Chile Data Protection & Privacy Regulation

Other Developments

A separate strand of the same pending bill touches enforcement tone rather than timing. Law 21.719's sixth transitional article currently allows the APDP to issue a written warning instead of a fine during the first twelve months the law is in force, but only for smaller companies. Boletín N°18.623-07 proposes extending that leniency to companies of all sizes. This is still at the consultation stage within the same bill working through the Senate and has not been enacted. It is a secondary feature of the postponement debate rather than a standalone enforcement reform, but it signals that legislators are treating the transition period as something to be softened broadly, not just delayed.

Worth noting for context: a separate instrument, Law N°21.806, had already amended Law 21.719's fourth transitional article earlier in the year, requiring that the first designation of Consejo Directivo members occur six months before the law's entry into force, which under the original 1 December 2026 commencement date meant a nomination deadline of 1 June 2026. That deadline passed without a Council being seated, which is the backdrop against which the current postponement proposal is being considered.

Cross-Monitor Connections

The same underlying development, a stalled licensing-equivalent authority and a pending bill altering the online-gambling sector's compliance timeline, is tracked in parallel for Chile on the advennt gambling-regulation monitor this period, where a different instrument (the pending online-gambling omnibus bill) is moving through the Senate on its own, unconnected timeline. No other monitor among financial-integrity, world-payments, artificial-intelligence or crypto carries a related Chile development this period.

Outlook

Two dates now govern the outlook for Chile's data-protection framework. The first is 1 December 2026, the commencement date currently fixed in law; the second is whatever date the Senate ultimately settles on if Boletín N°18.623-07 passes before that deadline arrives, with 1 December 2027 the date currently proposed. Whether the Senate floor votes on the postponement bill before year end, and whether the Executive submits a new Consejo Directivo nominee slate following the 20 May 2026 rejection, are the two developments most likely to resolve the uncertainty. Until a Council is seated, the APDP cannot become operationally active regardless of which commencement date ultimately governs, so the appointment question is, if anything, the more consequential of the two to watch.

1 earlier update not shown here.

Standing brief · as of 28 September 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Chile's comprehensive data-protection reform, Ley N21.719, faces a live threat to its own commencement date. The law, which comprehensively reforms the existing Ley N19.628, carries a statutory effective date of 1 December 2026. On 1 September 2026 the Executive submitted Boletin N18.623-07 to the Senate with suma urgencia, proposing to postpone that effective date by a full year, to 1 December 2027, and simultaneously to enlarge the governing council of the Agencia de Proteccion de Datos Personales, the APDP, from three members to five. As of the most recent status located this cycle, spanning 17 to 22 September 2026, the postponement bill remains in its first constitutional stage, with no committee report or floor vote yet held. The legally operative position, therefore, is that Ley 21.719 is still scheduled to take effect on 1 December 2026 unless and until the postponement bill is actually enacted.

The root cause of the postponement push is institutional rather than substantive: the Senate rejected the government's proposed slate of APDP Consejo Directivo nominees on 19 May 2026, falling short of the required two-thirds quorum by a vote of 19 in favour to 12 against. The consequence is that Chile's data-protection enforcement authority does not yet exist in operational form, its governing council unconstituted, even as the substantive law that authority would enforce approaches its scheduled commencement date. The postponement bill's proposed expansion of the council from three to five members, each designated by the President with two-thirds Senate approval for six-year non-renewable terms, is a direct legislative response to the difficulty of assembling a qualified majority around a smaller slate.

Other Developments

The substantive provisions of Ley 21.719 remain in the same posture as before, enacted but not yet effective, pending the outcome of the timing dispute. This includes the law's establishment of full ARCO rights, access, rectification, cancellation, and opposition, structured along GDPR-aligned lines, and its requirements for controllers and processors, including designation of a data-protection-officer analogue, maintenance of records of processing activities, and completion of data protection impact assessments for high-risk processing. None of these obligations has changed in substance this cycle; what has changed is the increased uncertainty around exactly when they become legally operative.

Cross-Monitor Connections

The unconstituted state of the APDP's governing council has a direct bearing on Chile's broader financial-services regulatory landscape tracked by the financial-integrity monitor, insofar as data-protection enforcement capacity and financial-sector AML/CFT enforcement capacity both depend on functioning regulatory institutions being properly constituted; readers tracking Chile's institutional capacity generally may find it useful to read this development alongside financial-integrity's coverage of Chile's own contested administrative-powers legislation this cycle. No adtech, biometric, or cross-border-transfer developments are addressed in this brief, as none met the bar for material content this cycle.

Outlook

The item to watch is straightforward: will Boletin N18.623-07 clear the Senate before 1 December 2026 arrives. If it does not, Ley 21.719 will take effect on its currently scheduled date regardless of whether the APDP's council has been constituted in time to administer it, a scenario that would leave a fully effective statute without a fully operational enforcement authority. If the postponement bill does pass, the effective date moves to 1 December 2027 and the council-expansion provisions take effect alongside it, giving the government a second opportunity to assemble the two-thirds Senate majority the original slate failed to achieve in May 2026.

Ley N21.719 sets a maximum administrative fine of 20,000 UTM, approximately CLP 1,400 million, for the gravest infractions, to be imposed by the Agencia once operational; with the Consejo Directivo unseated, this penalty structure currently has no body empowered to enforce it. Ley 19.628 remains the operative legal regime for personal-data processing throughout the transition period, meaning the substantive changes Ley 21.719 would introduce, across lawful processing, data subject rights, and controller/processor duties, have not yet taken practical effect regardless of the law's enacted status.

Outlook

The determinative question is whether the Senate confirms a revised Council slate before 1 December 2026, allowing the Agencia to become operational on schedule, or whether the pending postponement bill is enacted first, delaying full commencement to 1 December 2027. Both the Agencia's enforcement powers and the substantive rights and duties the new law introduces remain contingent on this unresolved institutional question.