Chile Personal Data Protection Law (Law No. 21.719)

GDPR-aligned reform of Law 19.628 published December 2024: creates the Personal Data Protection Agency, lawful bases, data subject rights, cross-border transfer rules and fines up to 4 percent of annual revenue. Applies from 1 December 2026.

Analysis

Chile’s Ley 21.719, which “regula la protección y el tratamiento de los datos personales y crea la Agencia de Protección de Datos Personales”, was published in the Diario Oficial on 13 December 2024 and enters into full force on 1 December 2026, with a GDPR‑aligned framework of principles, lawful bases, data subject rights, cross‑border transfer rules and a new supervisory authority.Ley 21.719 – texto oficial, Biblioteca del Congreso Nacional • Balance legislativo Ley 21.719 – BCN • Gobierno de Chile – noticia aprobación ley de protección de datos personales • Análisis práctico de la Ley 21.719 – ARCO Legal

Key Requirements

Below are the main legal obligations introduced by Ley 21.719, with direct references to the official text and authoritative commentaries.

• Scope and material application (datos personales y tratamiento)
• The law regulates the protection and treatment of personal data, defining dato personal, dato sensible, tratamiento, responsable del tratamiento and encargado del tratamiento.Ley 21.719 – BCN texto oficial
• It applies to any natural or legal person, public or private, that carries out processing of personal data, with specific rules for public bodies and exceptions for strictly personal or household activities.Ley 21.719 – BCN texto oficial
• Commentaries highlight that the scope is functionally similar to the GDPR’s concept of controllers and processors.DSA Compliance – Ley 21.719 (Datos personales Chile) • GRC360 – Guía 2026 Ley 21.719

• GDPR‑aligned principles of processing
• The law establishes core principles such as lawfulness, purpose limitation, data minimization, accuracy, storage limitation, security, and accountability, which must guide all processing activities.Ley 21.719 – BCN texto oficial
• Legal analyses explicitly describe the law as aligned with the RGPD europeo and note that these principles mirror the GDPR’s Article 5 framework.DSA Compliance – Ley 21.719 • GRC360 – Ley 21.719 de Protección de Datos Personales en Chile

• Lawful bases for processing (bases de legitimación)
• Processing of personal data must be based on specific lawful bases, including consentimiento, performance of a contract, legal obligation, protection of vital interests, exercise of public powers, and legitimate interest under conditions.Ley 21.719 – BCN texto oficial
• Commentators highlight that the law moves away from the traditional “consent‑only” model of Ley 19.628 to a GDPR‑like multi‑basis regime, making compliance more risk‑based.Carey – Publican la Ley 21.719 que modifica la Ley 19.628 • ARCO Legal – Ley 21.719

• Enhanced data subject rights (derechos de los titulares)
• The law grants and amplifies data subject rights, including:
• Right of access (acceso)
• Rectification (rectificación)
• Erasure/suppression (supresión)
• Opposition (oposición)
• Portability (portabilidad)
• Blocking/suspension of processing (bloqueo)
• Rights related to automated decisions and profiling.Ley 21.719 – BCN texto oficial
• Public information for citizens summarises these rights and emphasizes their enforceability from December 2026.Agenciadatos.cl – Información sobre derechos de protección de datos • Anami – Ley 21.719 Chile 2026: protección de datos personales

• Creation of the Agencia de Protección de Datos Personales (APDP)
• Ley 21.719 creates the Agencia de Protección de Datos Personales as a new, autonomous public authority with investigative, supervisory and sanctioning powers.Ley 21.719 – BCN texto oficial
• Official and expert sources explain that the APDP will be able to investigate ex officio, order suspension of processing, issue binding orders and maintain a national register of sanctions.Anami – Nace la Agencia de Protección de Datos Personales • XMS – Nueva Ley de Protección de Datos en Chile • Kulvio – Ley 21.719 Chile 2026 — Multas, Plazos y Obligaciones

• Obligations of controllers and processors
• The law sets detailed obligations for responsables and encargados, including:
• Implementation of appropriate technical and organisational security measures.
• Keeping records of processing activities.
• Contractual requirements for processors.
• Notification of data breaches to the APDP and, in certain cases, to affected data subjects within specified timeframes.Ley 21.719 – BCN texto oficial
• Compliance guides underline that companies must implement a full privacy management system, risk assessments and security controls similar to GDPR practice.GRC360 – Guía 2026 Ley 21.719 • DSA Compliance – Ley 21.719

