is not yet operating with full enforcement powers, so as of today there is no consolidated administrative or judicial case law interpreting its provisions. Any analysis of its practical application is, for now, preventive and doctrinal in nature, and should be treated with that caution.

What a company should do today

With barely three months left for the entry into force, the margin to adapt calmly has already narrowed considerably. A realistic compliance plan, in this timeframe, should prioritize at least the following steps (i) building a real inventory of the data processing carried out by the company (the input for the RAT), (ii) reviewing under what lawful basis each one rests, (iii) updating or generating the contracts with providers that act as data processors, and (iv) formally defining an internal privacy officer, whether or not they hold the status of Data Protection Officer required by law. Postponing this work beyond these three months leaves the company exposed right when the Agency begins to actively enforce.