--- title: "Chile Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/chile-data-protection-privacy-regulation/ source_html: /jurisdictions/chile/index.html description: "Chile data protection and privacy regulation: 10 categories, 60 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 3384788e9fea64fad3f876a27ed6aef20ec74a01d6bc916149ff6b79374d012e generator: "fe-fleet/md-twin@1.0" --- # Chile Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed in transition overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/chile/), [World Payments](https://payments.gi/jurisdictions/chile/), artificial-intelligence Last updated 2026-10-25 · 10 categories · 60 claims · 29 sources in the cumulative register Download report (PDF) Expand all Chile's comprehensive data-protection reform, Ley N21.719, faces a live threat to its own commencement date. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (5 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=CHILE)[Build Report](/reports/?j=CHILE)[Compare](/compare/?j=CHILE) Framework posture In transition 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Agencia de Protección de Datos Personales (APDP) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 1 Red categories 57 Sub-modules 60 Claims 0 Tier-1 sources Traffic-light mix 9 amber 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red ## Jurisdiction brief Jurisdiction lead brief 1,169 Full executive summary 271 ###### Latest update · 25 October 2026 #### Lead Signal Chile's data-protection regime is moving through an unusually active transition. Law N°21.719, the statute that creates the country's first dedicated data-protection authority, the Agencia de Protección de Datos Personales (APDP), is currently due to enter fully into force on 1 December 2026. That timeline is now in question: a bill carried under Boletín N°18.623-07 was approved in general, by unanimous vote, by the Senate's Constitution Committee on 19 October 2026, and the Executive has elevated its urgency to immediate discussion. If enacted, the bill would push the law's full commencement back a year, to 1 December 2027. At the same time, the APDP's governing body, a three-member Consejo Directivo, remains unappointed. The Senate rejected the Executive's first slate of nominees on 20 May 2026 for failing to reach the two-thirds quorum required under article 30 quáter of Law 21.719, and as of reporting from 11 to 19 October 2026 no replacement slate had been submitted. The combination, a regulator without a seated board and a commencement date under active legislative threat, leaves the practical operability of the new regime genuinely uncertain going into the final quarter before the current statutory deadline. #### Other Developments A separate strand of the same pending bill touches enforcement tone rather than timing. Law 21.719's sixth transitional article currently allows the APDP to issue a written warning instead of a fine during the first twelve months the law is in force, but only for smaller companies. Boletín N°18.623-07 proposes extending that leniency to companies of all sizes. This is still at the consultation stage within the same bill working through the Senate and has not been enacted. It is a secondary feature of the postponement debate rather than a standalone enforcement reform, but it signals that legislators are treating the transition period as something to be softened broadly, not just delayed. Worth noting for context: a separate instrument, Law N°21.806, had already amended Law 21.719's fourth transitional article earlier in the year, requiring that the first designation of Consejo Directivo members occur six months before the law's entry into force, which under the original 1 December 2026 commencement date meant a nomination deadline of 1 June 2026. That deadline passed without a Council being seated, which is the backdrop against which the current postponement proposal is being considered. #### Cross-Monitor Connections The same underlying development, a stalled licensing-equivalent authority and a pending bill altering the online-gambling sector's compliance timeline, is tracked in parallel for Chile on the advennt gambling-regulation monitor this period, where a different instrument (the pending online-gambling omnibus bill) is moving through the Senate on its own, unconnected timeline. No other monitor among financial-integrity, world-payments, artificial-intelligence or crypto carries a related Chile development this period. #### Outlook Two dates now govern the outlook for Chile's data-protection framework. The first is 1 December 2026, the commencement date currently fixed in law; the second is whatever date the Senate ultimately settles on if Boletín N°18.623-07 passes before that deadline arrives, with 1 December 2027 the date currently proposed. Whether the Senate floor votes on the postponement bill before year end, and whether the Executive submits a new Consejo Directivo nominee slate following the 20 May 2026 rejection, are the two developments most likely to resolve the uncertainty. Until a Council is seated, the APDP cannot become operationally active regardless of which commencement date ultimately governs, so the appointment question is, if anything, the more consequential of the two to watch. 