Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Chile Data Protection & Privacy Regulation

CL schema gdpri-v2 trajectory: not yet assessed in transition overlaps: Sentinel (AML/CFT), World Payments, artificial-intelligence

Last updated 2026-11-08 · 10 categories · 71 claims · 32 sources in the cumulative register

Chile's comprehensive data-protection reform, Ley N21.719, faces a live threat to its own commencement date.

Data collected 2026-11-08Data published 2026-11-08

AI-assembled from cited sources

Not fully checked this cycle: Regulator & Framework, Data Subject Rights, Enforcement & Redress (5 open gaps).

Evidence re-verified: 2026-11-08·Position last changed: 2026-11-08·

Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-11-10

Open in Co-Pilot ↗Build Report Compare

Framework postureIn transition10 of 10 modules populated · AI-synthesised · Tier-1/2 verified

Lead supervisory authorityAgencia de Protección de Datos Personales (APDP)Primary statutory & supervisory perimeter

Next milestone (> 2026-11-10)None scheduledNo dated future statutory milestone on record

Module coverage & confidence10 / 10 modules assessed0 Confirmed · 8 Probable · 2 Uncertain

Jurisdiction brief

Latest update · 8 November 2026

Lead Signal

Chile's new data protection law remains on a fixed commencement date even as the body meant to enforce it has not yet been seated. The Senate rejected the Executive's proposed first-council slate for the Agencia de Protección de Datos Personales on 20 May 2026, after the nomination failed to reach the required two-thirds majority. That rejection leaves the agency unconstituted while the statute's own commencement date of 1 December 2026 remains legally unchanged. The result is a widening gap between a law that takes effect on schedule and a regulator that, as things stand, has nobody at the top to run it on day one.

Other Developments

A separate instrument has moved forward on the implementation side: a decree published on 9 September 2026 sets out the requirements, procedures and registration mechanics for compliance programs — described as infraction-prevention models — that controllers may adopt under the new law. This gives organisations a defined, if still untested, route to structure internal compliance ahead of the law's effective date, independent of whether the agency itself is operational by then.

On the automated-decision-making side, the law is reported to include a right for individuals to object to decisions based solely on automated processing of their personal data where those decisions produce legal effects or otherwise significantly affect them. This would sit alongside the law's broader rights catalogue, though the provision's precise wording has not yet been checked directly against the statute's own text and should be treated as provisional pending that confirmation.

On enforcement, the statute's own text confirms a formal pathway for individuals whose rights requests are refused or go unanswered: an administrative protection procedure, backed by the possibility of a formal illegality claim before the courts. Separately, commentary on the sanctions regime reports a large increase in the ceiling for administrative fines compared with the prior law, with the most serious infractions said to be able to draw a substantially higher maximum penalty than before, and repeat violations said to carry exposure measured against a share of annual revenue. Those figures come from secondary compliance commentary rather than from the sanctions article of the statute itself, so they should be read as indicative rather than settled.

Cross-Monitor Connections

No material pointing to crypto, financial-integrity, world-payments, advennt or artificial-intelligence activity was carried into the record for this jurisdiction.

Outlook

The most consequential date on the calendar remains 1 December 2026, when the law is due to enter into force and largely replace the prior data protection statute. A government bill introduced on 1 September 2026 to postpone that commencement date is still pending; as of October 2026 it had not altered the legally fixed date. Whether the agency's council is seated before commencement, and whether the postponement bill advances, are now the two developments most likely to determine how smoothly the new regime actually starts operating once it is in force.

2 earlier updates not shown here.

Standing brief · as of 28 September 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Chile's comprehensive data-protection reform, Ley N21.719, faces a live threat to its own commencement date. The law, which comprehensively reforms the existing Ley N19.628, carries a statutory effective date of 1 December 2026. On 1 September 2026 the Executive submitted Boletin N18.623-07 to the Senate with suma urgencia, proposing to postpone that effective date by a full year, to 1 December 2027, and simultaneously to enlarge the governing council of the Agencia de Proteccion de Datos Personales, the APDP, from three members to five. As of the most recent status located this cycle, spanning 17 to 22 September 2026, the postponement bill remains in its first constitutional stage, with no committee report or floor vote yet held. The legally operative position, therefore, is that Ley 21.719 is still scheduled to take effect on 1 December 2026 unless and until the postponement bill is actually enacted.

The root cause of the postponement push is institutional rather than substantive: the Senate rejected the government's proposed slate of APDP Consejo Directivo nominees on 19 May 2026, falling short of the required two-thirds quorum by a vote of 19 in favour to 12 against. The consequence is that Chile's data-protection enforcement authority does not yet exist in operational form, its governing council unconstituted, even as the substantive law that authority would enforce approaches its scheduled commencement date. The postponement bill's proposed expansion of the council from three to five members, each designated by the President with two-thirds Senate approval for six-year non-renewable terms, is a direct legislative response to the difficulty of assembling a qualified majority around a smaller slate.

Other Developments

The substantive provisions of Ley 21.719 remain in the same posture as before, enacted but not yet effective, pending the outcome of the timing dispute. This includes the law's establishment of full ARCO rights, access, rectification, cancellation, and opposition, structured along GDPR-aligned lines, and its requirements for controllers and processors, including designation of a data-protection-officer analogue, maintenance of records of processing activities, and completion of data protection impact assessments for high-risk processing. None of these obligations has changed in substance this cycle; what has changed is the increased uncertainty around exactly when they become legally operative.

Cross-Monitor Connections

The unconstituted state of the APDP's governing council has a direct bearing on Chile's broader financial-services regulatory landscape tracked by the financial-integrity monitor, insofar as data-protection enforcement capacity and financial-sector AML/CFT enforcement capacity both depend on functioning regulatory institutions being properly constituted; readers tracking Chile's institutional capacity generally may find it useful to read this development alongside financial-integrity's coverage of Chile's own contested administrative-powers legislation this cycle. No adtech, biometric, or cross-border-transfer developments are addressed in this brief, as none met the bar for material content this cycle.

Outlook

The item to watch is straightforward: will Boletin N18.623-07 clear the Senate before 1 December 2026 arrives. If it does not, Ley 21.719 will take effect on its currently scheduled date regardless of whether the APDP's council has been constituted in time to administer it, a scenario that would leave a fully effective statute without a fully operational enforcement authority. If the postponement bill does pass, the effective date moves to 1 December 2027 and the council-expansion provisions take effect alongside it, giving the government a second opportunity to assemble the two-thirds Senate majority the original slate failed to achieve in May 2026.

Key regulatory facts for Chile
Regulatory Dimension	Chile Standing Position
Jurisdiction	Chile (CL)
Regulatory Scope	Data Protection & Privacy Regulation (10 modules, 71 sourced findings)
Regulator & Framework	Statute enacted and constitutionally validated, but the regulator is not yet operational and the implementing regulation is not yet finalized; current in-force law (Ley 19.628) is materially weaker than the incoming...
Lawful Processing & Special Data	Expanded lawful bases and sensitive-data regime are enacted but not yet effective (1 Dec 2026); current regime is narrower.
Data Subject Rights	Rights expansion enacted but not yet effective; current ARCO regime under Ley 19.628 is narrower and lacks portability/blocking/ADM-opposition rights.
Controller/Processor Duties	Core accountability and breach/security duties are enacted but not yet effective; DPO is only conditionally mandatory and no formal RoPA is required, both material divergences from GDPR.
Primary Instruments Cited	IAPP, IAPP, IAPP, IAPP, IAPP
Last Confirmed / Updated	2026-11-08 (32 sources in cumulative register)

#

Statute enacted and constitutionally validated, but the regulator is not yet operational and the implementing regulation is not yet finalized; current in-force law (Ley 19.628) is materially weaker than the incoming regime.

Primary frameworkLey N.º 21.719 (modifying Ley N.º 19.628 sobre Protección de la Vida Privada), in force 1 December 2026

Supervisory authorityAgencia de Protección de Datos Personales (APDP)

Traffic-light rationale — AmberStatute enacted and constitutionally validated, but the regulator is not yet operational and the implementing regulation is not yet finalized; current in-force law (Ley 19.628) is materially weaker than the incoming regime.

Sub-modules (5)

Regulator And AuthorityAmber

The APDP is an autonomous, decentralized public-law corporation with its own legal personality and patrimony, relating to government via the Ministry of Economy, governed by a 3-member Consejo Directivo; the Council must be appointed before 1 June 2026 per a January 2026 public-sector adjustment law.

