Key concepts for understanding Law 21.719 on personal data protection
The starting point for moving forward with clarity
Working in privacy and data protection, we always run into the same problem at the outset:
concepts get mixed up, and each team uses the same words to mean different things.
Before you talk about assessments, consent or risk, you need something more basic: a shared language.
This was one of the first things we learned while building Soyio.
That's why, within Soyio | Aprendizajes, we start here.
The glossary below brings together the essential concepts with their formal definition and the source of the information, so that legal, technology, business and other teams can speak the same language from the start.
Essential foundations: privacy, security, cybersecurity and data
Data
A representation of facts, quantities, measurements or descriptions of reality: a symbol or decontextualized fragment that becomes information once it is interpreted.
Privacy
The sphere of private life that a person has the right to protect from any intrusion.
Information security
Protecting information by ensuring its Confidentiality, Integrity and Availability (CIA) through an Information Security Management System (ISMS): a structured framework of people, processes and technology used to manage security risks, adapt to threats and meet legal requirements, all under a continuous improvement approach.
Cybersecurity
Preserving the confidentiality and integrity of information and the availability and resilience of networks and computer systems, in order to protect people, society, organizations or nations from cybersecurity incidents.
Anonymization
An irreversible procedure after which a piece of personal data can no longer be linked or associated with a specific person, nor allow that person to be identified, because the link to the information that connects, associates or identifies them has been destroyed or deleted. Anonymized data is no longer personal data.
Pseudonymization
Processing personal data in such a way that it can no longer be attributed to a data subject without using additional information, provided that this additional information is kept separately and is subject to technical and organizational measures designed to ensure that the personal data is not attributed to an identified or identifiable natural person.
Data taxonomy
A structured classification scheme that organizes data into hierarchical categories and subcategories, so it can be identified, managed, used and understood consistently across the organization.
Personal data protection laws
The body of rules that govern how personal data must be processed so that people's privacy and freedoms are safeguarded, limiting the collection, use, access and disclosure of that data to what is strictly necessary and with appropriate security safeguards.
Essential legal concepts
Personal data
Any information linked to or referring to an identified or identifiable natural person. A person is considered identifiable when their identity can be determined, directly or indirectly, in particular through one or more identifiers such as their name, their national ID number, or the analysis of elements specific to their physical, physiological, genetic, psychological, economic, cultural or social identity.
Sensitive personal data
Personal data referring to a person's physical or moral characteristics, or to facts or circumstances of their private life or intimacy, that reveal ethnic or racial origin, political, union or trade association membership, socioeconomic status, ideological or philosophical convictions, religious beliefs, data on health or on the human biological profile, biometric data, and information about the sex life, sexual orientation and gender identity of a natural person.
Special category personal data
Personal data subject to distinct compliance standards under the law. This includes: data on children and adolescents; data used for historical, statistical, scientific, study or research purposes; geolocation data; and data used for financial, banking or commercial obligations.
Data subject
An identified or identifiable natural person whom the personal data concerns or refers to.
Data processing
Any operation, set of operations or technical procedure, automated or not, that in any way makes it possible to collect, process, store, disclose, transmit or use personal data or sets of personal data.
Data controller
Any natural or legal person, public or private, who decides on the purposes and means of processing personal data, regardless of whether they process the data directly or through a third-party agent or data processor.
Third-party agent or data processor
The natural or legal person who processes personal data on behalf of the data controller.
Lawful basis, legal basis or basis of legitimacy
The cases in which processing personal data is lawful. Law 21.719 considers the processing of personal data lawful when there is consent from the data subject, unless one of the other lawful bases set out in the law applies: processing necessary to fulfill a legal obligation; processing necessary to enter into a contract or take pre-contractual steps; processing where a legitimate interest can be demonstrated; processing for the exercise of a right before courts or public bodies; or data relating to obligations of an economic, financial, banking or commercial nature (in accordance with Title III)
Purpose
The specific ends for which personal data is collected.