1 earlier update not shown here. ###### Standing brief · as of 28 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Chile's comprehensive data-protection reform, Ley N21.719, faces a live threat to its own commencement date. The law, which comprehensively reforms the existing Ley N19.628, carries a statutory effective date of 1 December 2026. On 1 September 2026 the Executive submitted Boletin N18.623-07 to the Senate with suma urgencia, proposing to postpone that effective date by a full year, to 1 December 2027, and simultaneously to enlarge the governing council of the Agencia de Proteccion de Datos Personales, the APDP, from three members to five. As of the most recent status located this cycle, spanning 17 to 22 September 2026, the postponement bill remains in its first constitutional stage, with no committee report or floor vote yet held. The legally operative position, therefore, is that Ley 21.719 is still scheduled to take effect on 1 December 2026 unless and until the postponement bill is actually enacted. The root cause of the postponement push is institutional rather than substantive: the Senate rejected the government's proposed slate of APDP Consejo Directivo nominees on 19 May 2026, falling short of the required two-thirds quorum by a vote of 19 in favour to 12 against. The consequence is that Chile's data-protection enforcement authority does not yet exist in operational form, its governing council unconstituted, even as the substantive law that authority would enforce approaches its scheduled commencement date. The postponement bill's proposed expansion of the council from three to five members, each designated by the President with two-thirds Senate approval for six-year non-renewable terms, is a direct legislative response to the difficulty of assembling a qualified majority around a smaller slate. #### Other Developments The substantive provisions of Ley 21.719 remain in the same posture as before, enacted but not yet effective, pending the outcome of the timing dispute. This includes the law's establishment of full ARCO rights, access, rectification, cancellation, and opposition, structured along GDPR-aligned lines, and its requirements for controllers and processors, including designation of a data-protection-officer analogue, maintenance of records of processing activities, and completion of data protection impact assessments for high-risk processing. None of these obligations has changed in substance this cycle; what has changed is the increased uncertainty around exactly when they become legally operative. #### Cross-Monitor Connections The unconstituted state of the APDP's governing council has a direct bearing on Chile's broader financial-services regulatory landscape tracked by the financial-integrity monitor, insofar as data-protection enforcement capacity and financial-sector AML/CFT enforcement capacity both depend on functioning regulatory institutions being properly constituted; readers tracking Chile's institutional capacity generally may find it useful to read this development alongside financial-integrity's coverage of Chile's own contested administrative-powers legislation this cycle. No adtech, biometric, or cross-border-transfer developments are addressed in this brief, as none met the bar for material content this cycle. #### Outlook The item to watch is straightforward: will Boletin N18.623-07 clear the Senate before 1 December 2026 arrives. If it does not, Ley 21.719 will take effect on its currently scheduled date regardless of whether the APDP's council has been constituted in time to administer it, a scenario that would leave a fully effective statute without a fully operational enforcement authority. If the postponement bill does pass, the effective date moves to 1 December 2027 and the council-expansion provisions take effect alongside it, giving the government a second opportunity to assemble the two-thirds Senate majority the original slate failed to achieve in May 2026. Read full brief · 1169 words Standing brief, as of 11 October 2026. #### Regulatory Status Chile's data-protection regime is in a state of institutional uncertainty. Ley N21.719, a comprehensive GDPR-influenced reform enacted 13 December 2024 to replace the 1999 Ley N19.628, was structured with a 24-month transition period originally ending 1 December 2026. That timeline is now materially at risk: the Senate rejected the Executive's proposed first Consejo Directivo slate for the Agencia de Proteccion de Datos Personales on 20 May 2026 (19 votes in favour, 12 against, short of the required two-thirds quorum under article 30 quater), and as of 2 October 2026 a bill to postpone full entry into force to 1 December 2027 was pending before the Senate, with the Agencia still lacking a governing council. Ley N21.719 sets a maximum administrative fine of 20,000 UTM, approximately CLP 1,400 million, for the gravest infractions, to be imposed by the Agencia once operational; with the Consejo Directivo unseated, this penalty structure currently has no body empowered to enforce it. Ley 19.628 remains the operative legal regime for personal-data processing throughout the transition period, meaning the substantive changes Ley 21.719 would introduce, across lawful processing, data subject rights, and controller/processor duties, have not yet taken practical effect regardless of the law's enacted status. #### Outlook The determinative question is whether the Senate confirms a revised Council slate before 1 December 2026, allowing the Agencia to become operational on schedule, or whether the