Chile Personal Data Protection Law — Law No. 19.628, as amended by Law No. 21.719

Why does it matter?

The amended law moves Chile from a 1999 statute with no regulator and few sanctions to a modern data protection regime with an Agency, fines and accountability duties.

Key benefits include:

• Prepare for the December 2026 regime

Close the gap between current practice and the amended law before the Agency starts enforcing, with the transition tracked as a program.

• Reduce sanction exposure

Fines under Law 21.719 reach 20,000 UTM for the most serious infringements, with higher caps for repeat offenders; a documented prevention model is a mitigating factor.

• Reuse GDPR work

The amended law follows the GDPR model closely, so principles, rights procedures and impact assessments built for Europe transfer to Chile with local adjustments.

• Enable lawful international transfers

Transfers to countries with an adequate level of protection, or under contractual and binding corporate safeguards, keep regional operations running.

• Demonstrate accountability

Records of processing, impact assessments and breach logs give the Agency, customers and partners evidence of responsible data handling.

How does it work?

Law No. 19.628 as amended sets principles of lawfulness, purpose, proportionality, quality, accountability, security, transparency and confidentiality, and requires a lawful basis for every processing operation: consent, contract, legal obligation, legitimate interest and the other bases Law 21.719 added. It defines the rights of access, rectification, erasure, opposition, portability and blocking, special rules for sensitive data and children's data, and the obligations of controllers and processors, including security measures, breach notification to the Agency and to affected people when the risk is high, and impact assessments for high-risk processing.

Organizations implement the law by mapping processing activities and their lawful bases, revising notices and consent mechanisms, building request-handling procedures with the statutory deadlines, assessing high-risk processing, contracting processors, and setting transfer safeguards. The Agencia de Protección de Datos Personales will supervise, investigate and sanction once the regime applies; the voluntary infringement-prevention model, with a designated data protection officer, is recognized as a mitigating factor. Before the amendments apply, the 1999 text continues to govern, with civil remedies through the courts.

SmartSuite holds the records of processing, lawful bases and data subject requests, runs impact assessments and breach notifications as workflows with deadlines, and tracks the transition plan to the amended law so leadership can see readiness before the regime starts.

Key Elements

• Principles and lawful bases

The 1999 principles extended with accountability and transparency, and an explicit list of lawful bases for processing.

• Data subject rights

Access, rectification, erasure, opposition, portability and blocking, with statutory response deadlines.

• Agencia de Protección de Datos Personales

The new supervisory authority created by Law 21.719, with powers to regulate, investigate and fine.

• Impact assessments

Required before processing likely to create a high risk to people's rights, such as profiling or large-scale sensitive data.

• Breach notification

Controllers report security breaches to the Agency without undue delay and inform affected people when the risk is high.

• International transfers

Allowed to adequate countries, or with contractual clauses, binding corporate rules or the other safeguards the law lists.

• Sanctions and the prevention model

Tiered fines for minor, serious and very serious infringements, mitigated by a certified prevention model with a data protection officer.

What does it cover?

The law applies to public bodies and private organizations that process personal data of people in Chile, wherever the organization is established when it offers goods or services to those people or monitors their behavior. It is implemented by privacy, legal, security and operations teams in every sector, with the amended obligations scheduled from December 1, 2026.

What are its objectives?

Law No. 19.628 as amended by Law No. 21.719 sets out to bring Chile to the level of protection of modern data protection laws.

Protect the personal data and private life of people in Chile

Require a lawful basis, transparency and purpose limitation for every processing operation

Give people enforceable rights with a regulator to turn to

Create the Agencia de Protección de Datos Personales to supervise and sanction

Set rules for sensitive data, children, automated decisions and international transfers

Reward accountability through impact assessments and the prevention model

Framework in Context

Law 21.719 was modeled on the EU GDPR and is expected to support an adequacy relationship with the EU; it sits alongside Brazil's LGPD and Argentina's Law 25.326 as Latin America's GDPR-style laws. Organizations map it to ISO/IEC 27701 and the NIST Privacy Framework when running one privacy program across jurisdictions.

Common Framework Mappings

Organizations map the amended Chilean law to the privacy frameworks they already run so one set of controls, records and evidence serves Chile and other jurisdictions.

Mapped frameworks include:

APEC Privacy Framework

Brazil General Data Protection Law (LGPD)

California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

EU General Data Protection Regulation (GDPR)

ISO/IEC 27701

NIST Privacy Framework