Skip to content
AI Policy Generator

ESWhat applies

Chile · Law

Law 21,719 on personal data protection

Adopted, applies laterLaw 21,719

Summary

It almost fully replaces Law 19,628 with a European-style regime and creates an agency with sanctioning powers. It brings legal bases, transparency duties, a right regarding automated decisions (art. 8 bis), impact assessments, breach reporting and transfer rules. It applies from December 1, 2026; the Senate approved delaying it to October 15, 2027, but the Chamber has yet to vote.

Who it applies to

Any individual or legal entity, including public bodies, that processes personal data in Chile, and foreign organizations that offer goods or services to, or monitor, people in Chile.

Penalties

Minor violations up to 5,000 UTM, serious up to 10,000 UTM and very serious up to 20,000 UTM, with higher amounts for repeat offenses and a National Sanctions Register (amounts per secondary sources). During the first 12 months, smaller companies may receive a written warning instead (sixth transitional article).

Official name
Ley N° 21.719, que regula la protección y el tratamiento de los datos personales y crea la Agencia de Protección de Datos Personales
Official reference
Diario Oficial 13-dic-2024 (promulgada 25-nov-2024); modifica la Ley 19.628; vigencia 1-dic-2026 (art. primero transitorio)
Regulator
Personal Data Protection Agency
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Public data processing policy and legal basesLey 19.628 modificada por la Ley 21.719, art. 14 terAdopted, applies laterDecember 1, 2026If you process personal data in Chile, including in AI systems.Verified in the official source on November 2, 2026
Rights regarding automated decisions (art. 8 bis)Ley 19.628 modificada por la Ley 21.719, art. 8 bisAdopted, applies laterDecember 1, 2026If you use systems that decide about people, including profiling, with legal or similarly significant effects (employment, credit, insurance, education, health, access to services).Verified in the official source on November 2, 2026
Data protection impact assessmentLey 19.628 modificada por la Ley 21.719, art. 15 terAdopted, applies laterDecember 1, 2026If processing is likely to be high risk; always for profiling with significant effects, large-scale processing, systematic monitoring of public areas and sensitive data without consent.Verified in the official source on November 2, 2026
Contracts with processorsLey 19.628 modificada por la Ley 21.719, art. 15 bisAdopted, applies laterDecember 1, 2026If a vendor (cloud, AI tool, contractor) processes personal data on your behalf.Verified in the official source on November 2, 2026
Security and breach reporting to the AgencyLey 19.628 modificada por la Ley 21.719, arts. 14 quinquies y 14 sexiesAdopted, applies laterDecember 1, 2026If you process personal data.Verified in the official source on November 2, 2026
Specific notice when using biometric dataLey 19.628 modificada por la Ley 21.719, art. 16 terAdopted, applies laterDecember 1, 2026If you use facial recognition, fingerprints, voice or other biometrics to identify people.Verified in the official source on November 2, 2026
Handle data subject rightsLey 19.628 modificada por la Ley 21.719, arts. 4 a 11Adopted, applies laterDecember 1, 2026If you process personal data.Verified in the official source on November 4, 2026
International data transfersLey 19.628 modificada por la Ley 21.719, título V, arts. 27 y 28Adopted, applies laterDecember 1, 2026If you send personal data to vendors or companies in other countries, such as cloud AI services.Verified in the official source on November 4, 2026
Infringement prevention program and data protection officerLey 19.628 modificada por la Ley 21.719, arts. 49 a 51 (modelo de prevención de infracciones, voluntario)Regulator guidanceDecember 1, 2026Recommended for companies processing data at scale or sensitive data; it is voluntary and counts as a mitigating factor.Verified in the official source on November 4, 2026

Public data processing policy and legal bases

Ley 19.628 modificada por la Ley 21.719, art. 14 terAdopted, applies later

Applies from December 1, 2026

When it relates
If you process personal data in Chile, including in AI systems.
What the rule provides
  • Identify the legal basis for each processing activity (consent, contract, legal obligation, legitimate interest or other).
  • Publish on the website a processing policy with date and version, controller details and contact channels.
  • If there are automated decisions or profiling, disclose that they exist, the logic involved and the expected consequences.
Typical evidence
  • Published processing policy.
  • Inventory of processing activities with legal basis.
Verification
Verified in the official source on November 2, 2026Text and date checked in BCN LeyChile (published in the Official Gazette on Dec 13, 2024; first transitional article: effective on the first day of the 24th month after publication = Dec 1, 2026). Postponement: Bill 18.623-07 (filed Sept 1, 2026, proposing Dec 1, 2027) passed the Senate on Oct 28, 2026 (33 to 6) with a new date of Oct 15, 2027 and moved to the Chamber of Deputies (press sources: Emol, Pauta, Garrigues). Until it is published as law, the legal date remains Dec 1, 2026. Recheck before that date.