Claims (9):

<cite index="42-1,42-2">The Agencia de Protección de Datos Personales is an autonomous, technical, decentralized public-law corporation with its own legal personality and patrimony, relating to government through the Ministry of Economy, and is governed by a directive council made up of three counsellors.
<cite index="41-1">Under a January 2026 public-sector adjustment law, the Agency's Consejo Directivo must be designated before 1 June 2026, requiring the presidential nomination to occur between March and April.
Agencia de Protección de Datos Personales (APDP) — APDP's three-member Consejo Directivo remains unappointed; Senate rejected the Executive's first nominee slate on 20 May 2026 for failing the two-thirds quorum required under Ley 21.719 art. 30 quáter; no new slate submitted as of 11-19 Oct 2026 reporting
Boletin N18.623-07, submitted by the Executive to the Senate on 1 September 2026 with suma urgencia, proposes postponing Ley 21.719's entry into force from 1 December 2026 to 1 December 2027 and enlarging the APDP's Consejo Directivo from three to five members.
Boletin N18.623-07 — As of the most recent status located this cycle (17-22 September 2026), the bill remains in first constitutional stage with no committee report or floor vote yet held; the legally operative effective date therefore remains 1 December 2026 pending any enacted amendment.
Senate of Chile — The Senate rejected the government's proposed slate of APDP Consejo Directivo members on 19 May 2026, falling short of the required two-thirds quorum (19 in favour, 12 against), leaving the Agency's governing council unconstituted.
Boletin N18.623-07 — Boletin 18.623-07 proposes enlarging the APDP Consejo Directivo from three to five members, designated by the President with two-thirds Senate approval, serving six-year non-renewable terms.
Agencia de Protección de Datos Personales — Agencia remains unconstituted after Senate rejection of first-council terna.
Agencia de Protección de Datos Personales — The Senate rejected the Executive's proposed first-council terna on 20 May 2026 for failing to reach the required two-thirds majority; the Agencia remains unconstituted as this cycle's primary legal-framework development.

Act And InstrumentsAmber

Ley 19.628 (1999) remains operative today; Ley 21.719 (enacted, not yet effective) and its implementing Decreto Supremo N.º 662 (Reglamento on Compliance Models, pending Contraloría review) both commence 1 December 2026.

Claims (8):

<cite index="6-1">Ley N.º 21.719, which regulates the protection and treatment of personal data and creates the Agencia de Protección de Datos Personales, enters into force on 1 December 2026.
Ley N.º 19.628 sobre protección a la vida privada (1999) remains the current operative statute governing personal data processing in Chile until Ley 21.719 takes effect, as confirmed by multiple 2025-2026 legal commentaries referencing its continued applicability pending the reform's entry into force.
<cite index="34-1">On 13 June 2025 the Ministry of Finance issued Decreto Supremo N.º 662, approving the Regulation governing requirements, modalities and procedures for the implementation, certification, registration and supervision of Infraction Prevention Models, which remains in the process of legality review before the Contraloría General de la República.
Boletín N°18.623-07 — postpone Ley 21.719's full entry-into-force date from 1 December 2026 to 1 December 2027 and enlarge the APDP Consejo Directivo from three to five members (three-member quorum); approved 'en general' by unanimity by the Senate Constitution Committee on 19 October 2026, urgency elevated to 'discusión inmediata'
Ley N21.719, which comprehensively reforms Ley N19.628, has a statutory effective date of 1 December 2026 under its own transitional article.
Ley N°21.806 — Ley 21.719's fourth transitional article so the first designation of the APDP Consejo Directivo must occur six months before the law's entry into force (by 1 June 2026); that deadline passed without a Council being seated
Decreto N°662 — Decreto 662 implements Compliance Models regime.
Decreto N°662, published 9 September 2026, regulates requirements, modalities and procedures to implement, certify, register and supervise Compliance (Infraction-Prevention) Models associated with Ley 21.719.

Material ScopeAmber

Ley 21.719 introduces differentiated regimes for biometric data, children/adolescent data, historical/statistical/scientific data, and geolocation data.

Claims (1):

<cite index="53-2">Ley 21.719 establishes special regimes for biometric data; data relating to children and adolescents; data used for historical, statistical, scientific or research purposes; and geolocation data.

Territorial ScopeAmber

The law applies extraterritorially to entities constituted in Chile, to processing operations located in Chile, and to entities offering goods or services in Chile; a pending parliamentary bill (Boletín N.º 18.060-07) proposes narrowing this extraterritorial rule.

Claims (2):

<cite index="23-3">The regulation applies to subjects constituted in Chilean territory, to those carrying out data-processing operations established in national territory, and to those offering goods or services in Chile, whether through their activities or by application of a contract or international law.
<cite index="2-8,2-9">A parliamentary-motion bill (Boletín N.º 18.060-07), currently in first constitutional procedure, proposes to perfect aspects of Ley N.º 21.719, including limiting the law's scope of application with respect to the extraterritorial rule.

Regulator Registration And FilingAmber

There is no mandatory general controller-registration duty; instead, adoption of a voluntary Modelo de Prevención de Infracciones is certified and recorded by the APDP in a National Registry of Sanctions and Compliance.

Claims (1):

<cite index="11-9,11-10">The law establishes leve, grave and gravísima infringement tiers with a certification-based Infraction Prevention Model recognized by the Agency as a mitigating factor, and certified models are entered into a national registry administered by the Agency.

Category narrative 95 words

Chile is mid-transition from the 1999 Ley N.º 19.628 sobre Protección de la Vida Privada (a minimal, civil-court-enforced regime with no dedicated regulator) to a GDPR-influenced omnibus regime under Ley N.º 21.719, which creates the Agencia de Protección de Datos Personales (APDP) and enters into force on 1 December 2026. As of the research date the APDP does not yet exist operationally: its 3-member Consejo Directivo must be appointed before 1 June 2026, and its implementing Reglamento (Decreto Supremo N.º 662) remains under constitutionality/legality review (toma de razón) at the Contraloría General de la República.

Periodic update · new data 2026-11-08

Regulator & Framework

The central development this period concerns the body meant to administer Chile's new data protection law rather than the law's substantive rules. On 20 May 2026 the Senate rejected the Executive's proposed first-council terna for the Agencia de Protección de Datos Personales, the nomination having failed to secure the required two-thirds majority. The agency therefore remains unconstituted. This matters because the statute's effective date is a fixed point on the calendar rather than something tied to the agency being ready: the law is still due to enter into force on 1 December 2026, replacing most of the prior data protection statute and establishing the agency in name, even though, as things stand, nobody has been confirmed to sit on its governing council.

A government bill introduced on 1 September 2026 proposes to postpone that commencement date. As of October 2026 the bill remained pending and had not changed the legally fixed date, so the 1 December deadline should be treated as live unless and until that bill, or some other instrument, actually amends it.

On the implementation side, a decree published on 9 September 2026 sets out requirements, procedures and registration mechanics for compliance programs, described in the source material as infraction-prevention models, that controllers may put in place under the new law. This gives organisations operating in Chile a concrete, if still untested, structure to work toward ahead of commencement, independent of the uncertainty around the agency's own readiness.

Outlook

The near-term picture turns on two linked questions: whether a revised nomination for the agency's council clears the Senate before 1 December 2026, and whether the pending postponement bill advances far enough to actually move the commencement date. Until one or both of those resolve, Chile faces a live possibility of a data protection law coming into force on schedule without a seated regulator to administer it from day one.

2 earlier distinct update(s)

Periodic update · new data 2026-10-25

Regulator & Framework

Chile's data-protection authority, the Agencia de Protección de Datos Personales (APDP), remains without a seated governing board as the statutory commencement date for Law N°21.719 approaches. The law's three-member Consejo Directivo is to be appointed by the Senate on a two-thirds quorum under article 30 quáter, but the Senate rejected the Executive's first slate of nominees on 20 May 2026 for failing to reach that threshold. As of reporting spanning 11 to 19 October 2026, no replacement slate had been put forward. This gap is material because Law N°21.806 had already amended Law 21.719's fourth transitional article to require that the first Council designation occur six months before the law's entry into force, which under the original 1 December 2026 commencement date fixed a nomination deadline of 1 June 2026. That deadline passed without appointment.

Against this backdrop, the Senate's Constitution Committee approved, in general and by unanimous vote on 19 October 2026, a bill under Boletín N°18.623-07 that would postpone Law 21.719's full entry into force from 1 December 2026 to 1 December 2027, and would enlarge the Consejo Directivo from three to five members with a three-member quorum, a structural change apparently intended to make the appointment threshold easier to clear going forward. The Executive has elevated the bill's legislative urgency to immediate discussion, signalling intent to resolve the timing question before the current deadline arrives. The bill has not been enacted, and whether the Senate will floor-vote it, and with what final quorum design, is unresolved.

Outlook

The operative question for the remainder of the year is whether Boletín N°18.623-07 is enacted before 1 December 2026. If it is, the law's full commencement shifts to 1 December 2027 and the Council is reconstituted at five seats. If it is not, Law 21.719 takes effect on schedule without an operating governing board in place, since no nominee slate has yet replaced the one rejected in May. Either path turns on two unresolved facts: whether a new nominee slate is submitted, and whether the Senate completes a floor vote on the postponement bill in the coming weeks.

Periodic update · new data 2026-10-11

Regulator & Framework

Chile's data-protection framework rests on Ley N21.719, a comprehensive, GDPR-influenced reform enacted 13 December 2024 to replace the 1999 Ley N19.628. The reform was structured with a 24-month transition period originally ending 1 December 2026, during which Ley N19.628 remains the operative legal regime. The institutional foundation for the new law's enforcement, the Agencia de Proteccion de Datos Personales, has encountered a material setback to this timeline: the Senate rejected the Executive's proposed first Consejo Directivo slate on 20 May 2026, with 19 votes in favour and 12 against, falling short of the two-thirds quorum required under Ley 21.719 article 30 quater.

