Chile Personal Data Protection Law — Law No. 19.628
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting. Framework text may require a separate license unless explicitly provided.
Overview
Chile Personal Data Protection Law No. 19.628 is a national data protection regulation that helps organizations safeguard personal information and ensure compliance with privacy requirements, covering collection, processing, storage, and dissemination of personal data within Chile.
Why it Matters
Chile’s Personal Data Protection Law establishes a foundational privacy framework guiding organizations in securely managing and protecting personal information. Key benefits include:
- Strengthen data protection practices
Support consistent safeguards for personal data throughout its lifecycle, reducing the risk of unauthorized access or accidental disclosure.
- Enhance regulatory alignment
Align privacy management with Chilean legal requirements, making it easier to demonstrate compliance to regulators and stakeholders.
- Improve consent and rights management
Enable organizations to effectively manage data subject consents and promptly respond to individual rights requests.
- Support operational accountability
Encourage internal privacy policies and oversight mechanisms, promoting greater accountability and transparency in data processing operations.
How it Works
Law No. 19.628 is structured around regulatory requirements for personal data protection, combining principles, data subject rights, and obligations for data controllers and processors, with enforcement by penalties and oversight.
Key Elements
- Lawful Processing Principles
Establishes core criteria for the fair and legal collection, use, and management of personal data.
- Data Subject Rights Framework
Describes the mechanisms for individuals to access, correct, and object to the processing of their personal information.
- Security and Confidentiality Measures
Outlines obligations for implementing technical and organizational controls to protect personal data confidentiality and integrity.
- Cross-Border Data Transfer Restrictions
Organizes the legal limitations and procedural requirements for transferring personal information outside Chilean jurisdiction.
Framework Scope
Chile Law No. 19.628 is adopted by organizations processing personal data across public and private sectors within Chile.
Framework Objectives
Chile Law No. 19.628 defines key requirements for organizations to promote responsible data handling and privacy protection.
- Safeguard personal data through robust security controls and risk management practices
- Strengthen privacy governance and organizational accountability over data processing activities
- Ensure compliance with Chilean legal and regulatory requirements for data protection
- Demonstrate readiness for audits and regulatory inspections through documented practices
- ClassicifationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeFrameworkLegal InstrumentLawSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionLatin AmericaRegion DetailChilePublisherBiblioteca del Congreso Nacional de Chile (BCN)
- VersioningVersionLaw No. 19.628 — Protection of Private LifeEffective DateAugust 28, 1999Issue DateAugust 28, 1999
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityModerate
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
Chile's Personal Data Protection Law is publicly available through official Chilean government publications.
How SmartSuite Supports Chile PDPL
Manage Chile Personal Data Protection Law (Law No. 19.628) requirements by organizing privacy controls, tracking personal data processing activities, and maintaining evidence supporting compliance with national data protection obligations.
Personal Data Inventory and Classification
Maintain records of personal data categories, processing purposes, and storage locations.
Consent, Purpose Limitation, and Lawful Use
Track consent collection, purpose limitation, and lawful use of personal data.
Access, Correction, and Deletion Request Management
Manage access, correction, and deletion requests with full audit trails.
Personal Information Safeguard Implementation
Track safeguards protecting confidentiality, integrity, and availability of personal information.
Data Incident and Regulatory Response Monitoring
Monitor data incidents and manage response workflows aligned to regulatory expectations.
Privacy Posture and Compliance Readiness Reporting
Provide dashboards showing privacy posture, control coverage, and compliance readiness.
Related frameworks
APEC Privacy Framework helps organizations manage cross-border privacy risks and facilitate data flows among Asia-Pacific economies.
Argentina's Personal Data Protection Law governs processing of personal data to protect individuals' privacy and ensure responsible data management.
LGPD is Brazil's data protection law that governs how organizations collect, process, and protect personal data.
CCPA/CPRA is California privacy law giving residents control over personal data and requiring businesses to protect and disclose data practices.
GDPR is an EU regulation that protects individuals' personal data and strengthens organizations' accountability for privacy.
Frequently Asked Questions For Chile Personal Data Protection Law — Law No. 19.628
Law No. 19.628 is designed to protect the privacy and integrity of individuals’ personal data in Chile. It establishes requirements for how organizations collect, process, store, and share personal information, ensuring the lawful and secure handling of data.
Yes, compliance with Law No. 19.628 is mandatory for both public and private sector organizations that process personal data within Chile. Failing to comply can lead to regulatory investigations and administrative penalties.
Any entity—public or private—that collects, uses, or manages personal data about individuals located in Chile is subject to Law No. 19.628. It applies regardless of the sector or size of the organization.
Key concepts include data subject consent, lawful processing, transparency, and data minimization. Organizations must be able to demonstrate data inventory, consent records, security policies, incident response procedures, and privacy notices.
Implementation involves mapping data processing activities, establishing internal privacy policies, designing technical and organizational controls, and providing mechanisms for handling data subject rights. Conducting regular risk assessments and employee training are also critical steps.
While Law No. 19.628 aligns with global data protection principles similar to the EU GDPR, it has unique local requirements specific to Chile. Organizations handling cross-border data transfers must pay particular attention to compatibility and adequacy requirements.
Ongoing compliance requires maintaining up-to-date data inventories, monitoring data processing activities, conducting audits, managing security incidents, and honoring data subject requests. Documentation of controls and regular staff awareness activities are necessary to demonstrate accountability.
SmartSuite can assist organizations by providing integrated tools for risk tracking, mapping regulatory controls to processes, and managing evidence collections. It supports audit readiness with documentation workflows, enables policy governance, and offers dashboards for compliance status and reporting. This helps maintain a defensible privacy posture and supports continual risk management.
Put CRI Profile into action with SmartSuite
Map controls, collect evidence, run assessments, manage remediation, and report readiness - all from a single connected system.