• Data Protection Officer (Delegado de Protección de Datos – DPD)
• Certain organisations are required to designate a Data Protection Officer (DPD) with defined responsibilities, independence and qualifications, particularly when large‑scale or high‑risk processing is involved.Ley 21.719 – BCN texto oficial
• Sector guides explicitly mention mandatory DPD roles for specific categories, and recommend voluntarily appointing one for complex environments.GRC360 – Fase 2 obligaciones DPO • ARCO Legal – Qué cambia con la nueva ley

• Data Protection Impact Assessments (Evaluaciones de Impacto en la Protección de Datos – EIPD)
• For high‑risk processing, organisations must perform Data Protection Impact Assessments, documenting risks and mitigation measures before starting the processing.Ley 21.719 – BCN texto oficial
• Implementation roadmaps stress that EIPDs become mandatory in later implementation phases and are critical for AI, profiling, and large‑scale data projects.GRC360 – Fases de implementación (EIPD) • DSA Compliance – Modelo de prevención de infracciones

• Cross‑border data transfers (transferencias internacionales)
• The law establishes a regime for international transfers of personal data, including:
• Transfer to countries or international organisations with adequate protection recognised by Chile.
• Transfers based on standard contractual clauses or other safeguards.
• Specific rules for binding corporate rules and consent‑based exceptions.Ley 21.719 – BCN texto oficial
• Expert commentaries point out that the full transfer regime enters in a later phase of implementation and draws heavily from GDPR adequacy and SCC concepts.GRC360 – Fase 3: transferencias internacionales • ARCO Legal – Análisis régimen de transferencias

• Sanctions, fines and model of prevention of infringements
• Ley 21.719 introduces a graduated sanctioning regime, with fines up to high amounts (e.g., 20,000 UTM) and, for certain serious infringements, up to a percentage of annual revenue, with aggravating and mitigating factors.Ley 21.719 – BCN texto oficial
• Compliance articles explain that Chile now has a modern sanctioning system, including a “modelo de prevención de infracciones”; organisations with robust compliance programs may benefit from reduced sanctions.DSA Compliance – Multas y modelo de prevención • Kulvio – Multas, plazos y obligaciones • XMS – Sanciones de hasta 20.000 UTM

• Entry into force and transitional regime
• The law establishes deferred vigencia, with full application set for 1 December 2026, as indicated in the transitional provisions and legislative balance.Balance legislativo – Ley 21.719 • Ley 21.719 – texto con vigencia diferida
• Commentary sources describe phased implementation, where definitions and the APDP start earlier and certain obligations (like DPO, EIPD and transfers) become fully enforceable in later phases.GRC360 – calendario de implementación • ARCO Legal – Calendario de vigencia

Compliance Challenges

Below are recurring compliance challenges organisations face when preparing for Ley 21.719, with examples and references.

• Legacy systems and fragmented data inventories
• Many organisations in Chile have legacy IT systems and lack a single, accurate data inventory, making it difficult to map processing activities and apply principles like minimisation and storage limitation.GRC360 – diagnóstico de madurez y brecha en empresas chilenas
• Industry guides report that companies often underestimate the effort of building records of processing activities (registro de actividades de tratamiento) as required by Ley 21.719.DSA Compliance – obligaciones de registro de tratamiento • Anami – retos de implementación en 2026

• Transition from consent‑centric to risk‑based lawful basis
• Under Ley 19.628, organisations tended to rely heavily on consent, whereas Ley 21.719 demands a proper assessment and documentation of lawful bases, including legitimate interest.Carey – análisis de cambios frente a Ley 19.628
• Commentaries describe misclassification of lawful bases as a common error, especially for HR data, marketing, and analytics.XMS – errores frecuentes al migrar a la nueva ley • ARCO Legal – casos típicos de incumplimiento

• Insufficient governance and accountability structures
• A major challenge is establishing clear governance, including privacy committees, defined roles, and escalation paths, as required by the law’s accountability principle and by the model of prevention of infringements.Ley 21.719 – principios y responsabilidad proactiva
• Compliance firms highlight that organisations often lack board‑level oversight of data protection, which weakens their ability to demonstrate due diligence to the APDP.DSA Compliance – modelo de prevención de infracciones • GRC360 – gobierno corporativo y privacidad

• Preparing for APDP supervision and sanctions
• Companies frequently underestimate the investigative powers and potential visibility of sanctions via the APDP’s register.Anami – facultades de la Agencia de Protección de Datos Personales
• Analyses warn that the reputational impact of appearing in the register of sanctions may be as significant as monetary fines, posing a challenge especially for consumer‑facing brands.Kulvio – Registro Nacional de Sanciones y efectos reputacionales • XMS – impacto de sanciones en empresas chilenas