pending postponement bill is enacted first, delaying full commencement to 1 December 2027. Both the Agencia's enforcement powers and the substantive rights and duties the new law introduces remain contingent on this unresolved institutional question. Read full brief · 271 words Key regulatory facts for Chile Regulatory Dimension Chile Standing Position Jurisdiction Chile (CL) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 60 sourced findings) Regulator & Framework Statute enacted and constitutionally validated, but the regulator is not yet operational and the implementing regulation is not yet finalized; current in-force law (Ley 19.628) is materially weaker than the incoming... Lawful Processing & Special Data Expanded lawful bases and sensitive-data regime are enacted but not yet effective (1 Dec 2026); current regime is narrower. Data Subject Rights Rights expansion enacted but not yet effective; current ARCO regime under Ley 19.628 is narrower and lacks portability/blocking/ADM-opposition rights. Controller/Processor Duties Core accountability and breach/security duties are enacted but not yet effective; DPO is only conditionally mandatory and no formal RoPA is required, both material divergences from GDPR. Primary Instruments Cited IAPP, IAPP, IAPP, IAPP, IAPP Last Confirmed / Updated 2026-10-25 (29 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Chile: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Statute enacted and constitutionally validated, but the regulator is not yet operational and the implementing regulation is not yet finalized; current in-force law (Ley 19.628) is materially weaker than the incoming regime. Primary framework Ley N.º 21.719 (modifying Ley N.º 19.628 sobre Protección de la Vida Privada), in force 1 December 2026 Supervisory authority Agencia de Protección de Datos Personales (APDP) Traffic-light rationale — Amber Statute enacted and constitutionally validated, but the regulator is not yet operational and the implementing regulation is not yet finalized; current in-force law (Ley 19.628) is materially weaker than the incoming regime. #### Sub-modules (5) #### Regulator And AuthorityAmber The APDP is an autonomous, decentralized public-law corporation with its own legal personality and patrimony, relating to government via the Ministry of Economy, governed by a 3-member Consejo Directivo; the Council must be appointed before 1 June 2026 per a January 2026 public-sector adjustment law. Claims (7): - The Agencia de Protección de Datos Personales is an autonomous, technical, decentralized public-law corporation with its own legal personality and patrimony, relating to government through the Ministry of Economy, and is governed by a directive council made up of three counsellors. - Under a January 2026 public-sector adjustment law, the Agency's Consejo Directivo must be designated before 1 June 2026, requiring the presidential nomination to occur between March and April. - Agencia de Protección de Datos Personales (APDP) — APDP's three-member Consejo Directivo remains unappointed; Senate rejected the Executive's first nominee slate on 20 May 2026 for failing the two-thirds quorum required under Ley 21.719 art. 30 quáter; no new slate submitted as of 11-19 Oct 2026 reporting - Boletin N18.623-07, submitted by the Executive to the Senate on 1 September 2026 with suma urgencia, proposes postponing Ley 21.719's entry into force from 1 December 2026 to 1 December 2027 and enlarging the APDP's Consejo Directivo from three to five members. - Boletin N18.623-07 — As of the most recent status located this cycle (17-22 September 2026), the bill remains in first constitutional stage with no committee report or floor vote yet held; the legally operative effective date therefore remains 1 December 2026 pending any enacted amendment. - Senate of Chile — The Senate rejected the government's proposed slate of APDP Consejo Directivo members on 19 May 2026, falling short of the required two-thirds quorum (19 in favour, 12 against), leaving the Agency's governing council unconstituted. - Boletin N18.623-07 — Boletin 18.623-07 proposes enlarging the APDP Consejo Directivo from three to five members, designated by the President with two-thirds Senate approval, serving six-year non-renewable terms. #### Act And InstrumentsAmber Ley 19.628 (1999) remains operative today; Ley 21.719 (enacted, not yet effective) and its implementing Decreto Supremo N.º 662 (Reglamento on Compliance Models, pending Contraloría review) both commence 1 December 2026. Claims (6): - Ley N.º 21.719, which regulates the protection and treatment of personal data and creates the Agencia de Protección de Datos Personales, enters into force on 1 December 2026. - Ley N.º 19.628 sobre protección a la vida privada (1999) remains the current operative statute governing personal data processing in Chile until Ley 21.719 takes effect, as confirmed by multiple 2025-2026 legal commentaries referencing its continued applicability pending the reform's entry into force. - On 13 June 2025 the Ministry of Finance issued Decreto Supremo N.