Rights regarding automated decisions (art. 8 bis)

Ley 19.628 modificada por la Ley 21.719, art. 8 bisAdopted, applies later

Applies from December 1, 2026

When it relates
If you use systems that decide about people, including profiling, with legal or similarly significant effects (employment, credit, insurance, education, health, access to services).
What the rule provides
  • Recognize the right to object and not to be subject to these decisions, unless needed for a contract, based on express consent or allowed by law.
  • In every case, ensure information, an explanation, human intervention, the chance to give one's view and to request review of the decision.
Typical evidence
  • Human review procedure with case log.
  • Decision explanation templates.
Verification
Verified in the official source on November 2, 2026Text and date checked in BCN LeyChile (published in the Official Gazette on Dec 13, 2024; first transitional article: effective on the first day of the 24th month after publication = Dec 1, 2026). Art. 8 bis text read in the official source. Postponement: Bill 18.623-07 (filed Sept 1, 2026, proposing Dec 1, 2027) passed the Senate on Oct 28, 2026 (33 to 6) with a new date of Oct 15, 2027 and moved to the Chamber of Deputies (press sources: Emol, Pauta, Garrigues). Until it is published as law, the legal date remains Dec 1, 2026. Recheck before that date.

Data protection impact assessment

Ley 19.628 modificada por la Ley 21.719, art. 15 terAdopted, applies later

Applies from December 1, 2026

When it relates
If processing is likely to be high risk; always for profiling with significant effects, large-scale processing, systematic monitoring of public areas and sensitive data without consent.
What the rule provides
  • Carry out the assessment before processing starts.
  • Follow the list and minimum guidance the Agency publishes.
Typical evidence
  • Signed and dated assessment per system.
Verification
Verified in the official source on November 2, 2026Text and date checked in BCN LeyChile (published in the Official Gazette on Dec 13, 2024; first transitional article: effective on the first day of the 24th month after publication = Dec 1, 2026). Postponement: Bill 18.623-07 (filed Sept 1, 2026, proposing Dec 1, 2027) passed the Senate on Oct 28, 2026 (33 to 6) with a new date of Oct 15, 2027 and moved to the Chamber of Deputies (press sources: Emol, Pauta, Garrigues). Until it is published as law, the legal date remains Dec 1, 2026. Recheck before that date.

Contracts with processors

Ley 19.628 modificada por la Ley 21.719, art. 15 bisAdopted, applies later

Applies from December 1, 2026

When it relates
If a vendor (cloud, AI tool, contractor) processes personal data on your behalf.
What the rule provides
  • Formalize the assignment with instructions, purpose and a ban on using or sharing the data for any other purpose.
  • A processor that departs from the assignment becomes a controller.
Typical evidence
  • Signed processing agreements with AI vendors.
Verification
Verified in the official source on November 2, 2026Text and date checked in BCN LeyChile (published in the Official Gazette on Dec 13, 2024; first transitional article: effective on the first day of the 24th month after publication = Dec 1, 2026). Postponement: Bill 18.623-07 (filed Sept 1, 2026, proposing Dec 1, 2027) passed the Senate on Oct 28, 2026 (33 to 6) with a new date of Oct 15, 2027 and moved to the Chamber of Deputies (press sources: Emol, Pauta, Garrigues). Until it is published as law, the legal date remains Dec 1, 2026. Recheck before that date.

Security and breach reporting to the Agency

Ley 19.628 modificada por la Ley 21.719, arts. 14 quinquies y 14 sexiesAdopted, applies later

Applies from December 1, 2026

When it relates
If you process personal data.
What the rule provides
  • Adopt measures that ensure confidentiality, integrity, availability and resilience.
  • Report breaches that create a reasonable risk for individuals to the Agency without undue delay.
  • Log every breach and notify individuals when it involves sensitive data, data of children under 14 or other cases set by law.
Typical evidence
  • Breach log.
  • Incident response plan.
Verification
Verified in the official source on November 2, 2026Text and date checked in BCN LeyChile (published in the Official Gazette on Dec 13, 2024; first transitional article: effective on the first day of the 24th month after publication = Dec 1, 2026). Postponement: Bill 18.623-07 (filed Sept 1, 2026, proposing Dec 1, 2027) passed the Senate on Oct 28, 2026 (33 to 6) with a new date of Oct 15, 2027 and moved to the Chamber of Deputies (press sources: Emol, Pauta, Garrigues). Until it is published as law, the legal date remains Dec 1, 2026. Recheck before that date.

