Legal Alert
Law 21.719: New Personal Data Protection Regulation in Chile
On December 1, 2026, Law 21.719 will enter into force, modernizing Chilean regulations on personal data protection and adapting the current Law No. 19.628 to international standards in this area.
Main Changes
The new regulation introduces obligations that will require companies to manage personal data in a more structured and transparent way. The main changes include:
- Greater responsibility in the processing of personal data.
- New rights for data subjects, such as access, rectification, cancellation, objection, blocking, and portability (ARCO Rights).
- Stricter rules for consent and data use.
- Creation of a Personal Data Protection Agency with supervisory and sanctioning powers.
- Creation of a National Compliance and Sanctions Registry, which will allow certain violations and sanctions to be publicly recorded.
- Significant fines for non-compliance.
Prevention Models and DPO
The law provides for the voluntary implementation of infringement prevention models in personal data protection matters, consisting of a compliance program. These programs may include:
- The appointment of a Data Protection Officer (DPO).
- Internal compliance protocols and procedures.
- Identification of risks and categories of processed data.
- Internal supervision and reporting mechanisms.
Having a prevention model certified by the Personal Data Protection Agency may constitute a mitigating circumstance of liability in the event of potential infringements.
How to Prepare
Although the law will enter into force in December 2026, it is advisable to begin an adaptation process now. Some key measures include:
- Identifying the personal data handled by the organization and how it is used.
- Reviewing consent forms, privacy policies, and legal bases for processing.
- Updating supplier contracts and internal documents.
- Strengthening security measures and incident management.
- Defining responsible parties and internal governance structures.
A Cultural and Regulatory Change
Law 21.719 not only entails new legal obligations, but also a change in the way organizations manage personal information and the trust of clients, employees, and third parties.
Early preparation will help reduce regulatory, operational, and reputational risks before the law enters into force.