º 662, approving the Regulation governing requirements, modalities and procedures for the implementation, certification, registration and supervision of Infraction Prevention Models, which remains in the process of legality review before the Contraloría General de la República. - Boletín N°18.623-07 — postpone Ley 21.719's full entry-into-force date from 1 December 2026 to 1 December 2027 and enlarge the APDP Consejo Directivo from three to five members (three-member quorum); approved 'en general' by unanimity by the Senate Constitution Committee on 19 October 2026, urgency elevated to 'discusión inmediata' - Ley N21.719, which comprehensively reforms Ley N19.628, has a statutory effective date of 1 December 2026 under its own transitional article. - Ley N°21.806 — Ley 21.719's fourth transitional article so the first designation of the APDP Consejo Directivo must occur six months before the law's entry into force (by 1 June 2026); that deadline passed without a Council being seated #### Material ScopeAmber Ley 21.719 introduces differentiated regimes for biometric data, children/adolescent data, historical/statistical/scientific data, and geolocation data. Claims (1): - Ley 21.719 establishes special regimes for biometric data; data relating to children and adolescents; data used for historical, statistical, scientific or research purposes; and geolocation data. #### Territorial ScopeAmber The law applies extraterritorially to entities constituted in Chile, to processing operations located in Chile, and to entities offering goods or services in Chile; a pending parliamentary bill (Boletín N.º 18.060-07) proposes narrowing this extraterritorial rule. Claims (2): - The regulation applies to subjects constituted in Chilean territory, to those carrying out data-processing operations established in national territory, and to those offering goods or services in Chile, whether through their activities or by application of a contract or international law. - A parliamentary-motion bill (Boletín N.º 18.060-07), currently in first constitutional procedure, proposes to perfect aspects of Ley N.º 21.719, including limiting the law's scope of application with respect to the extraterritorial rule. #### Regulator Registration And FilingAmber There is no mandatory general controller-registration duty; instead, adoption of a voluntary Modelo de Prevención de Infracciones is certified and recorded by the APDP in a National Registry of Sanctions and Compliance. Claims (1): - The law establishes leve, grave and gravísima infringement tiers with a certification-based Infraction Prevention Model recognized by the Agency as a mitigating factor, and certified models are entered into a national registry administered by the Agency. Chile is mid-transition from the 1999 Ley N.º 19.628 sobre Protección de la Vida Privada (a minimal, civil-court-enforced regime with no dedicated regulator) to a GDPR-influenced omnibus regime under Ley N.º 21.719, which creates the Agencia de Protección de Datos Personales (APDP) and enters into force on 1 December 2026. As of the research date the APDP does not yet exist operationally: its 3-member Consejo Directivo must be appointed before 1 June 2026, and its implementing Reglamento (Decreto Supremo N.º 662) remains under constitutionality/legality review (toma de razón) at the Contraloría General de la República. Periodic update · new data 2026-10-25 #### Regulator & Framework Chile's data-protection authority, the Agencia de Protección de Datos Personales (APDP), remains without a seated governing board as the statutory commencement date for Law N°21.719 approaches. The law's three-member Consejo Directivo is to be appointed by the Senate on a two-thirds quorum under article 30 quáter, but the Senate rejected the Executive's first slate of nominees on 20 May 2026 for failing to reach that threshold. As of reporting spanning 11 to 19 October 2026, no replacement slate had been put forward. This gap is material because Law N°21.806 had already amended Law 21.719's fourth transitional article to require that the first Council designation occur six months before the law's entry into force, which under the original 1 December 2026 commencement date fixed a nomination deadline of 1 June 2026. That deadline passed without appointment. Against this backdrop, the Senate's Constitution Committee approved, in general and by unanimous vote on 19 October 2026, a bill under Boletín N°18.623-07 that would postpone Law 21.719's full entry into force from 1 December 2026 to 1 December 2027, and would enlarge the Consejo Directivo from three to five members with a three-member quorum, a structural change apparently intended to make the appointment threshold easier to clear going forward. The Executive has elevated the bill's legislative urgency to immediate discussion, signalling intent to resolve the timing question before the current deadline arrives. The bill has not been enacted, and whether the Senate will floor-vote it, and with what final quorum design, is unresolved. #### Outlook The operative question for the remainder of the year is whether Boletín N°18.623-07 is enacted before 1 December 2026. If it is, the law's full commencement shifts to 1 December 2027 and the Council is reconstituted at five seats. If it is not, Law 21.719 takes effect on schedule without an operating governing board in place, since no nominee slate has yet replaced the one rejected in May. Either path turns on two unresolved facts: whether a new nominee slate is submitted, and whether the Senate completes a floor vote on the postponement bill in the coming weeks. 