Specific notice when using biometric data

Ley 19.628 modificada por la Ley 21.719, art. 16 terAdopted, applies later

Applies from December 1, 2026

When it relates
If you use facial recognition, fingerprints, voice or other biometrics to identify people.
What the rule provides
  • Meet the conditions for sensitive data and disclose which biometric system is used, for what purpose and how long data is kept.
Typical evidence
  • Biometric notice given to individuals.
Verification
Verified in the official source on November 2, 2026Text and date checked in BCN LeyChile (published in the Official Gazette on Dec 13, 2024; first transitional article: effective on the first day of the 24th month after publication = Dec 1, 2026). Postponement: Bill 18.623-07 (filed Sept 1, 2026, proposing Dec 1, 2027) passed the Senate on Oct 28, 2026 (33 to 6) with a new date of Oct 15, 2027 and moved to the Chamber of Deputies (press sources: Emol, Pauta, Garrigues). Until it is published as law, the legal date remains Dec 1, 2026. Recheck before that date.

Handle data subject rights

Ley 19.628 modificada por la Ley 21.719, arts. 4 a 11Adopted, applies later

Applies from December 1, 2026

When it relates
If you process personal data.
What the rule provides
  • Handle access, correction, deletion, objection, portability and blocking requests quickly and without obstacles.
Typical evidence
  • Log of requests and response times.
Related base documents
Verification
Verified in the official source on November 4, 2026Checked in LeyChile (BCN), text of Law 19,628 as amended by Law 21,719: arts. 4 to 11 (including 8 bis, 8 ter and 9) and the Dec 1, 2026 effective date (first transitional article of Law 21,719). Bulletin 18,623-07, which postpones the effective date, was filed in the Senate on Sept 1, 2026 per the Chamber of Deputies; its Senate approval on Oct 28, 2026 (new date Oct 15, 2027) comes only from secondary sources.

International data transfers

Ley 19.628 modificada por la Ley 21.719, título V, arts. 27 y 28Adopted, applies later

Applies from December 1, 2026

When it relates
If you send personal data to vendors or companies in other countries, such as cloud AI services.
What the rule provides
  • Transfer only to adequate countries or with safeguards: standard contractual clauses, binding corporate rules or certification.
  • Document each flow and its mechanism.
Typical evidence
  • Transfer file per vendor.
Verification
Verified in the official source on November 4, 2026Checked in LeyChile (BCN): title V, art. 27 (adequate country; contractual clauses, binding corporate rules or other instruments; compliance model or certification; exceptions) and art. 28 (the Agency determines adequacy). Bulletin 18,623-07, which postpones the effective date, was filed in the Senate on Sept 1, 2026 per the Chamber of Deputies; its Senate approval on Oct 28, 2026 (new date Oct 15, 2027) comes only from secondary sources.

Infringement prevention program and data protection officer

Ley 19.628 modificada por la Ley 21.719, arts. 49 a 51 (modelo de prevención de infracciones, voluntario)Regulator guidance

Applies from December 1, 2026

When it relates
Recommended for companies processing data at scale or sensitive data; it is voluntary and counts as a mitigating factor.
What the rule provides
  • Appoint a data protection officer or compliance lead with autonomy.
  • Identify risk processes and adopt protocols and controls; it can be certified.
Typical evidence
  • Appointment record and documented program.
Verification
Verified in the official source on November 4, 2026Checked in LeyChile (BCN): art. 49 (controllers "may voluntarily" adopt a prevention model), art. 50 ("may appoint" an autonomous officer) and art. 51 (certification by the Agency). Decree 662 (Sept 9, 2026), which would implement it, was not checked in the Official Gazette. Bulletin 18,623-07, which postpones the effective date, was filed in the Senate on Sept 1, 2026 per the Chamber of Deputies; its Senate approval on Oct 28, 2026 (new date Oct 15, 2027) comes only from secondary sources.

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)