Ley sobre Protección de la Vida Privada (Law No. 19.628)

· About Ley sobre Protección de la Vida Privada (Law No. 19.628)

Key Takeaways

  • Law No. 19.628 is Chile’s baseline private-sector and public-sector personal data statute, and it currently remains the operative law until the new reform takes effect on 1 December 2026.[1][4]
  • Law No. 21.719, published on 13 December 2024, rewrites the regime, creates a dedicated Personal Data Protection Agency, and is currently scheduled to enter into force on 1 December 2026.[3][4][11]
  • The reform applies to processing carried out in Chile and can also reach controllers and processors outside Chile when they offer goods or services to people in Chile or monitor their behaviour there, although final operational details depend on the enacted text and implementing rules.[3][4][10]
  • Until the new regime becomes effective, the current law remains in force, but the reform introduces stronger principles, legal bases, data subject rights, breach governance, and sanctions that are materially closer to GDPR-style compliance.[3][5][10]
  • Maximum sanctions under the reform include substantial fines and corrective powers by the new authority; the exact exposure depends on the infringement category and the final implementing framework, and a 2026 bill has reportedly sought to postpone the start date to 1 December 2027.[8][11][15]

What It Is

Law No. 19.628, titled Ley sobre Protección de la Vida Privada, is Chile’s foundational personal data law and the current legal framework governing the collection, use, disclosure, and protection of personal data.[1][6] It is enforced by the competent state authorities under the existing legal model, while Law No. 21.719 creates a new Personal Data Protection Agency to oversee the reformed regime.[3][4]

The core reform was adopted and published on 13 December 2024 as Law No. 21.719, with a general effective date of 1 December 2026 after a 24-month vacancy period.[3][4][11] As of 24 October 2026, sources indicate that a government bill introduced in September 2026 proposes postponing that entry into force to 1 December 2027, but that delay is not effective unless and until enacted.[8][15]

The practical takeaway is that organizations must treat Law No. 19.628 as currently operative, while preparing for the reformed law to govern from 1 December 2026 unless a postponement law is approved.[1][3][8]

Who Must Comply

The current law applies broadly to the processing of personal data in Chile, including collection, storage, use, communication, and transfer of personal data, with special treatment for sensitive data and certain commercial-information records.[1][6] The reform is designed to regulate both controllers and processors and to apply extraterritorially where foreign actors target individuals in Chile or monitor their conduct.[3][4][10]

There is no general small-business exemption in the reform materials surfaced here, so compliance planning should assume that ordinary commercial, employment, platform, customer-management, and vendor-processing activities are in scope.[3][10][11] Sector-specific rules may still apply alongside the general law, especially for financial, health, telecom, and public-sector processing.[1][5][6]

Exemptions remain limited and context-specific rather than broad carve-outs for size or profit status, and some materials note ongoing legislative activity on niche issues such as minors’ social media access and commercial-debt data.[1][7]

Core Requirements

  1. Lawful processing and purpose limitation — Controllers must process personal data for legitimate, defined purposes, and the reform modernizes the legal bases for processing beyond the older consent-centric model.[3][5][10]
  1. Transparency and notices — Organizations must provide clear information about the collection and use of personal data, including who processes it and for what purpose, with more demanding disclosure expectations under the new regime.[3][5][11]
  1. Rights management — Data subjects must be able to exercise rights over access, rectification, cancellation, objection, and related protections, and the reform strengthens the rights framework and administrative enforcement.[1][3][10]
  1. Security safeguards — Controllers must implement technical and organizational measures proportionate to the risk, and the new framework moves Chile closer to risk-based governance and documented controls.[3][5][10]
  1. Vendor and transfer controls — Cross-border transfers and third-party processing require governance, contracts, and accountability measures, especially once the reformed regime applies.[3][4][10]
  1. Incident handling and accountability — The reform introduces more formalized governance expectations, including internal compliance models and evidence of responsible processing, which are material for regulated organizations.[8][11][15]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Reform published | 13 December 2024 | Law No. 21.719 was published and set in motion the overhaul of Law No. 19.628.[3][11] | | Original effective date | 1 December 2026 | The reformed regime is scheduled to become fully operative after the vacancy period.[2][3][4] | | Proposed postponement | 1 December 2027 | A September 2026 government bill reportedly proposes delaying entry into force, but this is not yet effective law.[8][15] |

