🇨🇱 New legislation amending Law 19.628 from December 2026.
Law 21.719: Personal Data
Protection
Chile is aligning with international privacy standards such as the European GDPR. Learn about the new obligations your organization must meet.
KEY DATES AND FIGURESDec 2026Entry into force 5Data subject rights 20,000 UTMVery serious violation NewSupervisory authority
Implementation timeline
Key dates your organization needs to know to prepare properly.
Law No. 19.628
Chile's first legal framework for personal data protection.
Constitutional Reform
Data protection as a constitutional right (Art. 19 No. 4).
Publication of Law 21.719
New law published in the Official Gazette.
In progress
Transition Period
24 months to implement compliance measures.
What your organization should be doing nowEntry into Force
The law takes full effect with active enforcement.
SMEs will have one additional yearActive Enforcement
Fines of up to 20,000 UTM for the most serious violations.
Data Processing Principles
To protect personal data when it is collected or used, Law 21.719 establishes key principles that organizations must follow when processing personal data.
Lawfulness and fairness
Process data only with the data subject's consent or where the law permits. The controller must be able to prove this.
Purpose
Data may only be used for the specific purposes for which it was collected.
Proportionality
Process only data that is necessary, adequate, and relevant to the purpose.
Quality
Data must be accurate, complete, and up to date.
Security
Technical and organizational measures to protect data from unauthorized access.
Confidentiality
Anyone processing personal data must take steps to keep it confidential.
Accountability
Comply with the law and be able to demonstrate compliance to the authority.
Transparency and information
Give data subjects the information they need to exercise their rights.
ARSOP Rights
The 5 rights your organization must be ready to uphold.
ARSOP
Access
Know which data is processed, for what purpose, and how it was obtained.
Rectification
Correct inaccurate, incomplete, or outdated data.
Erasure
Request deletion of data where applicable.
Objection
Ask for a particular use of your data to stop.
Portability
Receive data in a structured format and transfer it to another controller.
Organizations must respond within 30 calendar days, with an extension of another 30 calendar days in justified cases.
Alongside a request for rectification, erasure, or objection, data subjects may request temporary restriction of processing. The organization must respond within 2 business days.
Controller Obligations
Article 14 of Law 21.719 sets out the specific obligations of personal data controllers.
Disclose processing policies
Inform data subjects about data processing policies and make them available.
Lawful sources and legal basis
Obtain data from lawful sources and process it under a justified legal basis.
Follow the law's principles
Process data according to the principles in Article 3.
Complete, up-to-date data
Keep data accurate, complete, and up to date.
Delete or anonymize
Delete or anonymize data when it is no longer necessary for the purpose.
Secrecy and confidentiality
Keep processed data confidential, even after the relationship with the data subject ends.
Security and breach notification
Adopt security measures and report breaches affecting personal data to the Agency.
Privacy by design
Incorporate data protection into the design of processes, products, and services.
Demonstrate compliance
Demonstrate compliance with the law to the authority (accountability principle).
Penalties
The Personal Data Protection Agency will have the power to impose significant fines based on the seriousness of violations.
Minor violations such as failing to update privacy policies.
Processing without valid consent or failing to implement appropriate security measures.
Mass data exposure, obstructing the Agency, or repeated noncompliance.
* The annual revenue percentage applies only to companies that are not SMEs
UTM (Monthly Tax Unit) = CLP $69,542 (December 2025)
Maximum fine: up to approximately CLP $1,390,840,000Personal Data Protection Agency
An independent body responsible for protecting the rights that safeguard people's private lives and personal data.
Supervision
Oversees organizations' compliance with data protection regulations.
Enforcement
Imposes fines and penalties for violations of the law.
Complaint resolution
Resolves data subjects' complaints when organizations fail to respond to their requests.
Rulemaking
Issues instructions and general rules for applying the law.
National Register of Penalties and Compliance
A public register listing sanctioned organizations and those adopting certified infringement prevention models.
Protected Data
Within personal data, the law identifies categories with distinct compliance requirements. These are:
Personal Data
Any information linked to or associated with an identified or identifiable natural person.
First nameLast nameRUTAddressIPEmail addressPhone numberPassport photoAnd more...
Sensitive Data
Data concerning physical or moral characteristics, facts, or circumstances of private life.
Ethnic originPolitical affiliationSexual orientation
Biometric Data
Data obtained through specific technical processing of physical, physiological, or behavioral characteristics.
FingerprintFacial recognitionIris scan
Geolocation Data
Data relating to a person's geographical location at a given time.
GPS locationLocation historyCell tower data
Financial Data
Information about a person's economic and financial situation.
Banking dataCredit historyIncome
Children's and adolescents' data
The law defines children as those under fourteen, and adolescents as those over fourteen and under eighteen.
Data for historical, statistical, and research purposes
For this category, the purposes must serve a public interest.
Is your company ready for Law 21.719?
At Soyio, we help you meet all the obligations of the new data protection law. Our platform automates compliance processes so you can focus on your business.
- Processing activity documentation and risk management
- Consent process implementation
- Automated ARSOP rights management
- Continuous compliance monitoring
Subscribe to our newsletter
Privacy is making headlines
A weekly roundup of privacy, regulation, and technology news that could affect your business.
Subscribe (LinkedIn, opens in a new tab)