1 earlier distinct update(s) Periodic update · new data 2026-10-11 #### Regulator & Framework Chile's data-protection framework rests on Ley N21.719, a comprehensive, GDPR-influenced reform enacted 13 December 2024 to replace the 1999 Ley N19.628. The reform was structured with a 24-month transition period originally ending 1 December 2026, during which Ley N19.628 remains the operative legal regime. The institutional foundation for the new law's enforcement, the Agencia de Proteccion de Datos Personales, has encountered a material setback to this timeline: the Senate rejected the Executive's proposed first Consejo Directivo slate on 20 May 2026, with 19 votes in favour and 12 against, falling short of the two-thirds quorum required under Ley 21.719 article 30 quater. As a direct consequence, a bill to postpone the law's full entry into force from 1 December 2026 to 1 December 2027 was pending before the Senate as of 2 October 2026, with the Agencia still lacking a designated governing council at that date. The practical effect is that Chile's comprehensive data-protection reform, enacted on paper more than eighteen months ago, remains dependent on an unresolved institutional question, whether a revised Council slate can secure Senate confirmation before the current transition period expires, or whether the law's commencement is instead formally delayed by a further year. #### Outlook The determinative event to watch is whether the Senate confirms a revised Consejo Directivo slate before 1 December 2026, which would allow the Agencia to become operational on the original schedule, or whether the pending postponement bill is enacted first, pushing full commencement of Ley 21.719 to 1 December 2027. Either outcome resolves the current uncertainty over when Chile's reformed data-protection regime will actually take effect. Sources and claims (17) - [IAPP](https://iapp.org/news/a/aspectos-del-recientemente-aprobado-proyecto-de-ley-que-crea-la-agencia-de-protecci-n-de-datos-personales-en-chile) — The Agencia de Protección de Datos Personales is an autonomous, technical, decentralized public-law corporation with its own legal personality and patrimony, relating to government through the Ministry of Economy, and is governed by a directive council made up of three counsellors. - [IAPP](https://iapp.org/news/a/d-a-de-la-pdp-en-chile-estamos-preparados-para-la-entrada-en-vigor-de-la-normativa) — Under a January 2026 public-sector adjustment law, the Agency's Consejo Directivo must be designated before 1 June 2026, requiring the presidential nomination to occur between March and April. - [IAPP](https://iapp.org/news/a/los-desaf-os-ante-las-regulaciones-tecnol-gicas-en-chile-una-oportunidad-para-la-autorregulaci-n) — Ley N.º 21.719, which regulates the protection and treatment of personal data and creates the Agencia de Protección de Datos Personales, enters into force on 1 December 2026. - [IAPP](https://iapp.org/news/a/el-reglamento-de-seguridad-privada-de-la-ley-n-21-659-y-la-protecci-n-de-datos-personales-en-chile) — Ley N.º 19.628 sobre protección a la vida privada (1999) remains the current operative statute governing personal data processing in Chile until Ley 21.719 takes effect, as confirmed by multiple 2025-2026 legal commentaries referencing its continued applicability pending the reform's entry into force. - [IAPP](https://iapp.org/news/a/se-dictan-nuevos-modelos-de-prevenci-n-de-infracciones-que-modifican-la-ley-de-protecci-n-de-datos-en-chile) — On 13 June 2025 the Ministry of Finance issued Decreto Supremo N.º 662, approving the Regulation governing requirements, modalities and procedures for the implementation, certification, registration and supervision of Infraction Prevention Models, which remains in the process of legality review before the Contraloría General de la República. - [IAPP](https://iapp.org/news/a/aspectos-del-recientemente-aprobado-proyecto-de-ley-que-crea-la-agencia-de-protecci-n-de-datos-personales-en-chile) — Ley 21.719 establishes special regimes for biometric data; data relating to children and adolescents; data used for historical, statistical, scientific or research purposes; and geolocation data. - [IAPP](https://iapp.org/news/a/aspectos-del-recientemente-aprobado-proyecto-de-ley-que-crea-la-agencia-de-protecci-n-de-datos-personales-en-chile) — The regulation applies to subjects constituted in Chilean territory, to those carrying out data-processing operations established in national territory, and to those offering goods or services in Chile, whether through their activities or by application of a contract or international law. - [IAPP](https://iapp.org/news/a/d-a-de-la-pdp-en-chile-estamos-preparados-para-la-entrada-en-vigor-de-la-normativa) — A parliamentary-motion bill (Boletín N.º 18.060-07), currently in first constitutional procedure, proposes to perfect aspects of Ley N.