The reformed law creates a dedicated enforcement authority with powers to investigate, order corrective measures, and impose sanctions.[3][5][10] Publicly available analyses characterize the fine regime as significant and escalating by infringement type, with additional exposure for repeat or serious breaches; the exact maximum amounts should be verified against the final enacted text and any implementing rules before relying on them for budgeting or risk analysis.[5][8][10][11]

Other sanctions may include corrective orders, suspension or cessation of processing, and reputational consequences tied to administrative findings.[3][5][10]

How to Comply

  1. Map processing activities — Build a current record of processing, data categories, recipients, retention periods, and international transfers, then update it for the reformed law’s broader accountability model.[3][10][11]
  1. Classify data and legal bases — Identify personal, sensitive, and high-risk processing, and document the legal basis, notices, and purpose for each activity; this is the foundation for lawful processing controls.[1][3][6]
  1. Upgrade governance and policies — Assign accountable ownership, update privacy notices, retention schedules, breach response, and third-party contracting, and align the control set to ISO 27001 for security management and NIST CSF 2.0 for risk governance.[3][5][10]
  1. Implement risk assessments — Use structured privacy and security assessments for high-risk processing, new products, data sharing, and cross-border transfers; where AI or automated decisioning is involved, align governance to ISO 42001 where it genuinely fits the system lifecycle.[8][11][15]
  1. Strengthen vendor management — Re-paper processor and subprocessor agreements, add audit rights, instructions, breach notice obligations, and transfer safeguards, and verify onward transfer controls before the new law starts.[3][4][10]
  1. Operationalize rights handling — Create intake, identity verification, SLA tracking, and legal-review workflows for data subject requests so the organization can respond consistently once the new regime applies.[1][3][11]
  1. Test incident response — Run tabletop exercises for data breaches, evidence preservation, regulator notification, and remediation, and keep logs that can demonstrate accountability to the new agency.[3][5][10]
  1. Track legislative timing — Monitor whether the proposed 2026 postponement becomes law, because compliance deadlines may shift from 1 December 2026 to 1 December 2027.[8][15]

Related Regulations

  • Chile’s Constitution and privacy jurisprudence — Constitutional privacy protections shape interpretation of personal data rules and support remedies beyond the statute itself.[1][6]
  • Law No. 21.459 on cybercrime — Cybersecurity incidents and evidence handling often overlap with data breach response, but the statutes regulate different conduct and sanctions.[4][5]
  • Sectoral financial, health, and telecom rules — These can impose stricter confidentiality or retention duties that coexist with, and sometimes exceed, the baseline data law.[5][6]
  • EU GDPR — Chile’s reform is widely described as moving the country closer to GDPR-like principles, legal bases, rights, and enforcement, though it is not identical.[4][5][10]
  • LGPD (Brazil) — The Brazilian model is a useful regional benchmark for accountability, rights management, and authority-led enforcement, but Chile’s new law has its own structure and timetable.[10][11]

FAQ

Does Law No. 19.628 still apply in 2026?

Yes. The current law remains the operative framework until the reform enters into force, which is currently scheduled for 1 December 2026.[1][4] If the reported postponement bill is enacted, that date would move to 1 December 2027.[8][15]

Does the reform apply to companies outside Chile?

Yes, the reform is described as having extraterritorial reach where foreign organizations offer goods or services to people in Chile or monitor their behaviour there.[3][4][10] That means offshore SaaS, platforms, adtech, and processors can fall within scope even without a Chilean establishment.[3][10]

Is consent still the only legal basis for processing?

No. Public analyses of the reform state that Chile is moving beyond a consent-only model toward a broader set of lawful bases and accountability obligations.[3][5][10] That makes contract, legal obligation, legitimate interest-like concepts, and other statutory grounds more important in program design, subject to the final text.

What happens if a company ignores the new law?

The new agency can investigate, order corrective action, and impose fines and other sanctions.[3][5][10] The financial exposure is described as materially stronger than under the old regime, so organizations should not wait for enforcement to begin before remediating gaps.[8][11]

Do small businesses get a carve-out?

No broad small-business exemption appears in the materials reviewed here.[3][10][11] Compliance obligations are likely to depend on what data is processed, how risky the processing is, and whether the organization acts as controller or processor.

What should international companies do before December 2026?

They should inventory Chile-related processing, update privacy notices and contracts, and build a rights and incident-response workflow now.[3][5][10] They should also monitor the postponement bill because the compliance clock may shift from 2026 to 2027.[8][15]

Sources

Put it into practice

More compliance guides