Countries › Chile › Guide › 13. Regulation › Cybersecurity law in Chile: who is covered by Ley Nº 21.663, the 3 hour incident alert, vital operators and fines

Cybersecurity law in Chile: who is covered by Ley Nº 21.663, the 3 hour incident alert, vital operators and fines

Last verified: 2026-10-26 · Status: Changing

The Ley Marco de Ciberseguridad covers essential service providers in energy, fuel, water, telecoms, digital and IT services, transport, banking and payments, social security, post, health and pharma, plus companies designated as operators of vital importance. Covered institutions must send the national CSIRT an early alert within 3 hours of a significant incident, an update within 72 hours (24 for affected vital operators) and a final report within 15 days. The reporting duties have applied since 1 March 2025, the vital operator lists were approved in 2025 and July 2026, and fines reach 20,000 UTM, or 40,000 UTM for vital operators.

USD figures use the Central Bank exchange rate of CLP 986.58 per US dollar published in the Diario Oficial for 23 October 2026 (CVE 2891564). UF figures use the SII value of CLP 41,221.08 for 26 October 2026, and UTM and UTA figures the SII values of CLP 72,151 and CLP 865,812 for October 2026. Conversions are for orientation only.

Key facts

Early alert to the national CSIRT after a significant incident	3 hoursLey Nº 21.663 art. 9 a), as of 2026-10-26 · in force
Incident update deadline	72 hoursLey Nº 21.663 art. 9 b), as of 2026-10-26 · in force
Incident update deadline for affected vital operators	24 hoursLey Nº 21.663 art. 9 b), as of 2026-10-26 · in force
Final incident report deadline after the alert	15 calendar daysLey Nº 21.663 art. 9 c), as of 2026-10-26 · in force
Maximum fine, very serious infringement	20,000 UTMLey Nº 21.663 art. 40, as of 2026-10-26 · in force
Maximum fine for vital operators, very serious infringement	40,000 UTMLey Nº 21.663 art. 40, as of 2026-10-26 · in force
Incident reporting and sanctions in force	2025-03-01 dateDFL Nº 1 of 2024 art. 2, as of 2026-10-26 · in force

The rule

1. The law applies to institutions providing essential services and to those designated as operators of vital importance. Essential services are those provided by State bodies and the national grid coordinator, those under public service concessions, and those of private firms in power generation, transmission or distribution; fuel transport, storage or distribution; drinking water and sanitation; telecommunications; digital infrastructure; digital services and IT services managed by third parties; land, air, rail and sea transport and their infrastructure; banking, financial services and payments; social security benefits administration; postal and courier services; institutional health care; and pharmaceutical production or research. The Agencia Nacional de Ciberseguridad (ANCI) can add services after public consultation.
Cost to do it: No registration fee. The cost is the compliance programme.
Example: A Chilean cloud hosting provider serving local banks falls under digital infrastructure and managed IT services. / A foreign SaaS provider serving Chilean clients should check whether it provides digital services within art. 4; the law sets no size test for essential services.Ley Nº 21.663, Ley Marco sobre Ciberseguridad e Infraestructura Crítica de la Información (DO 8 April 2024), Art. 4, 2024-04-08 official text · verified 2026-10-26

2. ANCI designates operators of vital importance among essential service providers whose service depends on networks and IT systems and whose disruption would have a significant impact on security, public order, essential services or State functions; private firms outside the essential list can be designated if they play a critical role in supply or are highly exposed. The size of the firm, and especially the needs of small and medium companies, must be considered. Designations are reviewed at least every three years after sector reports and a 30 calendar day public consultation. The first round was split in two stages: Resolución Exenta Nº 87 of 2025 approved the first list (power, telecoms, digital and IT services, banking and payments, health, State companies and public bodies), and Resolución Exenta Nº 187 of 21 July 2026 (DO 24 July 2026) approved the second (fuel, water and sanitation, transport, public service concessionaires, social security, pharmaceuticals, and essential services left out of the first list).
Cost to do it: Designation itself has no fee; it brings the heavier duties and fine scale of vital operators.
Example: A water utility named in the July 2026 list must now meet the art. 8 duties for vital operators. / Same in USD terms.Ley Nº 21.663; ANCI Resolución Exenta Nº 187 of 2026 (second stage list of operators of vital importance), Ley Nº 21.663 art. 5 and art. 6; Res. Ex. Nº 187 articulo primero, 2026-07-24 official text · verified 2026-10-26

3. All covered institutions must apply measures to prevent, report and resolve incidents, following ANCI protocols and sector standards. Operators of vital importance must also run a continuous information security management system and keep records of it; adopt continuity and cybersecurity plans, certified and reviewed at least every two years; run continuous reviews, exercises and drills; contain incidents quickly; hold the certifications required by art. 28; inform potentially affected people when ANCI requires it; train staff; and appoint a cybersecurity delegate as ANCI's counterpart, reporting to management.
Cost to do it: Certification under art. 28 and security programmes are private costs; the law fixes no fee.
Example: A bank designated as a vital operator must have its continuity plan certified and reviewed at least every two years. / Same in USD terms.Ley Nº 21.663, Art. 7 and art. 8, 2024-04-08 official text · verified 2026-10-26

4. Covered institutions must report to the national CSIRT cyber attacks and incidents that may have significant effects: an early alert within 3 hours of becoming aware; an update with an initial assessment of severity, impact and indicators of compromise within 72 hours, or 24 hours for an operator of vital importance whose essential service is affected; and a final report within 15 calendar days of the alert, replaced by a status report if the incident is still ongoing. Vital operators must also send their action plan, adopted within 7 calendar days at the latest. An incident is significant if it can interrupt an essential service, affect people's health or physical safety, or affect systems containing personal data, judged by the number of people affected, duration and geographic reach. Reports must exclude personal data, though IP addresses are not treated as personal data for this purpose. The detailed reporting rules are in Decreto Nº 295 of the Ministerio del Interior, published on 1 March 2025.
Cost to do it: No fee; the cost is a 24 hour incident detection and reporting capability.
Example: An incident detected at 22:00 on a Friday must be alerted to the CSIRT by 01:00 on Saturday. / The clock runs from awareness, not from confirmation of the cause.Ley Nº 21.663; Decreto Nº 295, Reglamento de Reporte de Incidentes de Ciberseguridad (DO 1 March 2025), Ley Nº 21.663 art. 9 and art. 27, 2025-03-01 official text · verified 2026-10-26

5. The law's rules apply from 1 January 2025, except the rules on vital operators (art. 5), their specific duties (art. 8), incident reporting (art. 9) and the sanctions title, which apply from 1 March 2025. Infringements are minor, serious or very serious. Fines are up to 5,000, 10,000 and 20,000 UTM respectively, and up to 10,000, 20,000 and 40,000 UTM for operators of vital importance. The fine depends on the security measures taken, the probability of the incident, exposure to risk, the severity of effects, repeat offending within three years, and size and economic capacity. The same facts cannot be sanctioned twice, and infringements prescribe after three years.
Cost to do it: Fines up to 20,000 UTM (about CLP 1,443 million or US$1.46 million), or 40,000 UTM (about CLP 2,886 million or US$2.93 million) for vital operators.
Example: A payments firm designated as a vital operator that fails to report a ransomware attack faces up to 40,000 UTM if the infringement is very serious. / About US$2.93 million in that example.Ley Nº 21.663; DFL Nº 1 of 2024, Ministerio del Interior y Seguridad Pública (DO 24 December 2024), Ley Nº 21.663 art. 38, art. 39 and art. 40; DFL Nº 1 art. 1 and art. 2, 2024-12-24 official text · verified 2026-10-26 · changed: DFL Nº 1 of 2024 set 1 January 2025 as the start of ANCI and of most of the law, and 1 March 2025 for vital operator designation, their specific duties, incident reporting and sanctions.

Step	Deadline	Content
Early alert	3 hours from awareness	Occurrence of the event
Update	72 hours (24 hours for a vital operator whose essential service is affected)	Initial assessment, severity, impact, indicators of compromise
Action plan (vital operators)	Adopted within 7 calendar days, sent as soon as adopted	Response plan
Final report	15 calendar days from the alert	Description, threat type, mitigation, cross border effects

Incident reporting clock under Ley Nº 21.663 art. 9

Worked example

A fuel distributor named in the July 2026 vital operator list suffers ransomware that stops dispatch at 09:00. It must alert the CSIRT by 12:00, update within 24 hours because its essential service is affected, adopt an action plan within 7 days and file a final report within 15 days of the alert. If the attack exposed customer data with reasonable risk, it must also notify the data protection Agency under Ley Nº 19.628 art. 14 sexies from 1 December 2026.

Step by step

1. Check whether any line of business falls within art. 4 and whether the company appears in Res. Ex. Nº 87 of 2025 or Res. Ex. Nº 187 of 2026.
2. Set up 24 hour detection and a reporting runbook for the 3, 72 (or 24) hour and 15 day steps.
3. Vital operators: appoint the cybersecurity delegate, document the security management system, certify continuity plans and train staff.
4. Align the cyber runbook with data breach notices to the data protection Agency.

Common traps

Waiting for forensic certainty: the 3 hour clock runs from awareness of an incident that may have significant effects (art. 9 a).
Including personal data in CSIRT reports: they must be omitted (art. 27).
Assuming only large firms are covered: essential services are defined by activity; size only matters for vital operator designation and for differentiated measures (art. 5 and 7).

Sources

← Anti money laundering in Chile: who reports to the UAF, suspicious transaction and cash reports, record keeping and finesEnvironmental enforcement in Chile: SMA infringements and fines, self reporting, compliance programmes, damage liability and environmental crimes →