Chile Data Protection Law 21.719: What Changes in 2026

The current Ley 19.628 (1999): a thin regime with consent-centric rules, no dedicated regulator, and enforcement through the courts (habeas data actions) and sectoral bodies like the consumer protection agency (SERNAC) for commercial matters and the CMF for financial data. That weakness is exactly why the reform passed. But contracts, systems, and data practices built now will be judged under the new law in December 2026, so 'current law is lax' is a reason to start building, not to wait.

Controllers and processors established in Chile, plus, GDPR-style, foreign entities that offer goods or services to persons in Chile or monitor their behavior there. Public bodies are covered with sector adjustments. There are no volume thresholds. The law's definitions (personal data, sensitive data including biometric and health data, profiling) track the GDPR closely, and children's data receives heightened protection with the minor's best interest as a guiding principle.

Five stand out: (1) lawful-basis discipline, consent is no longer the only route, but every purpose needs a documented ground including balanced legitimate interest; (2) data subject rights including access, rectification, deletion, opposition, portability, and rights around automated decisions, on statutory clocks; (3) breach notification to the Agency without undue delay for incidents with material risk; (4) DPIAs for high-risk processing (profiling, sensitive data at scale, systematic monitoring); (5) international-transfer rules requiring adequacy, safeguards, or specific situations. Sensitive-data processing rules are stricter than the GDPR's in places, health and biometric data especially.

Infringements are classified minor, serious, or very serious (Article 35 of the reformed Ley 19.628): up to 5,000 UTM, 10,000 UTM, and 20,000 UTM respectively, with a UTM being Chile's inflation-indexed tax unit (about USD 70), so the ceiling approaches USD 1.4 million, and repeated very serious conduct can raise exposure further, including suspension of processing. Sanctions are entered in the public National Register of Sanctions and Compliance, reputational exposure by design. Aggravating and mitigating factors include cooperation, self-reporting, and whether a certified prevention model was in place.

Companies can adopt an infringement-prevention model, a documented compliance program with a designated prevention officer, risk mapping, controls, training, and audit, and have it certified. A certified model in operation is an express mitigating factor in sanctioning and signals diligence in the public register. It borrows from Chile's corporate criminal-liability compliance tradition (Ley 20.393), and for companies already running GDPR or LGPD programs, certification is mostly a packaging exercise over existing controls.