As a direct consequence, a bill to postpone the law's full entry into force from 1 December 2026 to 1 December 2027 was pending before the Senate as of 2 October 2026, with the Agencia still lacking a designated governing council at that date. The practical effect is that Chile's comprehensive data-protection reform, enacted on paper more than eighteen months ago, remains dependent on an unresolved institutional question, whether a revised Council slate can secure Senate confirmation before the current transition period expires, or whether the law's commencement is instead formally delayed by a further year.

Outlook

The determinative event to watch is whether the Senate confirms a revised Consejo Directivo slate before 1 December 2026, which would allow the Agencia to become operational on the original schedule, or whether the pending postponement bill is enacted first, pushing full commencement of Ley 21.719 to 1 December 2027. Either outcome resolves the current uncertainty over when Chile's reformed data-protection regime will actually take effect.

Sources and claims (21)

Probable IAPP — <cite index="42-1,42-2">The Agencia de Protección de Datos Personales is an autonomous, technical, decentralized public-law corporation with its own legal personality and patrimony, relating to government through the Ministry of Economy, and is governed by a directive council made up of three counsellors. observed 2026-08-05
Probable IAPP — <cite index="41-1">Under a January 2026 public-sector adjustment law, the Agency's Consejo Directivo must be designated before 1 June 2026, requiring the presidential nomination to occur between March and April. observed 2026-08-05
Probable IAPP — <cite index="6-1">Ley N.º 21.719, which regulates the protection and treatment of personal data and creates the Agencia de Protección de Datos Personales, enters into force on 1 December 2026. observed 2026-08-05
Probable IAPP — Ley N.º 19.628 sobre protección a la vida privada (1999) remains the current operative statute governing personal data processing in Chile until Ley 21.719 takes effect, as confirmed by multiple 2025-2026 legal commentaries referencing its continued applicability pending the reform's entry into force. observed 2026-08-05
Probable IAPP — <cite index="34-1">On 13 June 2025 the Ministry of Finance issued Decreto Supremo N.º 662, approving the Regulation governing requirements, modalities and procedures for the implementation, certification, registration and supervision of Infraction Prevention Models, which remains in the process of legality review before the Contraloría General de la República. observed 2026-08-05
Probable IAPP — <cite index="53-2">Ley 21.719 establishes special regimes for biometric data; data relating to children and adolescents; data used for historical, statistical, scientific or research purposes; and geolocation data. observed 2026-08-05
Probable IAPP — <cite index="23-3">The regulation applies to subjects constituted in Chilean territory, to those carrying out data-processing operations established in national territory, and to those offering goods or services in Chile, whether through their activities or by application of a contract or international law. observed 2026-08-05
Probable IAPP — <cite index="2-8,2-9">A parliamentary-motion bill (Boletín N.º 18.060-07), currently in first constitutional procedure, proposes to perfect aspects of Ley N.º 21.719, including limiting the law's scope of application with respect to the extraterritorial rule. observed 2026-08-05
Probable IAPP — <cite index="11-9,11-10">The law establishes leve, grave and gravísima infringement tiers with a certification-based Infraction Prevention Model recognized by the Agency as a mitigating factor, and certified models are entered into a national registry administered by the Agency. observed 2026-08-05
Probable Orbix Consultor — Agencia de Protección de Datos Personales (APDP) — APDP's three-member Consejo Directivo remains unappointed; Senate rejected the Executive's first nominee slate on 20 May 2026 for failing the two-thirds quorum required under Ley 21.719 art. 30 quáter; no new slate submitted as of 11-19 Oct 2026 reporting observed 2026-10-25
Probable https://www.varelaabogados.cl/post/ley-proteccion-datos-personales-chile-21719 — Boletín N°18.623-07 — postpone Ley 21.719's full entry-into-force date from 1 December 2026 to 1 December 2027 and enlarge the APDP Consejo Directivo from three to five members (three-member quorum); approved 'en general' by unanimity by the Senate Constitution Committee on 19 October 2026, urgency elevated to 'discusión inmediata'
Probable Neuronet — Boletin N18.623-07, submitted by the Executive to the Senate on 1 September 2026 with suma urgencia, proposes postponing Ley 21.719's entry into force from 1 December 2026 to 1 December 2027 and enlarging the APDP's Consejo Directivo from three to five members. observed 2026-11-08
Probable Diario Financiero — Ley N21.719, which comprehensively reforms Ley N19.628, has a statutory effective date of 1 December 2026 under its own transitional article. observed 2026-10-11
Probable RecordingLaw — Boletin N18.623-07 — As of the most recent status located this cycle (17-22 September 2026), the bill remains in first constitutional stage with no committee report or floor vote yet held; the legally operative effective date therefore remains 1 December 2026 pending any enacted amendment. observed 2026-10-11
Probable BCN - Ley Chile — Senate of Chile — The Senate rejected the government's proposed slate of APDP Consejo Directivo members on 19 May 2026, falling short of the required two-thirds quorum (19 in favour, 12 against), leaving the Agency's governing council unconstituted. observed 2026-11-08
Probable YourDevs — Boletin N18.623-07 — Boletin 18.623-07 proposes enlarging the APDP Consejo Directivo from three to five members, designated by the President with two-thirds Senate approval, serving six-year non-renewable terms. observed 2026-11-08
Probable Diario Oficial / SEGPRES alert — Ley N°21.806 — Ley 21.719's fourth transitional article so the first designation of the APDP Consejo Directivo must occur six months before the law's entry into force (by 1 June 2026); that deadline passed without a Council being seated observed 2026-10-25
Probable Diario Financiero — Agencia de Protección de Datos Personales — Agencia remains unconstituted after Senate rejection of first-council terna. observed 2026-10-11
Probable Neuronet — Decreto N°662 — Decreto 662 implements Compliance Models regime. observed 2026-11-08
Probable Diario Financiero — Agencia de Protección de Datos Personales — The Senate rejected the Executive's proposed first-council terna on 20 May 2026 for failing to reach the required two-thirds majority; the Agencia remains unconstituted as this cycle's primary legal-framework development. observed 2026-10-11
Probable Neuronet — Decreto N°662, published 9 September 2026, regulates requirements, modalities and procedures to implement, certify, register and supervise Compliance (Infraction-Prevention) Models associated with Ley 21.719. observed 2026-11-08

#

Expanded lawful bases and sensitive-data regime are enacted but not yet effective (1 Dec 2026); current regime is narrower.

Primary frameworkLey N.º 21.719 (amending Ley N.º 19.628)

Supervisory authorityAgencia de Protección de Datos Personales (APDP)

Traffic-light rationale — AmberExpanded lawful bases and sensitive-data regime are enacted but not yet effective (1 Dec 2026); current regime is narrower.

Sub-modules (4)

Lawful BasesAmber

Ley 19.628 historically recognized only legal authorization and express written consent; Ley 21.719 adds legitimate interest, contractual necessity, vital interest, legal obligation, judicial cooperation, specific banking/financial/stock-market transactions, international agreements, and urgent medical necessity.

Claims (2):

<cite index="28-15">Ley 19.628 only recognizes as sources of lawful processing legal authorization and the express and written consent of the data subject.
<cite index="23-1">The new law recognizes international/domestic transfer scenarios and lawful processing hypotheses including legitimate interest, vital interest, formulation/exercise/defense of a right, legal duty compliance, banking/financial/stock-market transactions, international obligations or cooperation agreements, express legal authorization, international judicial cooperation, contract necessity or precontractual measures, and urgent medical or health measures.

Special CategoriesAmber

Exceptions to the express-consent default for sensitive data include manifestly public data, legitimate interest, vital interest, exercise/defense of a right, and legal-duty compliance; differentiated regimes exist for biometric, children's, research/statistical, and geolocation data.

Claims (1):

<cite index="53-1">Sensitive data may be processed without express consent when it has been made manifestly public and its use relates to the published purposes, when a legitimate interest is involved, when a vital interest is involved, for the formulation, exercise or defense of a right, and in compliance with a legal duty.

Pseudonymisation And AnonymisationAmber

Retention-limitation principle requires deletion or anonymisation of data once the processing purpose is fulfilled, absent legal authorization or consent for extended retention.

Claims (1):

<cite index="28-2,28-3">Data must be retained only for the period necessary to fulfil the purposes of processing, after which it must be deleted or anonymised, and processing for a longer period requires legal authorization or the data subject's consent.

Category narrative 40 words

The current Ley 19.628 recognizes only two lawful bases (legal authorization and express written consent). Ley 21.719 substantially broadens the lawful-basis catalogue and introduces a differentiated regime for sensitive/special-category data with an expanded set of exceptions to the express-consent default.