º 21.719, including limiting the law's scope of application with respect to the extraterritorial rule. - [IAPP](https://iapp.org/news/a/aspectos-del-recientemente-aprobado-proyecto-de-ley-que-crea-la-agencia-de-protecci-n-de-datos-personales-en-chile) — The law establishes leve, grave and gravísima infringement tiers with a certification-based Infraction Prevention Model recognized by the Agency as a mitigating factor, and certified models are entered into a national registry administered by the Agency. - [Orbix Consultor](https://orbixconsultor.cl/guias/agencia-proteccion-datos) — Agencia de Protección de Datos Personales (APDP) — APDP's three-member Consejo Directivo remains unappointed; Senate rejected the Executive's first nominee slate on 20 May 2026 for failing the two-thirds quorum required under Ley 21.719 art. 30 quáter; no new slate submitted as of 11-19 Oct 2026 reporting - [https://www.varelaabogados.cl/post/ley-proteccion-datos-personales-chile-21719](https://www.varelaabogados.cl/post/ley-proteccion-datos-personales-chile-21719) — Boletín N°18.623-07 — postpone Ley 21.719's full entry-into-force date from 1 December 2026 to 1 December 2027 and enlarge the APDP Consejo Directivo from three to five members (three-member quorum); approved 'en general' by unanimity by the Senate Constitution Committee on 19 October 2026, urgency elevated to 'discusión inmediata' - [Figueroa & Streit Abogados](https://fys.legal/agencia-proteccion-datos-personales-reclamo/) — Boletin N18.623-07, submitted by the Executive to the Senate on 1 September 2026 with suma urgencia, proposes postponing Ley 21.719's entry into force from 1 December 2026 to 1 December 2027 and enlarging the APDP's Consejo Directivo from three to five members. - [Diario Financiero](https://www.df.cl/df-lab/tech-empresas/senado-rechaza-propuesta-de-kast-de-consejeros-de-la-agencia-de-proteccion) — Ley N21.719, which comprehensively reforms Ley N19.628, has a statutory effective date of 1 December 2026 under its own transitional article. - [RecordingLaw](https://www.recordinglaw.com/es/world-laws/world-data-privacy-laws/chile-data-privacy-laws/) — Boletin N18.623-07 — As of the most recent status located this cycle (17-22 September 2026), the bill remains in first constitutional stage with no committee report or floor vote yet held; the legally operative effective date therefore remains 1 December 2026 pending any enacted amendment. - [XMS Latam](https://xmslatam.com/ley-21719-proteccion-datos-chile/) — Senate of Chile — The Senate rejected the government's proposed slate of APDP Consejo Directivo members on 19 May 2026, falling short of the required two-thirds quorum (19 in favour, 12 against), leaving the Agency's governing council unconstituted. - [Camara de Diputados de Chile](https://www.camara.cl/verDoc.aspx?prmID=18854&prmTIPO=INICIATIVA) — Boletin N18.623-07 — Boletin 18.623-07 proposes enlarging the APDP Consejo Directivo from three to five members, designated by the President with two-thirds Senate approval, serving six-year non-renewable terms. - [Diario Oficial / SEGPRES alert](https://www.doe.cl/alerta/01092026/3f3d97e66706de2d4565) — Ley N°21.806 — Ley 21.719's fourth transitional article so the first designation of the APDP Consejo Directivo must occur six months before the law's entry into force (by 1 June 2026); that deadline passed without a Council being seated ### Chile: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Expanded lawful bases and sensitive-data regime are enacted but not yet effective (1 Dec 2026); current regime is narrower. Primary framework Ley N.º 21.719 (amending Ley N.º 19.628) Supervisory authority Agencia de Protección de Datos Personales (APDP) Traffic-light rationale — Amber Expanded lawful bases and sensitive-data regime are enacted but not yet effective (1 Dec 2026); current regime is narrower. D2 · Lawful Processing — Full Module Record 4 sub-modules · 40 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Chile: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ Rights expansion enacted but not yet effective; current ARCO regime under Ley 19.628 is narrower and lacks portability/blocking/ADM-opposition rights. Primary framework Ley N.º 21.719 (amending Ley N.º 19.628) Supervisory authority Agencia de Protección de Datos Personales (APDP) Traffic-light rationale — Amber Rights expansion enacted but not yet effective; current ARCO regime under Ley 19.628 is narrower and lacks portability/blocking/ADM-opposition rights. #### Sub-modules (5) #### Access RightAmber Access right retained from Ley 19.628 and continued under Ley 21.719, allowing data subjects to obtain confirmation and details of processing. Claims (2): - Data subjects must be permitted the full exercise of their rights of access, rectification, suppression or opposition, and portability, unless a legal limitation exists. - Ley N21.719 — Ley 21.719 establishes full ARCO rights (access, rectification, cancellation, opposition) for data subjects, GDPR-aligned in structure. #### Rectification And ErasureAmber The 'cancelación' right is renamed 'supresión' (erasure) under the new law, alongside rectification. Claims (1): - Regarding data subject rights, in addition to those currently recognized in Ley N.º 19.628 — access, rectification, and cancellation (now termed suppression) and opposition — the new law adds blocking, portability, and opposition to automated decisions. #### Restriction And ObjectionAmber New rights of blocking (bloqueo) and opposition to automated decision-making are introduced. Claims (1): - The rights catalogue is extended to include blocking and opposition to automated decisions. #### Data PortabilityAmber Portability is a newly introduced data subject right under Ley 21.719. Claims (1): - Portability is added as a new data subject right not previously recognized under Ley 19.628. #### Deadlines And Response WindowsAmber Controllers have 30 calendar days (extendable once) to respond to a rights request; denial, partial denial, or silence entitles the data subject to file a claim with the Agency. Claims (1): - An administrative procedure is established