Prepare for Chile's Law 21.719 with controls you already run

Law 21.719 is Chile's new personal data protection law. It amends Law 19.628 on the Protection of Private Life, which dated from 1999, and turns it into a modern regime with processing principles, legal bases, data subject rights, security and breach reporting duties, international transfer rules and administrative fines. It also creates the Personal Data Protection Agency to supervise and enforce the law.

The amendments take effect on the first day of the 24th month after publication, which is 1 December 2026, as the law was published on 13 December 2024. In September 2026 the government sent a bill to Congress (Boletín 18.623-07) proposing to move the date to 1 December 2027. Until any change is approved and published, 1 December 2026 remains the legal date.

Any public or private controller established in Chile that processes personal data must comply. The law also reaches controllers outside Chile when they offer goods or services to people in Chile, whether paid or not, or monitor their behaviour in Chile, including analysis, tracking or profiling. Processors acting on a controller's behalf are bound through Article 15 bis.

Article 35 sets fines of up to 5,000 UTM (or a written warning) for minor infringements, up to 10,000 UTM for serious infringements and up to 20,000 UTM for very serious ones. Repeat offences can be fined up to three times the amount. For companies that are not small businesses, repeat serious or very serious infringements can reach 2% or 4% of annual revenue respectively.

Yes. Article 14 sexies requires the controller to report security breaches to the Agency by the fastest means possible and without undue delay when there is a reasonable risk to individuals' rights and freedoms. Breaches involving sensitive data, data about children under 14, or financial and commercial data must also be communicated to the affected individuals, and all breaches must be recorded.

No, appointing a data protection delegate is voluntary for private controllers under Article 50. However, a delegate is a required element of the voluntary infringement prevention model in Article 49, a compliance programme that the Agency can certify. Adopting a certified model can be taken into account as a mitigating factor if an infringement occurs.

Law 21.719 is closely modelled on the GDPR. It has similar principles, legal bases, rights of access, rectification, erasure, objection, portability and blocking, protection by design and by default, impact assessments, breach reporting and adequacy-based international transfers. Organisations already compliant with the GDPR can reuse much of their work, but should check Chile-specific points such as notification thresholds, the prevention model and fine levels.

Yes. OneClickComply supports Chile's Law 21.719 today. Your existing GDPR and ISO 27001 controls are mapped to the law's articles, evidence is collected automatically from your tools and AutoComplete generates supporting policies from your real environment. Our in-house audit team gives expert guidance through Ask an Auditor. OneClickComply does not certify compliance with the law.