Sources and claims (6)

Probable IAPP — <cite index="28-15">Ley 19.628 only recognizes as sources of lawful processing legal authorization and the express and written consent of the data subject. observed 2026-08-05
Probable IAPP — <cite index="23-1">The new law recognizes international/domestic transfer scenarios and lawful processing hypotheses including legitimate interest, vital interest, formulation/exercise/defense of a right, legal duty compliance, banking/financial/stock-market transactions, international obligations or cooperation agreements, express legal authorization, international judicial cooperation, contract necessity or precontractual measures, and urgent medical or health measures. observed 2026-08-05
Probable IAPP — <cite index="53-1">Regarding sensitive personal data, as a general rule its processing must be carried out with the express consent of the data subject, without prejudice to exceptions. observed 2026-08-05
Probable IAPP — <cite index="53-1">Sensitive data may be processed without express consent when it has been made manifestly public and its use relates to the published purposes, when a legitimate interest is involved, when a vital interest is involved, for the formulation, exercise or defense of a right, and in compliance with a legal duty. observed 2026-08-05
Probable IAPP — <cite index="28-2,28-3">Data must be retained only for the period necessary to fulfil the purposes of processing, after which it must be deleted or anonymised, and processing for a longer period requires legal authorization or the data subject's consent. observed 2026-08-05
Probable RecordingLaw — Ley N°21.719 — Consent to process personal data must be free, informed, specific and unambiguous, manifested through a statement or clear affirmative act by the data subject. observed 2026-10-11

#

Rights expansion enacted but not yet effective; current ARCO regime under Ley 19.628 is narrower and lacks portability/blocking/ADM-opposition rights.

Primary frameworkLey N.º 21.719 (amending Ley N.º 19.628)

Supervisory authorityAgencia de Protección de Datos Personales (APDP)

Traffic-light rationale — AmberRights expansion enacted but not yet effective; current ARCO regime under Ley 19.628 is narrower and lacks portability/blocking/ADM-opposition rights.

Sub-modules (5)

Access RightAmber

Access right retained from Ley 19.628 and continued under Ley 21.719, allowing data subjects to obtain confirmation and details of processing.

Claims (3):

<cite index="31-1">Data subjects must be permitted the full exercise of their rights of access, rectification, suppression or opposition, and portability, unless a legal limitation exists.
Ley N21.719 — Ley 21.719 establishes full ARCO rights (access, rectification, cancellation, opposition) for data subjects, GDPR-aligned in structure.
Ley N°21.719 — Art. 4 recognises rights of access, rectification, erasure (supresión), objection, portability and blocking.

Rectification And ErasureAmber

The 'cancelación' right is renamed 'supresión' (erasure) under the new law, alongside rectification.

Claims (1):

<cite index="23-5">Regarding data subject rights, in addition to those currently recognized in Ley N.º 19.628 — access, rectification, and cancellation (now termed suppression) and opposition — the new law adds blocking, portability, and opposition to automated decisions.

Restriction And ObjectionAmber

New rights of blocking (bloqueo) and opposition to automated decision-making are introduced.

Claims (2):

<cite index="23-5">The rights catalogue is extended to include blocking and opposition to automated decisions.
Ley N°21.719 — Art. 8 ter creates a right of blocking (bloqueo): the data subject may request temporary suspension of processing while a rectification, erasure or objection request is resolved.

Data PortabilityAmber

Portability is a newly introduced data subject right under Ley 21.719.

Claims (1):

<cite index="23-5">Portability is added as a new data subject right not previously recognized under Ley 19.628.

Deadlines And Response WindowsAmber

Controllers have 30 calendar days (extendable once) to respond to a rights request; denial, partial denial, or silence entitles the data subject to file a claim with the Agency.

Claims (2):

<cite index="11-13">An administrative procedure is established under which, if within 30 calendar days following the filing date (extendable once) the request is denied in whole or in part or no response is given, the data subject may file a claim with the Agencia de Protección de Datos Personales.
Ley N°21.719 — Secondary sources report a 30-calendar-day response deadline for ARCO+ requests, extendable by a further 30 days; not yet directly verified against the statute's own deadline article, with some guides instead citing 15 business days.

Category narrative 43 words

Ley 21.719 expands the classic ARCO (access, rectification, cancellation, opposition) rights into an ARCOP+ scheme: access, rectification, suppression (renamed from cancellation), opposition, blocking, portability, and opposition to automated decision-making/profiling. A 30-calendar-day response window applies, with escalation to the Agency on denial or silence.

Sources and claims (9)

Probable IAPP — <cite index="31-1">Data subjects must be permitted the full exercise of their rights of access, rectification, suppression or opposition, and portability, unless a legal limitation exists. observed 2026-08-05
Probable IAPP — <cite index="23-5">Regarding data subject rights, in addition to those currently recognized in Ley N.º 19.628 — access, rectification, and cancellation (now termed suppression) and opposition — the new law adds blocking, portability, and opposition to automated decisions. observed 2026-08-05
Probable IAPP — <cite index="23-5">The rights catalogue is extended to include blocking and opposition to automated decisions. observed 2026-08-05
Probable IAPP — <cite index="23-5">Portability is added as a new data subject right not previously recognized under Ley 19.628. observed 2026-08-05
Probable IAPP — <cite index="11-13">An administrative procedure is established under which, if within 30 calendar days following the filing date (extendable once) the request is denied in whole or in part or no response is given, the data subject may file a claim with the Agencia de Protección de Datos Personales. observed 2026-08-05
Probable https://lawwwing.com/la-nueva-era-de-la-proteccion-de-datos-en-chile-que-cambia-con-la-ley-21-719/ — Ley N21.719 — Ley 21.719 establishes full ARCO rights (access, rectification, cancellation, opposition) for data subjects, GDPR-aligned in structure.
Probable BCN - Ley Chile — Ley N°21.719 — Art. 4 recognises rights of access, rectification, erasure (supresión), objection, portability and blocking. observed 2026-11-08
Probable BCN - Ley Chile — Ley N°21.719 — Art. 8 ter creates a right of blocking (bloqueo): the data subject may request temporary suspension of processing while a rectification, erasure or objection request is resolved. observed 2026-11-08
Uncertain YourDevs — Ley N°21.719 — Secondary sources report a 30-calendar-day response deadline for ARCO+ requests, extendable by a further 30 days; not yet directly verified against the statute's own deadline article, with some guides instead citing 15 business days. observed 2026-11-08

#

Core accountability and breach/security duties are enacted but not yet effective; DPO is only conditionally mandatory and no formal RoPA is required, both material divergences from GDPR.

Primary frameworkLey N.º 21.719 (amending Ley N.º 19.628); Decreto Supremo N.º 662 (Reglamento on Compliance Models)

Supervisory authorityAgencia de Protección de Datos Personales (APDP)

Traffic-light rationale — AmberCore accountability and breach/security duties are enacted but not yet effective; DPO is only conditionally mandatory and no formal RoPA is required, both material divergences from GDPR.

Sub-modules (7)

Accountability And DpiaAmber

Accountability principle requires controllers/processors to answer for infringements; DPIA-like impact assessments are required for high-risk activities such as systematic monitoring of publicly accessible areas.

Claims (3):

<cite index="10-10">The future law recognizes the principle of accountability, indicating that those who process personal data must, in the event of non-compliance with principles, obligations or other provisions, take responsibility for possible infringements of the regulation.
<cite index="22-9,22-10">Where processing involves systematic observation or monitoring of a publicly accessible area, an impact assessment must be carried out, considering the description of the processing operations, the purpose, and the evaluation of necessity and proportionality, and thus the risks and mitigation measures.
Ley N21.719 — Ley 21.719 requires designation of a Delegado de Proteccion de Datos (DPO analogue) for organisations processing personal data significantly, records of processing activities, and DPIAs for high-risk processing such as sensitive-data use or profiling.

Dpo RequirementsAmber

The DPO role is voluntary in general, becoming effectively mandatory once an entity adopts and certifies a compliance/prevention model; the DPO must report directly to the entity's highest governing authority.

Claims (2):

<cite index="4-3,4-4">A major novelty of Ley N.º 21.719 is the introduction of the data protection delegate figure, a role that is in principle voluntary, applying only to entities that adopt an infraction prevention model.
<cite index="4-1">Decree N.º 662's Article 8 establishes that the DPO must report directly to the authority that designated them, and that authority must be the entity's highest directive or administrative authority.

Ropa RequirementsAmber

Unlike GDPR Art.30, no formal Records of Processing Activities register is mandated; instead, controllers must publish categories of data, purposes, legal bases, recipients, retention periods, data sources, and international transfers.

Claims (1):

<cite index="12-8">Unlike the GDPR, the future law does not require controllers to maintain a formal record of processing activities (Article 30 GDPR equivalent), though a transparency duty requires publishing categories of data processed, the general description of the data subjects, recipients, purposes, legal basis, and, for legitimate-interest processing, what those interests are.

Joint Controller ArrangementsRed

No specific joint-controller regime distinct from general controller/processor obligations was identified in the sources reviewed for this run.

Security MeasuresAmber

Controllers/processors must adopt risk- and data-nature-proportionate technical and organisational security measures, bearing the burden of demonstrating their adequacy (accountability model).

Claims (1):

<cite index="35-12,35-14">The controller must guarantee adequate security standards, protecting data against unauthorized or unlawful processing and against loss, leakage, accidental damage or destruction; upon a security incident, it falls to the controller or processor to demonstrate the existence and functioning of security measures adopted based on risk levels and available technology.