• Managing data subject request volumes and timelines
• The law imposes strict deadlines and requirements for responding to rights requests (access, rectification, erasure, portability, opposition, etc.).Ley 21.719 – derechos y plazos de respuesta
• Industry guidance notes that many organisations lack workflow tools and trained staff to handle high volumes of rights requests efficiently.Agenciadatos.cl – información a titulares sobre ejercicio de derechos • GRC360 – gestión de derechos ARCO+

• Cross‑border transfers and global vendor relationships
• Organisations relying on global SaaS, cloud and analytics vendors face challenges in ensuring adequate safeguards for international transfers under the new regime.Ley 21.719 – normas de transferencias internacionales
• Legal and compliance analyses point to contract renegotiation, SCC‑like clauses and vendor due diligence as complex, resource‑intensive tasks.ARCO Legal – régimen de transferencias y cláusulas contractuales • DSA Compliance – transferencias internacionales

Implementation Best Practices

The following actionable steps and frameworks are widely recommended for implementing Ley 21.719.

• Conduct a comprehensive data mapping and gap analysis
• Perform an organisation‑wide data inventory and mapping of processing activities, aligned with the law’s requirement for records of processing and principles of minimisation and purpose limitation.Ley 21.719 – obligaciones del responsable del tratamiento
• Chilean implementation guides recommend starting with data mapping workshops, system catalogues, and a classification scheme for personal, sensitive and high‑risk data.[GRC360 – pasos para implementar la Ley 21.719](https://www.grc360.cl

Recent developments

• 2026-09-01 — A late-August/early-September jurisdiction update says Law No. 21.719 will enter into force on 2026-12-01 and that the older Law No. 19.628 remains operative until then. The page frames this as the current baseline for Chile’s privacy regime while the reform waits to take effect. (source)
• 2026-09-01 — This update says the law is set to enter into force on 2026-12-01, but notes a government bill before the Senate would postpone implementation to 2027-12-01. It is the clearest recent signal of possible legislative change to the timeline. (source)
• 2026-08-31 — A late-August industry explainer highlights the coming December 2026 start date, the new data protection agency, stronger rights, and fines of up to 20,000 UTM. It reflects growing private-sector focus on compliance readiness before the law takes effect. (source)
• 2026-08-15 — This report says the general entry into force of Law 21.719 remains set for 2026-12-01 and discusses its extraterritorial reach, including entities offering goods or services in Chile. It underscores the operational impact for foreign companies and cross-border processors. (source)
• 2026-08-03 — An August industry article says Chile’s Personal Data Protection Law will take full effect on 2026-12-01 after the transition period from its December 2024 publication. It also emphasizes the significant sanctions regime, which is driving compliance planning. (source)
• 2026-07-27 — This legal update describes the regime as having moved into an active implementation phase, with expanded rights, stronger principles such as purpose limitation, and a new supervisory authority. The framing suggests businesses are already adjusting internal governance and data-handling practices. (source)
• 2026-07-07 — This mid-year analysis presents Law 21.719 as creating a dedicated enforcement agency and raising compliance stakes for organizations handling Chilean personal data. It is representative of broader industry attention to enforcement risk and operational changes. (source)
• 2026-05-20 — This article summarizes the law’s practical obligations for organizations, including lawful basis requirements, specific purpose limitations, and sanctions up to 20,000 UTM for very serious infringements. The focus is on compliance impacts across sectors and company sizes. (source)
• 2026-02-05 — This global legal tracker notes that Law 21.719 modernizes Chile’s regime and is scheduled to enter into force on 2026-12-01. It also highlights core policy changes such as new legal bases for processing, international transfer rules, and accountability-style requirements. (source)
• 2026-01-22 — This update says Senate Bill No. 18.060-07 proposes significant amendments to Law No. 21.719 before its December 2026 entry into force. The report indicates the law’s final shape may still change, which is the most material recent policy-development risk. (source)

Related regulations

• National Artificial Intelligence Policy Bill — Chile, Active
• UK Data Protection Act 2018 — United Kingdom, Active
• Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
• General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
• COPPA (Children's Online Privacy Protection Act) — United States, Active
• Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
• Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
• New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01

Put it into practice

• Generate the policy: GDPR policy generator (generatepolicy.com)
• Buy the policy pack: Privacy Program Bundle (cyberpolicy.shop)
• Build it yourself: Privacy Dual Coverage Bundle (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates