A deadline up in the air

In Chile, almost every company that was preparing for the new data protection law had the same date marked on the calendar, December 1, 2026. Since October 28, that date has been in doubt. On that day the Senate approved, in the first constitutional stage, the bill that sets the entry into force of the law for October 15, 2027.

The news can be read in two ways. The first is as a relief, ten and a half more months to calmly do what was behind schedule. The second, riskier, is as a sign that the subject can wait. Companies that choose the second will reach October 2027 in the same situation they are in today, but with less time and with an Agency better prepared to enforce.

What the Senate approved

The bill originated in a presidential message of August 31, 2026, which proposed delaying the entry into force until December 1, 2027. In the Senate's Constitution Committee the date was brought forward to October 15, 2027.

Besides the date, the bill modifies the Personal Data Protection Agency, the body that will oversee compliance with the law and sanction infringements. Its governing board would go from three to five councillors, with six-year terms, without the possibility of being appointed again, and would be partially renewed every two years. The first councillors would be proposed by the President of the Republic in a single act, two for six years, two for four and one for two years, so that renewal is staggered, and they would need the approval of two thirds of the senators in office. The period to propose them would be extended from six to nine months before the entry into force, but if less than twelve months remain before that date when the law is published, as will happen with any publication after October 15, 2026, the President would have ten days from publication to make the proposal.

The bill does not modify the obligations that Law 21.719 imposes on companies or its sanctions regime.

Three possible scenarios

If the Chamber approves the bill without changes and the law is published before December 1, the new date becomes firm. Law 21.719 would enter into force on October 15, 2027 and the President would have ten days from publication to propose to the Senate the names of the Agency's councillors.

If the Chamber introduces changes, the bill returns to the Senate for a third stage, and the time available before December 1 shrinks. Until that process ends, the legal date remains the original one.

If the bill is not published before December 1, Law 21.719 enters into force on that day, even though the Agency that must oversee it is not yet operating. A postponement law published after that date would have to suspend a rule that is already in force, which opens a legal discussion that nobody should want to have with their own compliance as the thing being tested.

What does not change

While Law 21.719 is not in force, Law 19.628, on the protection of private life, continues to apply. It is a weaker law and has no specialized oversight body, but it still requires, among other things, that the processing of personal data have a legal basis or the authorization of the data subject, and it still allows people to bring claims before the courts.

What is already happening in the market does not change either. In our experience, large companies are including data protection clauses in their contracts with suppliers and asking for compliance records before hiring. For a software provider, an external accountant, a debt collection company or a call center, the question will not wait until October 2027.

Some complementary rules are already published, such as Decreto Supremo N° 662, of 2025, of the Ministry of Finance, which regulates infringement prevention models and was published in the Diario Oficial (the Official Gazette) on September 9, 2026. Its certification does not operate yet because the Agency is not functioning, but nothing prevents implementing the model from now on.

How to use the time

The work that Law 21.719 requires is the same with either date. First, the company has to know what personal data it processes, from whom, for what purpose and on what legal basis. Then it is advisable to review the contracts with the suppliers that access that data. After that, information security must be put in order, a channel must be set up for people to exercise their rights and someone responsible for privacy must be designated within the company. Finally, everything must be documented, since when the Agency inspects it will ask for records before explanations.

What changes between the two dates is the quality of the work. With a December 1 deadline, the work is done in a rush. With an October 2027 deadline, it can be done in a reasonable order, with a budget and without interrupting operations.

What we still do not know

Will the Chamber vote before December 1? Will it keep October 15, 2027 or go back to the date in the presidential message? When will the Agency's councillors be appointed and when will it actually begin to oversee? None of those answers changes what a company has to do, but all of them change the pace at which it is advisable to do it. We will update this analysis as the bill advances.

Ten and a half months is enough time to comply well. It is also enough time to forget about the subject until it is too late.