under which, if within 30 calendar days following the filing date (extendable once) the request is denied in whole or in part or no response is given, the data subject may file a claim with the Agencia de Protección de Datos Personales. Ley 21.719 expands the classic ARCO (access, rectification, cancellation, opposition) rights into an ARCOP+ scheme: access, rectification, suppression (renamed from cancellation), opposition, blocking, portability, and opposition to automated decision-making/profiling. A 30-calendar-day response window applies, with escalation to the Agency on denial or silence. Sources and claims (6) - [IAPP](https://iapp.org/news/a/el-reglamento-de-seguridad-privada-de-la-ley-n-21-659-y-la-protecci-n-de-datos-personales-en-chile) — Data subjects must be permitted the full exercise of their rights of access, rectification, suppression or opposition, and portability, unless a legal limitation exists. - [IAPP](https://iapp.org/news/a/aspectos-del-recientemente-aprobado-proyecto-de-ley-que-crea-la-agencia-de-protecci-n-de-datos-personales-en-chile) — Regarding data subject rights, in addition to those currently recognized in Ley N.º 19.628 — access, rectification, and cancellation (now termed suppression) and opposition — the new law adds blocking, portability, and opposition to automated decisions. - [IAPP](https://iapp.org/news/a/aspectos-del-recientemente-aprobado-proyecto-de-ley-que-crea-la-agencia-de-protecci-n-de-datos-personales-en-chile) — The rights catalogue is extended to include blocking and opposition to automated decisions. - [IAPP](https://iapp.org/news/a/aspectos-del-recientemente-aprobado-proyecto-de-ley-que-crea-la-agencia-de-protecci-n-de-datos-personales-en-chile) — Portability is added as a new data subject right not previously recognized under Ley 19.628. - [IAPP](https://iapp.org/news/a/aspectos-del-recientemente-aprobado-proyecto-de-ley-que-crea-la-agencia-de-protecci-n-de-datos-personales-en-chile) — An administrative procedure is established under which, if within 30 calendar days following the filing date (extendable once) the request is denied in whole or in part or no response is given, the data subject may file a claim with the Agencia de Protección de Datos Personales. - [Lawwwing](https://lawwwing.com/la-nueva-era-de-la-proteccion-de-datos-en-chile-que-cambia-con-la-ley-21-719/) — Ley N21.719 — Ley 21.719 establishes full ARCO rights (access, rectification, cancellation, opposition) for data subjects, GDPR-aligned in structure. ### Chile: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core accountability and breach/security duties are enacted but not yet effective; DPO is only conditionally mandatory and no formal RoPA is required, both material divergences from GDPR. Primary framework Ley N.º 21.719 (amending Ley N.º 19.628); Decreto Supremo N.º 662 (Reglamento on Compliance Models) Supervisory authority Agencia de Protección de Datos Personales (APDP) Traffic-light rationale — Amber Core accountability and breach/security duties are enacted but not yet effective; DPO is only conditionally mandatory and no formal RoPA is required, both material divergences from GDPR. D4 · Controller & Processor — Full Module Record 7 sub-modules · 66 words · 11 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Chile: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Transfer-mechanism framework is enacted but not yet effective and awaits Agency ratification of model clauses; adequacy in/out and localisation dimensions are unaddressed in available sources. Primary framework Ley N.º 21.719 (amending Ley N.º 19.628), Article 27 Supervisory authority Agencia de Protección de Datos Personales (APDP) Traffic-light rationale — Amber Transfer-mechanism framework is enacted but not yet effective and awaits Agency ratification of model clauses; adequacy in/out and localisation dimensions are unaddressed in available sources. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 81 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Chile: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial-sector overlay is well documented and currently in force; other sectoral overlays (telecoms, education, insurance) show no dedicated findings. Primary framework Ley N.º 21.521 (Ley Fintech); CMF Norma de Carácter General N.º 514; Ley N.º 21.719 (general overlay) Supervisory authority Comisión para el Mercado Financiero (CMF) Traffic-light rationale — Amber Financial-sector overlay is well documented and currently in force; other sectoral overlays (telecoms, education, insurance) show no dedicated findings. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 66 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Chile: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No dedicated adtech-specific regime found; general DP-law rights (opposition/profiling) provide only indirect coverage. Primary framework Ley N.º 21.719 (general overlay only; no dedicated adtech statute identified) Supervisory authority Agencia de Protección de Datos Personales (APDP) Traffic-light rationale — Red No dedicated adtech-specific regime found; general DP-law rights (opposition/profiling) provide only indirect coverage. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 42 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Chile: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core ADM-opposition and biometric provisions are enacted but not yet effective; AI-labelling bill remains a proposal; genetic-data and surveillance-carveout coverage is unconfirmed. Primary framework Ley N.