Is personal data protection the same as cybersecurity?
The two are often confused —partly because the words protection and security sound so close— but they are different concepts, with different goals, even if they are deeply related.
Today, most information is created, stored and moved around in digital environments. Email, websites, databases, cloud systems and artificial intelligence process large volumes of data around the clock. In that setting, the biggest threats are no longer on paper or in physical formats, they are in the digital world. That is why talking about data protection today necessarily means talking about cybersecurity too.
Cybersecurity, then, is about safeguarding information of any kind —financial, technical, personal, strategic or operational— against digital threats. It is a mainly technical and organizational approach, centered on systems, networks, platforms, processes and controls. Cybersecurity works to prevent cyberattacks, unauthorized access, malware, ransomware and failures that could disrupt services or compromise the confidentiality and integrity of information.
The broader concept of information security does cover cybersecurity, but cybersecurity has taken on particular weight: digital environments are now central, the risks that come with them keep growing, and regulatory requirements in this area have increased.
On the other hand, personal data protection focuses on protecting people, not just data. It seeks to make sure there is clarity about what personal data is used for, that it is used lawfully and transparently, and that people can exercise their rights: granting or withdrawing consent, objecting to certain uses, accessing their information or finding out what is being done with it.
Can data protection exist without cybersecurity?
Simple answer: No.
In fact, Law 21.719 on personal data protection expressly sets out the obligation to adopt appropriate security measures. Because when personal data is exposed by security failures, the consequences are not only technical, they are human: fraud, identity theft, financial losses, reputational damage or harm to the private lives of the people involved.
In that sense, cybersecurity is an essential enabler of privacy.
That is why Chile now has two key regulatory pillars:
Law 21.719 (in force from December 2026), which protects people's rights against the misuse of their personal data.
The Ley Marco de Ciberseguridad (already in force), which works to strengthen the security of digital systems and services, manage risks and respond to incidents.
The two laws complement each other: the first defines what has to be protected and why, and the second how to protect it in a digital environment that keeps getting more complex and riskier.
In a diagram[1], it could be represented like this:
It is not just compliance, it is building trust
Today, “having security” is no longer enough.
And “complying with the law” is not enough on its own either.
You have to do both well, and do them in a coordinated way. Because when security protects the data and data protection protects people, the result is not just compliance or risk prevention: it is a relationship of trust between people and the organizations that access their data.
In short, cybersecurity looks after information; data protection looks after the people behind it. Understanding that difference —and how the two fit together— is key in Chile's current regulatory landscape.---Note: Original idea by SOYIO, improved with AI[1] Source: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