Breach NotificationAmber

Breach must be reported to the Agency via the most expeditious means without undue delay when there is risk to rights/freedoms; no fixed 72-hour-style deadline exists; data subjects must additionally be notified for sensitive data, under-14 children's data, or economic/financial/banking/commercial data breaches.

Claims (3):

<cite index="38-1">Regarding the security duty and specifically the obligation to report security breaches, no fixed deadline is indicated, as in the case of the GDPR (72 hours); instead the law states it must be done by the most expeditious means possible and without undue delay.
<cite index="35-2">Data subjects must additionally be notified when the breach affects sensitive personal data, data of children under 14 years of age, or data relating to economic, financial, banking or commercial obligations.
Ley N21.719 — Ley 21.719 requires notification of security breaches posing a risk to data-subject rights to the Agencia within 72 hours of the controller becoming aware, with notification to affected individuals also required without undue delay where risk is high.

Retention And DisposalAmber

Data must be retained only as long as necessary for the processing purpose, then deleted or anonymised absent extended legal authorization or consent.

Claims (1):

<cite index="28-2">Data must be retained only for the period necessary to fulfil the purposes of the processing, after which it must be cancelled or anonymised.

Category narrative 66 words

Ley 21.719 introduces an accountability principle, DPIA-equivalent impact assessments for high-risk processing, a voluntary-but-conditionally-mandatory DPO (delegado de protección de datos), transparency-publication duties in lieu of a formal Art.30-style RoPA, risk-proportionate security obligations with a demonstrated-accountability burden of proof, and a breach-notification duty without a fixed statutory clock (unlike GDPR's 72 hours), but with mandatory data-subject notice for sensitive data, under-14 children's data, or financial/economic data breaches.

Sources and claims (11)

Probable IAPP — <cite index="10-10">The future law recognizes the principle of accountability, indicating that those who process personal data must, in the event of non-compliance with principles, obligations or other provisions, take responsibility for possible infringements of the regulation. observed 2026-08-05
Probable IAPP — <cite index="22-9,22-10">Where processing involves systematic observation or monitoring of a publicly accessible area, an impact assessment must be carried out, considering the description of the processing operations, the purpose, and the evaluation of necessity and proportionality, and thus the risks and mitigation measures. observed 2026-08-05
Probable IAPP — <cite index="4-3,4-4">A major novelty of Ley N.º 21.719 is the introduction of the data protection delegate figure, a role that is in principle voluntary, applying only to entities that adopt an infraction prevention model. observed 2026-08-05
Probable IAPP — <cite index="4-1">Decree N.º 662's Article 8 establishes that the DPO must report directly to the authority that designated them, and that authority must be the entity's highest directive or administrative authority. observed 2026-08-05
Probable IAPP — <cite index="12-8">Unlike the GDPR, the future law does not require controllers to maintain a formal record of processing activities (Article 30 GDPR equivalent), though a transparency duty requires publishing categories of data processed, the general description of the data subjects, recipients, purposes, legal basis, and, for legitimate-interest processing, what those interests are. observed 2026-08-05
Probable IAPP — <cite index="35-12,35-14">The controller must guarantee adequate security standards, protecting data against unauthorized or unlawful processing and against loss, leakage, accidental damage or destruction; upon a security incident, it falls to the controller or processor to demonstrate the existence and functioning of security measures adopted based on risk levels and available technology. observed 2026-08-05
Probable IAPP — <cite index="38-1">Regarding the security duty and specifically the obligation to report security breaches, no fixed deadline is indicated, as in the case of the GDPR (72 hours); instead the law states it must be done by the most expeditious means possible and without undue delay. observed 2026-08-05
Probable IAPP — <cite index="35-2">Data subjects must additionally be notified when the breach affects sensitive personal data, data of children under 14 years of age, or data relating to economic, financial, banking or commercial obligations. observed 2026-08-05
Probable IAPP — <cite index="28-2">Data must be retained only for the period necessary to fulfil the purposes of the processing, after which it must be cancelled or anonymised. observed 2026-08-05
Probable Global Suite Solutions — Ley N21.719 — Ley 21.719 requires designation of a Delegado de Proteccion de Datos (DPO analogue) for organisations processing personal data significantly, records of processing activities, and DPIAs for high-risk processing such as sensitive-data use or profiling. observed 2026-11-08
Probable XMS LATAM — Ley N21.719 — Ley 21.719 requires notification of security breaches posing a risk to data-subject rights to the Agencia within 72 hours of the controller becoming aware, with notification to affected individuals also required without undue delay where risk is high. observed 2026-11-08

#

Transfer-mechanism framework is enacted but not yet effective and awaits Agency ratification of model clauses; adequacy in/out and localisation dimensions are unaddressed in available sources.

Primary frameworkLey N.º 21.719 (amending Ley N.º 19.628), Article 27

Supervisory authorityAgencia de Protección de Datos Personales (APDP)

Traffic-light rationale — AmberTransfer-mechanism framework is enacted but not yet effective and awaits Agency ratification of model clauses; adequacy in/out and localisation dimensions are unaddressed in available sources.

Sub-modules (6)

Transfer MechanismsAmber

Article 27 permits transfers via adequate-protection-level assessment of the destination country, contractual clauses/BCRs or similar instruments, certification/compliance models, explicit consent, specific banking/financial/stock-market transfers, treaty/cooperation obligations, express legal authorization, international judicial cooperation, contract necessity, and urgent medical measures.

Claims (1):

<cite index="23-1">International data transfer is possible when there are adequate levels of data protection in the recipient country; when contractual clauses, binding corporate rules or another similar legal instrument are complied with; when a compliance model or certification mechanism exists; when there is express consent of the data subject; when carried out in the context of specific banking, financial or stock-market transfers; when international obligations acquired or cooperation agreements are complied with; when there is express legal authorization; when it occurs in the context of international judicial cooperation; when necessary for the conclusion or execution of a contract or precontractual measures; and when necessary to adopt urgent medical or health measures.

Adequacy ReceivedRed

No evidence was found of any foreign regulator or bloc (e.g., the EU) having issued an adequacy decision in favour of Chile.

Adequacy GrantedRed

No evidence was found of Chile (via the not-yet-operational Agency) having granted adequacy status to any other jurisdiction; this determination is expected to be a future Agency function.

Sccs And BcrsAmber

Model contractual clauses for international transfers, based on the Red Iberoamericana de Protección de Datos template, were administratively pre-approved in December 2025 and await ratification once the Agency is installed.

Claims (1):

<cite index="21-15">In December 2025, via an exempt resolution of the Undersecretariat of Economy and Small Business, model contractual clauses for international transfers were approved, based on the model approved by the Ibero-American Data Protection Network, to be ratified once the Agencia de Protección de Datos Personales is installed.

Transfer Impact AssessmentRed

No distinct, formally named Transfer Impact Assessment obligation (as distinguished from the general destination-country adequacy assessment under Article 27) was identified in sources reviewed.

Data LocalisationRed

No general data-localisation mandate was identified; sector-specific data-retention/event-log requirements exist for open-finance API providers (5-year retention) but this is a security/retention rule, not a localisation mandate.

Category narrative 81 words

Ley 21.719 introduces, for the first time, a structured international-transfer regime with multiple transfer mechanisms (adequacy-style destination assessment, contractual clauses/BCRs, certification, consent, sector-specific carve-outs, treaty-based cooperation, contractual necessity, urgent medical need), plus an intra-group derogation added by a later amendment. Model contractual clauses have been pre-approved administratively pending Agency ratification. No evidence was found of Chile having received or granted formal adequacy decisions, of an explicit Transfer Impact Assessment requirement distinct from the general destination-country assessment, or of a data-localisation mandate.

Sources and claims (2)

Probable IAPP — <cite index="23-1">International data transfer is possible when there are adequate levels of data protection in the recipient country; when contractual clauses, binding corporate rules or another similar legal instrument are complied with; when a compliance model or certification mechanism exists; when there is express consent of the data subject; when carried out in the context of specific banking, financial or stock-market transfers; when international obligations acquired or cooperation agreements are complied with; when there is express legal authorization; when it occurs in the context of international judicial cooperation; when necessary for the conclusion or execution of a contract or precontractual measures; and when necessary to adopt urgent medical or health measures. observed 2026-08-05
Probable IAPP — <cite index="21-15">In December 2025, via an exempt resolution of the Undersecretariat of Economy and Small Business, model contractual clauses for international transfers were approved, based on the model approved by the Ibero-American Data Protection Network, to be ratified once the Agencia de Protección de Datos Personales is installed. observed 2026-08-05

#

Financial-sector overlay is well documented and currently in force; other sectoral overlays (telecoms, education, insurance) show no dedicated findings.

Primary frameworkLey N.º 21.521 (Ley Fintech); CMF Norma de Carácter General N.º 514; Ley N.º 21.719 (general overlay)

Supervisory authorityComisión para el Mercado Financiero (CMF)

Traffic-light rationale — AmberFinancial-sector overlay is well documented and currently in force; other sectoral overlays (telecoms, education, insurance) show no dedicated findings.

Sub-modules (7)

Financial Sector OverlayAmber

The Fintech Law establishes an Open Finance system requiring express client consent, security, and interoperability standards for data-sharing among regulated financial participants; the CMF's NCG 514 mandates API security monitoring, safeguards, 5-year event-log retention, and secure data deletion.

Claims (2):

<cite index="40-2">Ley N.º 21.521 (the Fintech Law) establishes a special regulation of the Open Finance System, setting rules and principles for an exchange system among financial service providers based on clients' express consent, remote automated access, and high security standards.
<cite index="40-1">The Comisión para el Mercado Financiero issued Norma de Carácter General N.º 514 in 2024, applicable to IPI, IPC, PSBI and PSIP entities, requiring API security processes including monitoring, safeguards, maintenance of an updated event registry for five years, and secure deletion of information once legal retention periods expire.

Health Sector OverlayRed

No dedicated health-sector DP overlay (comparable to HIPAA) was identified in sources reviewed for this run; general special-category rules under Ley 21.719 would apply to health data as sensitive data.

Telecoms And EprivacyRed

No dedicated telecoms/ePrivacy-style overlay (comparable to the EU ePrivacy Directive) was identified in sources reviewed.

Employment DataAmber

Compliance-model obligations under the Reglamento must be incorporated into employment contracts, service-provider agreements, and internal workplace regulations (Reglamento Interno de Orden, Higiene y Seguridad).

Claims (1):

<cite index="16-4">The compliance program must include incorporating these obligations into the employment contracts of workers, employees and service providers, or as a specific obligation in the entity's internal regulation on order, hygiene and safety.

Credit And ScoringAmber

Historic rules permitting reporting of non-compliance with economic, financial, banking or commercial obligations (e.g., mortgages, loans) are preserved under the new regime.

Claims (1):

The current regulation on personal data concerning economic, financial, banking or commercial obligations is maintained, permitting reporting of default on obligations such as mortgages and loans subject to specific rules retained under the new regime.

EducationRed

No education-sector-specific DP overlay was identified in sources reviewed for this run.

InsuranceRed

No insurance-sector-specific DP overlay was identified in sources reviewed for this run.

Category narrative 66 words

Financial-sector data flows are governed by the Ley Fintech (Open Finance system) and CMF technical standards (NCG N.º 514), which pre-date and currently sit alongside the incoming general DP law; the compliance-model regime under Ley 21.719 requires embedding DP obligations into employment contracts and internal workplace regulations; historic economic/financial/commercial-obligation reporting rules are preserved. No comprehensive telecoms/ePrivacy, education-sector, or insurance-sector DP overlay was identified in sources reviewed.

Sources and claims (4)

Probable IAPP — <cite index="40-2">Ley N.º 21.521 (the Fintech Law) establishes a special regulation of the Open Finance System, setting rules and principles for an exchange system among financial service providers based on clients' express consent, remote automated access, and high security standards. observed 2026-08-05
Probable IAPP — <cite index="40-1">The Comisión para el Mercado Financiero issued Norma de Carácter General N.º 514 in 2024, applicable to IPI, IPC, PSBI and PSIP entities, requiring API security processes including monitoring, safeguards, maintenance of an updated event registry for five years, and secure deletion of information once legal retention periods expire. observed 2026-08-05
Probable IAPP — <cite index="16-4">The compliance program must include incorporating these obligations into the employment contracts of workers, employees and service providers, or as a specific obligation in the entity's internal regulation on order, hygiene and safety. observed 2026-08-05
Probable IAPP — The current regulation on personal data concerning economic, financial, banking or commercial obligations is maintained, permitting reporting of default on obligations such as mortgages and loans subject to specific rules retained under the new regime. observed 2026-08-05

#

No dedicated adtech-specific regime found; general DP-law rights (opposition/profiling) provide only indirect coverage.

Primary frameworkLey N.º 21.719 (general overlay only; no dedicated adtech statute identified)

Supervisory authorityAgencia de Protección de Datos Personales (APDP)

Traffic-light rationale — RedNo dedicated adtech-specific regime found; general DP-law rights (opposition/profiling) provide only indirect coverage.

Sub-modules (6)

Cookies And TrackersRed

No dedicated cookie/tracker consent statute was identified.

Dark PatternsRed

No dark-pattern-specific prohibition was identified.

Opt Out SignalsRed

No recognized technical opt-out signal (comparable to GPC or DAA) was identified.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room-specific rule was identified.

Cross Context AdvertisingRed

No CPRA-style 'sale'/'share' cross-context advertising concept was identified in the Chilean framework.

Direct MarketingAmber

The new opposition right to automated decisions/profiling under Ley 21.719 is the closest applicable mechanism to direct-marketing opt-out, though no marketing-specific suppression regime was separately identified.

Claims (1):

<cite index="23-5">The new law adds a right of opposition to automated decisions to the ARCO rights catalogue, relevant to profiling-based marketing activities.

Category narrative 42 words

No dedicated cookie/adtech-consent statute, dark-pattern prohibition, recognized opt-out signal (e.g., GPC/DAA equivalent), or clean-room/data-collaboration rule was identified for Chile in sources reviewed. Ley 21.719's new opposition right to automated decision-making/profiling is the closest applicable mechanism relevant to targeted advertising and direct marketing.

Sources and claims (1)

Probable IAPP — <cite index="23-5">The new law adds a right of opposition to automated decisions to the ARCO rights catalogue, relevant to profiling-based marketing activities. observed 2026-08-05

#

Core ADM-opposition and biometric provisions are enacted but not yet effective; AI-labelling bill remains a proposal; genetic-data and surveillance-carveout coverage is unconfirmed.

Primary frameworkLey N.º 21.719 (amending Ley N.º 19.628)

Supervisory authorityAgencia de Protección de Datos Personales (APDP)

Traffic-light rationale — AmberCore ADM-opposition and biometric provisions are enacted but not yet effective; AI-labelling bill remains a proposal; genetic-data and surveillance-carveout coverage is unconfirmed.

Sub-modules (6)

Profiling RestrictionsAmber

New right to oppose profiling/automated decision-making introduced.

Claims (1):

<cite index="23-5">The rights of data subjects are expanded to include opposition to automated decisions, alongside blocking and portability.

Automated Decision Making TransparencyAmber

Compliance-model documentation must specify the existence of automated decisions or profiling, including their logic and expected effects on data subjects.

Claims (2):

<cite index="3-12">The compliance program must also specify retention periods and the existence of automated decisions or profiling, indicating their logic and expected effects for data subjects.
Ley N°21.719 — Art. 8 bis reportedly grants a right to object to decisions based solely on automated processing of personal data that produce legal effects on, or significantly affect, the data subject.

Ai Risk AssessmentsAmber

A separate bill would mandate clear, traceable labelling of AI-generated synthetic content involving personal likeness; it remains in legislative process, not yet in force.

Claims (1):

<cite index="18-5">A draft bill defines synthetic content as any image, video, audio or graphic representation that, using personal data or distinctive elements of a natural person's identity, has been created or substantially modified using AI systems such that it could be mistaken for an authentic representation, and would impose labelling obligations on those who develop, operate or make such AI systems available.

Biometric RegimeAmber

A special regime is established for biometric data processing under Ley 21.719.

Claims (1):

<cite index="53-2">Special regimes are established for biometric data, among other differentiated categories.

Genetic DataRed

No distinct genetic-data-specific regime beyond general special-category treatment was identified in sources reviewed.

State Surveillance CarveoutsRed

No specific national-security/state-surveillance carve-out provision was identified in sources reviewed for this run.

Category narrative 55 words

Ley 21.719 introduces a right to oppose automated decision-making/profiling and a distinct biometric-data regime, and requires impact assessments for systematic monitoring of publicly accessible areas. A separate draft bill on mandatory traceable AI-content labelling is in legislative process but not yet law. No dedicated genetic-data regime or state-surveillance carve-out provision was identified in sources reviewed.

No periodic updates recorded in this cycle

Sources and claims (5)

Probable IAPP — <cite index="23-5">The rights of data subjects are expanded to include opposition to automated decisions, alongside blocking and portability. observed 2026-08-05
Probable IAPP — <cite index="3-12">The compliance program must also specify retention periods and the existence of automated decisions or profiling, indicating their logic and expected effects for data subjects. observed 2026-08-05
Probable IAPP — <cite index="18-5">A draft bill defines synthetic content as any image, video, audio or graphic representation that, using personal data or distinctive elements of a natural person's identity, has been created or substantially modified using AI systems such that it could be mistaken for an authentic representation, and would impose labelling obligations on those who develop, operate or make such AI systems available. observed 2026-08-05
Probable IAPP — <cite index="53-2">Special regimes are established for biometric data, among other differentiated categories. observed 2026-08-05
Uncertain Global Suite Solutions — Ley N°21.719 — Art. 8 bis reportedly grants a right to object to decisions based solely on automated processing of personal data that produce legal effects on, or significantly affect, the data subject. observed 2026-11-08

#

A children's-data regime and an under-14 breach-notification threshold are enacted but not yet effective; no dedicated age-verification/parental-consent/profiling-ban mechanism was confirmed.

Primary frameworkLey N.º 21.719 (amending Ley N.º 19.628); Ley N.º 21.659 (Reglamento de Seguridad Privada, ancillary)

Supervisory authorityAgencia de Protección de Datos Personales (APDP)

Traffic-light rationale — AmberA children's-data regime and an under-14 breach-notification threshold are enacted but not yet effective; no dedicated age-verification/parental-consent/profiling-ban mechanism was confirmed.

Sub-modules (5)

Age VerificationAmber

No dedicated age-verification mechanism was identified; the law does use an under-14 threshold for heightened breach-notification duties, implying an operative age marker without a verification procedure being specified.

Claims (1):

<cite index="35-2">Data subjects must be notified when breaches affect data of children under 14 years of age, establishing an operative age threshold within the breach-notification regime.

Minor Profiling BansRed

No minor-specific profiling ban was identified in sources reviewed.

Education SettingsRed

No education-setting-specific DP rule was identified in sources reviewed.

Dependent AdultsAmber

The Private Security Regulation under Ley 21.659 imposes a duty on public/private security entities to respect and protect the fundamental rights of vulnerable persons, including persons with disabilities, in data-processing activities tied to security operations.

Claims (1):

<cite index="1-2">Public or private institutions engaged in private security must respect and protect fundamental human rights and freedoms, especially concerning vulnerable persons, children, adolescents, and persons with disabilities.

Category narrative 62 words

Ley 21.719 creates a differentiated regime for children's/adolescents' data and imposes a heightened breach-notification duty when a breach affects data of children under 14. A separate private-security regulation (Ley 21.659) imposes fundamental-rights-protection duties toward vulnerable groups, including children and persons with disabilities, in security-related personal-data processing. No explicit age-verification mechanism, parental-consent procedure, minor-profiling ban, or education-setting-specific rule was identified in sources reviewed.

Sources and claims (2)

Probable IAPP — <cite index="35-2">Data subjects must be notified when breaches affect data of children under 14 years of age, establishing an operative age threshold within the breach-notification regime. observed 2026-08-05
Probable IAPP — <cite index="1-2">Public or private institutions engaged in private security must respect and protect fundamental human rights and freedoms, especially concerning vulnerable persons, children, adolescents, and persons with disabilities. observed 2026-08-05

#

Enforcement architecture is enacted but the Agency is not yet operational and the penalty framework may still be amended by a pending bill; current in-force redress is limited to civil litigation.

Primary frameworkLey N.º 21.719 (amending Ley N.º 19.628)

Supervisory authorityAgencia de Protección de Datos Personales (APDP)

Traffic-light rationale — AmberEnforcement architecture is enacted but the Agency is not yet operational and the penalty framework may still be amended by a pending bill; current in-force redress is limited to civil litigation.

Sub-modules (6)

Regulator Powers And PenaltiesAmber

The Agency will hold instruction, interpretation, supervision, infringement-determination, sanctioning, complaint-resolution, certification, and international-cooperation powers; infringements are tiered leve/grave/gravísima, denominated in UTM, with suspension powers for repeat very-serious violations.

Claims (6):

<cite index="11-7">The Agency has functions to issue instructions, interpret the regulation's provisions, oversee compliance with obligations, determine non-compliance, exercise sanctioning power, resolve data subjects' requests and complaints, conduct promotional and dissemination activities, propose measures to the President and Congress, provide technical assistance to autonomous bodies, enter cooperation agreements, participate with international organisations, and certify and supervise compliance models.
<cite index="15-23,15-24">Infringements by data controllers of the principles, rights and obligations established by the law are classified, according to gravity, as minor, serious and very serious, with minor infringements sanctioned by written warning or fines.
<cite index="43-13">In cases of repeated very serious infringements within a 24-month period, the control authority may order suspension of the data controller's processing operations and activities for up to 30 days, extendable indefinitely until corrective measures are adopted.
Ley N21.719 — Ley 21.719 sets maximum administrative fines of 20,000 UTM for the most serious infractions, tripled on recidivism, or up to 4% of annual revenue for large companies.
Boletín N°18.623-07 — extend the 12-month written-warning-instead-of-fine leniency under Ley 21.719's sixth transitional article to all companies regardless of size (currently limited to smaller companies)
Ley N°21.719 — Secondary sources report a maximum administrative fine of 20,000 UTM for the gravest infractions (versus roughly 50 UTM under prior Ley 19.628), with recidivism potentially raising exposure to up to 4% of annual revenue; not independently verified against the statute's own sanctions article.

Enforcement Activity IndexRed

No enforcement activity index could be constructed: the Agency does not yet exist and Ley 19.628's civil-court mechanism generates no centrally tracked enforcement statistics identified in sources reviewed.

Regulator Funding And CapacityRed

Agency capacity/funding cannot yet be assessed since its governing Consejo Directivo had not been appointed as of the research date (deadline 1 June 2026).

Claims (1):

<cite index="41-1,41-2">Recently, in January 2026, via the public-sector adjustment bill, rules were approved establishing that the Agency's Consejo Directivo must be designated before 1 June 2026, and that if the Senate does not act before that date the presidential proposal of counsellors will be deemed accepted.

Collective Redress And Class ActionsRed

No data-protection-specific collective-redress or class-action mechanism was identified in sources reviewed for this run.

Private Right Of ActionAmber

Under current Ley 19.628, data subjects may pursue civil damages for patrimonial and moral harm caused by improper data processing via the courts.

Claims (2):

<cite index="35-9">Ley 19.628 establishes only the duty to indemnify patrimonial and moral damage caused by improper data processing, without prejudice to eliminating, modifying or blocking data as required by the data subject or ordered by a court.
Ley N°21.719 — Art. 23 governs the exercise of data-subject rights, the administrative tutela procedure, and the reclamo de ilegalidad before the courts where a controller refuses or fails to satisfy a rights request.

Recent Developments 180DAmber

Within the last 180 days: a January 2026 public-sector adjustment law set the 1 June 2026 deadline for appointing the Agency's Consejo Directivo, and a parliamentary-motion bill (Boletín N.º 18.060-07) to amend aspects of Ley 21.719 remains in first constitutional procedure.

Claims (2):

<cite index="41-1,41-2">Recently, in January 2026, via the public-sector adjustment bill, rules were approved establishing that the Agency's Consejo Directivo must be designated before 1 June 2026, and that if the Senate does not act before that date the presidential proposal of counsellors will be deemed accepted.
<cite index="2-8">A parliamentary-motion bill (Boletín N.º 18.060-07) intended to perfect aspects of Ley N.º 21.719 is currently in first constitutional procedure.

Category narrative 65 words

Under current Ley 19.628, redress is court-based (civil damages actions for patrimonial and moral harm). Ley 21.719 (not yet effective) creates the APDP with instruction, interpretation, supervision, sanctioning, and complaint-resolution powers, a tiered leve/grave/gravísima penalty structure denominated in UTM, and suspension powers for repeated very-serious infringements. A pending parliamentary bill would revise the penalty ranges. No dedicated collective-redress/class-action mechanism specific to data protection was identified.

Periodic update · new data 2026-11-08

Enforcement & Redress

The statute's own text, read directly, confirms a formal procedure available to individuals whose data protection rights requests are refused or left unanswered by a controller: an administrative protection procedure, together with the possibility of pursuing a formal illegality claim before the courts if that administrative route does not resolve the matter. This gives the rights catalogue created elsewhere in the law a concrete enforcement path, independent of whether the new agency's council has been seated.

Separately, compliance-oriented commentary reports a substantial increase in the ceiling for administrative fines compared with the prior data protection statute, with the gravest infractions said to be able to draw a maximum penalty many multiples higher than under the previous regime, and repeat violations said to carry exposure assessed against a share of annual revenue. These figures have not yet been checked against the sanctions article of the statute itself and should be treated as indicative of direction rather than as a confirmed ceiling.

Outlook

The redress pathway established in the statute's own text gives individuals a route to enforcement that does not depend on the agency being operational, which somewhat offsets the uncertainty created by the unconstituted council elsewhere in the regime. The fine figures reported in commentary, if confirmed against the statute itself, would represent a material increase in financial exposure for controllers and are worth verifying directly as the commencement date approaches.

2 earlier distinct update(s)

Periodic update · new data 2026-10-25

Enforcement & Redress

Chile's data-protection enforcement framework carries a built-in leniency period that is itself now subject to proposed amendment. Law 21.719's sixth transitional article currently permits the APDP to issue a written warning in place of a fine during the first twelve months the law is in force, but that relief is presently limited to smaller companies. The bill under Boletín N°18.623-07, the same instrument proposing to postpone the law's full commencement to 1 December 2027, is understood to propose extending this written-warning leniency to companies of all sizes, removing the size-based limitation. This proposal sits at the consultation stage within the Senate's consideration of the broader bill and has not been enacted; it is a secondary feature of the postponement debate rather than a freestanding enforcement reform.

Because the APDP's governing Consejo Directivo remains unappointed, no enforcement activity under Law 21.719, whether a written warning or a fine, can yet occur in practice: the authority empowered to exercise those powers is not yet operationally constituted. The enforcement-tone question, how lenient the first year of the regime will be and for whom, is therefore a live legislative question layered on top of the more basic question of when, and under what governing board, the regime becomes operative at all.