Consent
Any freely given, specific, unambiguous and informed expression of will, given through a statement or a clear affirmative action, by which the data subject, their legal representative or their agent, as applicable, authorizes the processing of the personal data that concerns them.
Legitimate interest
A legal basis that allows data to be processed without consent when the controller has a valid and necessary interest and that interest does NOT infringe the data subject's rights.
Data Protection Agency
A decentralized public body with its own legal personality, which will be responsible for enforcing, regulating and sanctioning the processing of personal data in Chile.
GDPR or RGPD
The General Data Protection Regulation (GDPR) is the European Union's data privacy and security law, which sets the rules for how personal data must be processed. It strengthens people's rights and harmonizes data protection law across the EU.
Adequate country
A country outside Chile that the Agency has declared to guarantee an adequate level of data protection.
Assignment of personal data
The transfer of personal data by the data controller to another controller.
Disclosure of data
When the data controller makes personal data known, in any way, to people other than the data subject the data concerns, without going as far as assigning or transferring it.
Data retention periods
The period during which an organization may keep personal data, strictly limited to the time needed to fulfill the purpose of the processing or to meet a legal duty. Once that period is over, the data must be deleted or anonymized.
Registro Nacional de Sanciones y Cumplimiento (National Registry of Sanctions and Compliance)
A public national registry administered by the Agency that records certified prevention models, the data controllers that have adopted them, and the sanctions imposed on data controllers that have broken the law.
Data subject rights
Right of access
The data subject's right to ask the controller for, and obtain, confirmation of whether that controller is processing their personal data, access to it where it is, and the information provided for in this law.
Right to rectification
The data subject's right to ask the controller for, and obtain, the modification or completion of their personal data when the controller is processing it and it is inaccurate, out of date or incomplete.
Right to erasure
The data subject's right to ask the controller for, and obtain, the erasure or deletion of their personal data, on the grounds set out in the law.
Right to object
The data subject's right to ask the controller for, and obtain, that a given processing operation not be carried out, on the grounds set out in the law.
Right to personal data portability
The data subject's right to ask the controller for, and obtain, a copy of their personal data in a structured, generic and commonly used electronic format that different systems can work with, and to be able to disclose or transfer it to another data controller. The data subject has the right to have their personal data transmitted directly from one controller to another where this is technically possible.
Right to blocking
The right to request the temporary suspension of any processing operation on one's personal data when a rectification, erasure or objection request has been filed, for as long as that request remains unresolved.
Human review
The right of data subjects, in the case of decisions based on the automated processing of personal data, to ask the controller for an explanation, for human intervention, to express their point of view and to request a review of the decision.
Exercising rights
A request or claim submitted in writing, by form or by electronic means, through which a data subject can ask a data controller to exercise the rights recognized in the Law (Access, Rectification, Erasure, Objection, Portability and Blocking).
Rights management
The set of policies, procedures and technical and organizational measures that let an organization receive, process, answer and document data subject requests to exercise the rights over their personal data. That process must be effective, timely, transparent and in line with current regulations.
Among other things, it should cover:
Having one or more channels available for submitting requests
Verifying the identity of the requester
Analyzing whether the request meets the legal requirements
Carrying out the right that was requested
Answering within the legal deadlines
Recording evidence of the process
Evidence, traceability and audit
Privacy evidence
Records (documents, logs, reports) that serve as proof that privacy processes are running as planned and that legal requirements and internal policies are being met.
Traceability
The ability to reconstruct the history of access to, use of and changes to personal data over time.
Audit
A formal inspection and verification to check whether a standard or set of guidelines is being followed, whether records are accurate, or whether efficiency and effectiveness targets are being met.
Information security and cybersecurity
Access control
Mechanisms that ensure only authorized people can access data or systems, according to defined roles and permissions.
Multi-factor authentication (MFA)
An authentication method that requires two or more independent factors to verify a user's identity. For example, a password and a code sent to their phone.
