Chile. Comprehensive data protection. Law
Law 21.719Law No. 21,719 regulating the protection and processing of personal data and creating the Personal Data Protection Agency
§1Summary
- Synopsis
Comprehensive overhaul of Chile's 1999 law (amending and largely replacing Law 19,628) along GDPR lines. It adds lawful bases, ARCO-plus rights including portability, breach notification, international transfer rules, and an independent agency with fining power.
- Key themes
- Unique features
Voluntary certified 'infraction prevention models' with a DPO can mitigate liability; a public National Register of Sanctions; repeat offenders face tripled fines.
- SaaS relevance
Applies to controllers and processors established in Chile and to foreign entities offering goods/services to or monitoring people in Chile.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Agency without undue delay where reasonable risk; individuals for sensitive, minors' or financial data
- DPO
- Conditional
- Cross-border transfers
- Adequacy (Agency), contractual clauses/BCRs, certification
- Maximum penalty
- Up to 20,000 UTM (very serious); up to 3x for repeat infringements
§3Dates
- Key dates
- Adopted
- In force
- Published Diario Oficial 2024-12-13; entry into force 2026-12-01; government bill filed in Senate 2026-09-01 to defer to 2027-12-01 (pending); DS 662/2025 on infringement prevention models
§4Text and authority
- Text
- Authoritative text bcn.cl
- Authority
- Agencia de Protección de Datos Personales (Not yet established)
§5Where it applies
- Domestic law of
- Chile
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Watch postponement bill: if enacted, in-force date moves to 2027-12-01. Turnover-based caps for large companies (up to 2-4% revenue) reported in some commentary; not verified here.