Outlook

Watch whether the broadened written-warning leniency survives into the bill's final text, and whether it is explicitly tied to the postponed 1 December 2027 commencement date or to whatever date ultimately governs. Until the Consejo Directivo is seated, the practical enforcement posture of the APDP, lenient or otherwise, remains theoretical rather than operative.

Periodic update · new data 2026-10-11

Enforcement & Redress

Ley N21.719 establishes a maximum administrative fine of 20,000 UTM, approximately CLP 1,400 million, for the gravest category of data-protection infractions, to be imposed by the Agencia de Proteccion de Datos Personales once that body is operational. This penalty structure is statutory and enacted, but its practical availability depends entirely on the Agencia's institutional readiness. With the Agencia's Consejo Directivo not yet seated, following the Senate's rejection of the Executive's proposed slate on 20 May 2026, there is currently no body empowered to impose this fine or exercise any of the Agencia's other enforcement powers under the new law.

This creates a period during which Chile's maximum data-protection penalty exists in statutory form without operational enforcement capacity behind it. The duration of that period is tied directly to the same institutional question affecting the broader regulatory framework: whether a revised Council slate is confirmed before 1 December 2026, or whether the pending postponement bill delays full commencement, and with it the Agencia's enforcement powers, to 1 December 2027.

Outlook

The enforcement-and-redress picture for Chile cannot move independently of the institutional question affecting the Agencia's Consejo Directivo. Until that council is seated, the 20,000 UTM maximum fine and the Agencia's other statutory enforcement powers remain unenforceable in practice, regardless of their formal legal status under Ley 21.719.

Sources and claims (10)

Probable IAPP — <cite index="11-7">The Agency has functions to issue instructions, interpret the regulation's provisions, oversee compliance with obligations, determine non-compliance, exercise sanctioning power, resolve data subjects' requests and complaints, conduct promotional and dissemination activities, propose measures to the President and Congress, provide technical assistance to autonomous bodies, enter cooperation agreements, participate with international organisations, and certify and supervise compliance models. observed 2026-08-05
Probable IAPP — <cite index="15-23,15-24">Infringements by data controllers of the principles, rights and obligations established by the law are classified, according to gravity, as minor, serious and very serious, with minor infringements sanctioned by written warning or fines. observed 2026-08-05
Probable IAPP — <cite index="43-13">In cases of repeated very serious infringements within a 24-month period, the control authority may order suspension of the data controller's processing operations and activities for up to 30 days, extendable indefinitely until corrective measures are adopted. observed 2026-08-05
Probable IAPP — <cite index="35-9">Ley 19.628 establishes only the duty to indemnify patrimonial and moral damage caused by improper data processing, without prejudice to eliminating, modifying or blocking data as required by the data subject or ordered by a court. observed 2026-08-05
Probable IAPP — <cite index="41-1,41-2">Recently, in January 2026, via the public-sector adjustment bill, rules were approved establishing that the Agency's Consejo Directivo must be designated before 1 June 2026, and that if the Senate does not act before that date the presidential proposal of counsellors will be deemed accepted. observed 2026-08-05
Probable IAPP — <cite index="2-8">A parliamentary-motion bill (Boletín N.º 18.060-07) intended to perfect aspects of Ley N.º 21.719 is currently in first constitutional procedure. observed 2026-08-05
Probable Factor-AI — Ley N21.719 — Ley 21.719 sets maximum administrative fines of 20,000 UTM for the most serious infractions, tripled on recidivism, or up to 4% of annual revenue for large companies. observed 2026-09-28
Probable Varela Abogados — Boletín N°18.623-07 — extend the 12-month written-warning-instead-of-fine leniency under Ley 21.719's sixth transitional article to all companies regardless of size (currently limited to smaller companies) observed 2026-10-25
Uncertain XMS LATAM — Ley N°21.719 — Secondary sources report a maximum administrative fine of 20,000 UTM for the gravest infractions (versus roughly 50 UTM under prior Ley 19.628), with recidivism potentially raising exposure to up to 4% of annual revenue; not independently verified against the statute's own sanctions article. observed 2026-11-08
Probable BCN - Ley Chile — Ley N°21.719 — Art. 23 governs the exercise of data-subject rights, the administrative tutela procedure, and the reclamo de ilegalidad before the courts where a controller refuses or fails to satisfy a rights request. observed 2026-11-08

No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-08. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 71 claim(s) (71 category placement(s)), 32 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 3 Nov 2026: not upheld (8 confirmed against the cited source; 2 contradicted by the cited source; 3 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map

GDPR article to category mapping
Article	Category	Sub-module
`Art. 5`	Controller/Processor Duties	accountability and dpia
`Art. 6`	Lawful Processing & Special Data	lawful bases
`Art. 7`	Lawful Processing & Special Data	consent thresholds
`Art. 9`	Lawful Processing & Special Data	special categories
`Art. 13`	Data Subject Rights	access right
`Art. 14`	Data Subject Rights	access right
`Art. 15`	Data Subject Rights	access right
`Art. 16`	Data Subject Rights	rectification and erasure
`Art. 17`	Data Subject Rights	rectification and erasure
`Art. 18`	Data Subject Rights	restriction and objection
`Art. 19`	Data Subject Rights	rectification and erasure
`Art. 20`	Data Subject Rights	data portability
`Art. 21`	Data Subject Rights	restriction and objection
`Art. 22`	Algorithmic, Biometric & Surveillance Governance	automated decision making transparency
`Art. 25`	Controller/Processor Duties	accountability and dpia
`Art. 28`	Controller/Processor Duties	joint controller arrangements
`Art. 30`	Controller/Processor Duties	ropa requirements
`Art. 32`	Controller/Processor Duties	security measures
`Art. 33`	Controller/Processor Duties	breach notification
`Art. 34`	Controller/Processor Duties	breach notification
`Art. 35`	Controller/Processor Duties	accountability and dpia
`Art. 37`	Controller/Processor Duties	dpo requirements
`Art. 38`	Controller/Processor Duties	dpo requirements
`Art. 39`	Controller/Processor Duties	dpo requirements
`Art. 44`	Cross-Border & Adequacy	transfer mechanisms
`Art. 45`	Cross-Border & Adequacy	adequacy received
`Art. 46`	Cross-Border & Adequacy	sccs and bcrs
`Art. 47`	Cross-Border & Adequacy	sccs and bcrs
`Art. 48`	Cross-Border & Adequacy	transfer impact assessment
`Art. 49`	Cross-Border & Adequacy	transfer mechanisms
`Art. 77`	Enforcement & Redress	private right of action
`Art. 78`	Enforcement & Redress	regulator powers and penalties
`Art. 79`	Enforcement & Redress	private right of action
`Art. 80`	Enforcement & Redress	collective redress and class actions
`Art. 81`	Enforcement & Redress	regulator powers and penalties
`Art. 82`	Enforcement & Redress	private right of action
`Art. 83`	Enforcement & Redress	regulator powers and penalties
`Art. 84`	Enforcement & Redress	regulator powers and penalties

Chile Data Protection & Privacy Regulation

Jurisdiction brief

Latest update · 8 November 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Standing brief · as of 28 September 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Regulatory Status

Outlook

Chile: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾#

Sub-modules (5)

Regulator And AuthorityAmber

Act And InstrumentsAmber

Material ScopeAmber

Territorial ScopeAmber

Regulator Registration And FilingAmber

Regulator & Framework

Outlook

Regulator & Framework

Outlook

Regulator & Framework

Outlook

Chile: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾#

Sub-modules (4)

Lawful BasesAmber

Consent ThresholdsAmber

Special CategoriesAmber

Pseudonymisation And AnonymisationAmber

Chile: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾#

Sub-modules (5)

Access RightAmber

Rectification And ErasureAmber

Restriction And ObjectionAmber

Data PortabilityAmber

Deadlines And Response WindowsAmber

Chile: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾#

Sub-modules (7)

Accountability And DpiaAmber

Dpo RequirementsAmber

Ropa RequirementsAmber

Joint Controller ArrangementsRed

Security MeasuresAmber

Breach NotificationAmber

Retention And DisposalAmber

Chile: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾#

Sub-modules (6)

Transfer MechanismsAmber

Adequacy ReceivedRed

Adequacy GrantedRed

Sccs And BcrsAmber

Transfer Impact AssessmentRed

Data LocalisationRed

Chile: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾#

Sub-modules (7)

Financial Sector OverlayAmber

Health Sector OverlayRed

Telecoms And EprivacyRed

Employment DataAmber

Credit And ScoringAmber

EducationRed

InsuranceRed

Chile: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾#

Sub-modules (6)

Cookies And TrackersRed

Dark PatternsRed

Opt Out SignalsRed

Clean Rooms And DcrRed

Cross Context AdvertisingRed

Direct MarketingAmber

Chile: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾#

Sub-modules (6)

Profiling RestrictionsAmber

Automated Decision Making TransparencyAmber

Ai Risk AssessmentsAmber

Biometric RegimeAmber

#

#

#

#

#

#

#

#

#

#