Data encryption
A cryptographic technique that transforms information so that it can only be understood by those who hold the corresponding key.
Backup
A copy of files and programs kept to make recovery easier when it is needed.
Security incident
An event that actually or potentially jeopardizes the confidentiality, integrity or availability of an information system, or of the information the system processes, stores or transmits, or that constitutes a violation or imminent threat of violation of security policies, security procedures or acceptable use policies.
Breach of security measures
The loss of control, compromise, unauthorized disclosure, unauthorized acquisition or any similar event in which: a person other than an authorized user accesses or could access personally identifiable information; or an authorized user accesses personally identifiable information for a purpose other than the authorized one.
Technical and organizational security measures
Protective measures prescribed to meet the security requirements (that is, confidentiality, integrity and availability) specified for an information system. Safeguards may include security features, management restrictions, personnel security, and the security of physical structures, areas and devices.
Confidentiality
The ability to protect data so that unauthorized third parties cannot access it.
Integrity
Protection against the improper modification or destruction of information, which includes ensuring non-repudiation and the authenticity of the information.
Availability
Ensuring timely and reliable access to and use of information.
Resilience
The ability to prepare for and adapt to changing conditions, and to withstand and recover quickly from disruptions. Resilience includes the ability to withstand and recover from deliberate attacks, accidents, or natural threats or incidents.
Biometrics and identity
Biometrics
Specific technical processing that makes it possible to identify a person from unique physical, physiological or behavioral characteristics.
Digital identity
The set of electronic attributes that make it possible to identify a person in digital environments.
Identity validation
The process of verifying that a person is who they say they are before granting access or completing a procedure.
Electronic signatures
Simple electronic signature
Any kind of sound, symbol or electronic process that lets the recipient of an electronic document identify its author, at least formally.
Advanced electronic signature
A signature certified by an accredited provider and created using means that the signatory keeps under their exclusive control, so that it is linked solely to them and to the data it refers to. It allows any later modification to be detected, verifies the signatory's identity, and prevents them from denying the integrity of the document or its authorship.
Governance, maturity and organizational measures
RAT (record of processing activities)
A document that records and describes the personal data processing activities carried out by a controller or processor, including purposes, categories of data, categories of data subjects, categories of recipients, whether there are international transfers and to which country, retention periods and security measures.
Data governance
An organizational structure that supports the management of a company's data. It is made up of the set of standards, policies and processes that ensure an organization's data is correct, reliable, secure and useful.
EIPD (Evaluación de Impacto en Protección de datos), or DPIA in English
A systematic process for identifying, assessing and mitigating the risks that a personal data processing activity may create for data subjects' rights.
Privacy maturity
The level of development and effectiveness with which an organization implements personal data protection practices, controls and culture on an ongoing basis.
Privacy by design and by default
The data controller's obligation to apply appropriate technical and organizational measures from the design stage, both before and during the processing of personal data, in order to comply with the principles and with data subjects' rights.
Privacy risk
The likelihood that people will experience problems as a result of data processing, and the impact of those problems if they occur.
Privacy policy
A document that transparently tells data subjects how their personal data is collected, used, shared and protected.
---
Sources:RAE: https://dle.rae.es/privacidad
DAMA: https://dama.org/
Law 21.719 on personal data protection https://www.bcn.cl/leychile/navegar?idNorma=1209272
Law 21.663, Cybersecurity Framework https://www.bcn.cl/leychile/navegar?idNorma=1202434
Law 19.799 https://www.bcn.cl/leychile/navegar?idNorma=196640
ISO 27001 https://www.iso.org/es/norma/27001
ISO 27701 https://www.iso.org/standard/27701
OECD https://www.oecd.org/en/topics/privacy-and-data-protection.html
European Commission https://commission.europa.eu/law/law-topic/data-protection_en
ISACA https://www.isaca.org/
NIST https://csrc.nist.gov/glossary