º 21.719 (amending Ley N.º 19.628) Supervisory authority Agencia de Protección de Datos Personales (APDP) Traffic-light rationale — Amber Core ADM-opposition and biometric provisions are enacted but not yet effective; AI-labelling bill remains a proposal; genetic-data and surveillance-carveout coverage is unconfirmed. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 55 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Chile: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A children's-data regime and an under-14 breach-notification threshold are enacted but not yet effective; no dedicated age-verification/parental-consent/profiling-ban mechanism was confirmed. Primary framework Ley N.º 21.719 (amending Ley N.º 19.628); Ley N.º 21.659 (Reglamento de Seguridad Privada, ancillary) Supervisory authority Agencia de Protección de Datos Personales (APDP) Traffic-light rationale — Amber A children's-data regime and an under-14 breach-notification threshold are enacted but not yet effective; no dedicated age-verification/parental-consent/profiling-ban mechanism was confirmed. D9 · Children's Privacy — Full Module Record 5 sub-modules · 62 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Chile: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Enforcement architecture is enacted but the Agency is not yet operational and the penalty framework may still be amended by a pending bill; current in-force redress is limited to civil litigation. Primary framework Ley N.º 21.719 (amending Ley N.º 19.628) Supervisory authority Agencia de Protección de Datos Personales (APDP) Traffic-light rationale — Amber Enforcement architecture is enacted but the Agency is not yet operational and the penalty framework may still be amended by a pending bill; current in-force redress is limited to civil litigation. Periodic update · new data 2026-10-25 #### Enforcement & Redress Chile's data-protection enforcement framework carries a built-in leniency period that is itself now subject to proposed amendment. Law 21.719's sixth transitional article currently permits the APDP to issue a written warning in place of a fine during the first twelve months the law is in force, but that relief is presently limited to smaller companies. The bill under Boletín N°18.623-07, the same instrument proposing to postpone the law's full commencement to 1 December 2027, is understood to propose extending this written-warning leniency to companies of all sizes, removing the size-based limitation. This proposal sits at the consultation stage within the Senate's consideration of the broader bill and has not been enacted; it is a secondary feature of the postponement debate rather than a freestanding enforcement reform. Because the APDP's governing Consejo Directivo remains unappointed, no enforcement activity under Law 21.719, whether a written warning or a fine, can yet occur in practice: the authority empowered to exercise those powers is not yet operationally constituted. The enforcement-tone question, how lenient the first year of the regime will be and for whom, is therefore a live legislative question layered on top of the more basic question of when, and under what governing board, the regime becomes operative at all. #### Outlook Watch whether the broadened written-warning leniency survives into the bill's final text, and whether it is explicitly tied to the postponed 1 December 2027 commencement date or to whatever date ultimately governs. Until the Consejo Directivo is seated, the practical enforcement posture of the APDP, lenient or otherwise, remains theoretical rather than operative. Periodic update · new data 2026-10-11 #### Enforcement & Redress Ley N21.719 establishes a maximum administrative fine of 20,000 UTM, approximately CLP 1,400 million, for the gravest category of data-protection infractions, to be imposed by the Agencia de Proteccion de Datos Personales once that body is operational. This penalty structure is statutory and enacted, but its practical availability depends entirely on the Agencia's institutional readiness. With the Agencia's Consejo Directivo not yet seated, following the Senate's rejection of the Executive's proposed slate on 20 May 2026, there is currently no body empowered to impose this fine or exercise any of the Agencia's other enforcement powers under the new law. This creates a period during which Chile's maximum data-protection penalty exists in statutory form without operational enforcement capacity behind it. The duration of that period is tied directly to the same institutional question affecting the broader regulatory framework: whether a revised Council slate is confirmed before 1 December 2026, or whether the pending postponement bill delays full commencement, and with it the Agencia's enforcement powers, to 1 December 2027. #### Outlook The enforcement-and-redress picture for Chile cannot move independently of the institutional question affecting the Agencia's Consejo Directivo. Until that council is seated, the 20,000 UTM maximum fine and the Agencia's other statutory enforcement powers remain unenforceable in practice, regardless of their formal legal status under Ley 21.719. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 65 words · 8 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties