Countries › Chile › Guide › 13. Regulation › Personal data protection in Chile: Ley Nº 21.719 from 1 December 2026, legal bases, rights, breaches, transfers and fines

Personal data protection in Chile: Ley Nº 21.719 from 1 December 2026, legal bases, rights, breaches, transfers and fines

Argentina. For full detail on Argentina, go to The Argentine Thread.

Last verified: 2026-10-26 · Status: Changing

Ley Nº 21.719 rewrites Chile's 1999 privacy law and takes effect on 1 December 2026, with a new Agencia de Protección de Datos Personales as regulator. It reaches foreign companies that offer goods or services to people in Chile or monitor their behaviour, requires a legal basis for every processing operation, and gives people access, rectification, erasure, objection and portability rights answered within 30 days. Breaches with reasonable risk must be reported to the Agency; transfers abroad need adequacy, safeguards or a listed exception; fines reach 20,000 UTM, or 4 percent of revenue for large repeat offenders.

USD figures use the Central Bank exchange rate of CLP 986.58 per US dollar published in the Diario Oficial for 23 October 2026 (CVE 2891564). UF figures use the SII value of CLP 41,221.08 for 26 October 2026, and UTM and UTA figures the SII values of CLP 72,151 and CLP 865,812 for October 2026. Conversions are for orientation only.

Key facts

Ley Nº 21.719 in force	2026-12-01 dateLey Nº 21.719 first transitory article, as of 2026-10-26 · in force
Applies to foreign companies targeting or monitoring people in the country	Yes textLey Nº 19.628 art. 1 bis c), as amended, as of 2026-10-26 · in force
Data protection regulator	Agencia de Protección de Datos Personales textLey Nº 19.628 art. 30, as amended, as of 2026-10-26 · in force
Deadline to answer a data subject request	30 calendar daysLey Nº 19.628 art. 11, as amended, as of 2026-10-26 · in force
Breach notice to the regulator	Without undue delay textLey Nº 19.628 art. 14 sexies, as amended, as of 2026-10-26 · in force
Maximum fine, very serious infringement	20,000 UTMLey Nº 19.628 art. 35 c), as amended, as of 2026-10-26 · in force
Maximum fine for large repeat offenders, very serious infringement	4 %Ley Nº 19.628 art. 35, as amended, as of 2026-10-26 · in force
Data protection officer mandatory	No (required only within a certified prevention model) textLey Nº 19.628 art. 50, as amended; Decreto Nº 662 art. 3, as of 2026-10-26 · in force
Prescription of infringements	4 yearsLey Nº 19.628 art. 40, as amended, as of 2026-10-26 · in force

The rule

1. The law applies to processing by any person or entity, including public bodies, when the controller or processor is established in Chile; when a processor anywhere acts for a controller established in Chile; and when a controller or processor outside Chile processes data to offer goods or services to people in Chile, paid or free, or to monitor their behaviour, including analysis, tracking, profiling or prediction. It also applies to a foreign controller made subject to Chilean law by contract or international law. Processing by individuals for personal activities and by media for opinion and news is excluded.
Cost to do it: No registration or fee. The old public registry of databases is eliminated (Ley Nº 21.719, third transitory article).
Example: A US e commerce site with no Chilean entity that ships to Santiago customers and profiles their purchases is covered from 1 December 2026. / The size of the company does not matter for coverage; it affects only compliance standards and some sanctions.Ley Nº 21.719 (DO 13 December 2024), art. 1 Nº 2 and Nº 3, amending Ley Nº 19.628, Ley Nº 19.628 art. 1 and art. 1 bis, as amended, 2024-12-13 official text · verified 2026-10-26 · changed: Ley Nº 21.719 takes effect on 1 December 2026, the first day of the 24th month after publication (first transitory article). Before that date Ley Nº 19.628 in its 1999 form applies, with no extraterritorial rule and no specialised regulator.

2. Processing is lawful with the data subject's consent, which must be free, informed, specific, prior and unambiguous, can be withdrawn at any time without retroactive effect, and is presumed not free when collected as a condition of a contract that does not need the data. Without consent, processing is lawful only when it concerns economic, financial, banking or commercial obligations under Title III; is needed to comply with a legal obligation; is needed to enter into or perform a contract with the data subject; is needed for the legitimate interests of the controller or a third party without affecting the data subject's rights; or is needed to exercise or defend rights before courts or public bodies. The controller must prove the legal basis. Controllers must publish on their website their data policy with date and version, their identity and legal representative, and other required information.
Cost to do it: Drafting privacy notices, a legal basis register and consent flows is a private professional cost.
Example: An employer processing payroll data relies on the employment contract and legal obligations; marketing emails to customers need consent or a documented legitimate interest. / Same rules apply whatever the currency of the business.Ley Nº 19.628 as amended by Ley Nº 21.719, Art. 12, art. 13, art. 14 and art. 14 ter, 2024-12-13 official text · verified 2026-10-26

3. Data subjects can exercise access, rectification, erasure, objection and portability rights by a written request to the controller's dedicated email address, contact form or equivalent electronic channel. The controller must acknowledge receipt and respond within 30 calendar days, extendable once by 30 more. A refusal must be reasoned and must tell the person that they have 30 business days to complain to the Agency. With a request for rectification, erasure or objection, the person can ask for a temporary block of the data, which the controller must answer within 2 business days. Before high risk processing, such as systematic profiling or automated decisions with significant legal effects, the controller must carry out a data protection impact assessment.
Cost to do it: Rectification, erasure and objection are always free; access is free at least once a quarter. Only direct costs can be charged for access or portability requested more than once a quarter (art. 10).
Example: A request received on 2 December 2026 must be answered by 1 January 2027, or by 31 January 2027 if the controller extends once. / A legal entity not incorporated in Chile must give the Agency, in writing, a working email or equivalent channel of someone able to act for it, for rights requests and official notices (art. 10).Ley Nº 19.628 as amended by Ley Nº 21.719, Art. 4 to art. 11 and art. 15 ter, 2024-12-13 official text · verified 2026-10-26

4. Controllers must adopt security measures suited to the risk. They must report to the Agency, by the fastest means and without undue delay, security breaches that destroy, leak, lose or alter personal data or give unauthorised access, when there is a reasonable risk to data subjects' rights, and must keep a record of each breach with its nature, effects, data categories, approximate number of people affected and measures taken. Where the breach involves sensitive data, data on children under 14, or data on economic, financial, banking or commercial obligations, the controller must also notify each affected person in clear language, or publish a notice in a national mass medium if individual notice is impossible. Omitting the breach notices or records is a serious infringement; deliberately omitting them is a very serious one.
Cost to do it: Serious infringement fine up to 10,000 UTM (about CLP 721.5 million or US$731,324); very serious up to 20,000 UTM (about CLP 1,443 million or US$1.46 million).
Example: A retailer whose customer database with card payment histories leaks must report to the Agency and notify every affected customer, because the data concern commercial obligations. / If the same company is also an essential service provider under Ley Nº 21.663, the cyber incident must separately be reported to the national CSIRT within 3 hours.Ley Nº 19.628 as amended by Ley Nº 21.719, Art. 14 quinquies, art. 14 sexies, art. 34 ter k) and art. 34 quáter f), 2024-12-13 official text · verified 2026-10-26

5. International transfers are lawful when the recipient is in a country the Agency declares adequate; when they are covered by contractual clauses, binding corporate rules or other instruments with adequate safeguards; or when both sides adopt a compliance model or certification with adequate safeguards. Clauses and instruments approved by the Agency need no further authorisation. Groups can use binding corporate rules approved by the Agency, with the exporting entity liable for breaches by group members. Without adequacy or safeguards, only specific and non habitual transfers are allowed, for example with express consent for that specific transfer, for specific banking or securities transfers, or when needed to perform a contract with the data subject. The Agency will publish the list of adequate countries and model clauses on its website. Transfers in breach of these rules are a serious infringement, and knowing breaches a very serious one.
Cost to do it: No fee for transfers under adequacy or approved clauses; a case by case Agency authorisation is possible under art. 28 when no other route applies.
Example: A Chilean subsidiary sending HR data to its parent in the United States needs Agency approved clauses, binding corporate rules or another art. 27 route, unless the Agency declares the destination adequate. / Same requirement in USD terms; the cost is legal drafting, not a government fee.Ley Nº 19.628 as amended by Ley Nº 21.719, Art. 27, art. 28, art. 34 ter m) and art. 34 quáter h), 2024-12-13 official text · verified 2026-10-26

6. Infringements are minor (for example failing the transparency duty or answering requests late), serious (for example processing without a legal basis, security failures, unlawful transfers, or breaching children's data rules) and very serious (for example fraudulent processing, knowingly processing sensitive or children's data unlawfully, deliberately hiding a breach, or skipping a required impact assessment). Fines are up to 5,000 UTM for minor, 10,000 UTM for serious and 20,000 UTM for very serious infringements, plus a 50 percent surcharge if corrective measures are not taken within 60 days. Repeat offenders can be fined up to three times the amount. A company that is not micro, small or medium sized under Ley Nº 20.416 and repeats a serious or very serious infringement can be fined the higher of that amount or 2 or 4 percent of the previous year's revenue. Repeated very serious infringements within 24 months allow a suspension of processing for up to 30 days. Sanctions appear in a public register for five years. Infringements prescribe after four years. During the first 12 months, the Agency can sanction smaller companies with a written warning instead.
Cost to do it: Fines up to 5,000, 10,000 or 20,000 UTM (about CLP 360.8 million, CLP 721.5 million or CLP 1,443 million; US$365,662, US$731,324 or US$1.46 million). Three times the very serious cap is 60,000 UTM, about CLP 4,329 million or US$4.39 million.
Example: A large company with CLP 500,000 million of revenue that repeats a very serious infringement faces up to 4 percent of revenue, CLP 20,000 million, because that exceeds 60,000 UTM. / About US$20.3 million in that example.Ley Nº 19.628 as amended by Ley Nº 21.719; Ley Nº 21.719 sixth transitory article, Art. 34 bis, art. 34 ter, art. 34 quáter, art. 35, art. 37, art. 38, art. 39 and art. 40, 2024-12-13 official text · verified 2026-10-26

7. Controllers can voluntarily adopt an infraction prevention model, a compliance programme that must include a data protection officer, a description of the data, databases, purposes, legal bases, recipients, international transfers, retention periods and automated decisions, among other elements. The Agency certifies, registers and supervises these programmes, and certificates last three years. Appointing a data protection officer is otherwise optional; in micro, small and medium companies the owner or top management can take on the role. The rules for these programmes are set by Decreto Nº 662 of the Ministerio de Hacienda, published on 9 September 2026.
Cost to do it: Building a certified programme is a private cost; the law and the regulation set no certification fee in the provisions reviewed.
Example: A Chilean bank subsidiary adopts a programme, appoints a data protection officer reporting to the board and applies for Agency certification. / Same in USD terms.Ley Nº 19.628 as amended by Ley Nº 21.719; Decreto Nº 662 of 13 June 2025, Ministerio de Hacienda (DO 9 September 2026), Ley Nº 19.628 art. 48 to art. 53; Decreto Nº 662 art. 1 and art. 3, 2026-09-09 official text · verified 2026-10-26

Category	Examples	Maximum fine	Approximate CLP	Approximate USD
Minor	Missing privacy policy, late answer to a request	Warning or 5,000 UTM	360.8 million	365,662
Serious	No legal basis, security failure, unlawful transfer, no breach notice	10,000 UTM	721.5 million	731,324
Very serious	Fraudulent processing, deliberate concealment of a breach, missing impact assessment	20,000 UTM	1,443 million	1.46 million
Repeat, large company	Repeat serious or very serious infringement	Higher of 3x cap or 2% / 4% of revenue	Depends on revenue	Depends on revenue

Fines under the new data law (Ley Nº 19.628 art. 35 as amended; CLP and USD at October 2026 values)

Worked example

A Spanish software firm with Chilean clients processes their employees' data in Europe as processor for the Chilean clients. From 1 December 2026, the Chilean clients are controllers established in Chile and the Spanish firm is covered as their processor (art. 1 bis b). The clients need an art. 27 route for the transfer to Spain.
A breach exposing 50,000 customers' payment histories is a serious infringement if not reported; at 10,000 UTM the cap is about CLP 721.5 million (about US$731,324), plus a 50 percent surcharge if the ordered fixes are not made within 60 days.

Step by step

1. Before 1 December 2026, map data, purposes, legal bases, recipients and transfers, and identify high risk processing needing an impact assessment.
2. Publish the art. 14 ter information on the website and set up the dedicated channel for rights requests with a 30 day clock.
3. Put art. 27 safeguards in place for every recurring international transfer, including intra group flows.
4. Write a breach response plan that covers the Agency notice, individual notices for sensitive, children's and financial data, and a breach log.
5. Review processor contracts so processors follow instructions and security duties.
6. Consider a certified prevention model under Decreto Nº 662, which requires a data protection officer.

Common traps

Treating the law as local only: a foreign company targeting or monitoring people in Chile is covered (art. 1 bis c).
Bundling consent into terms of service: consent is presumed not free if the contract does not need the data (art. 12).
Relying on Argentina's data rules for flows from Chile to Argentina: transfers out of Chile are judged under Chilean rules and the Agency's own adequacy list (art. 27 and 28). See The Argentine Thread for the Argentine side.
Having no contact point in Chile: a controller not incorporated in Chile must give the Agency, in writing, a working electronic channel of someone able to act for it (art. 10).
Missing the 2 business day deadline to answer a temporary blocking request (art. 11).
Assuming the cyber report covers the data breach: Ley Nº 21.663 reports go to the CSIRT and must exclude personal data; the data breach notice goes to the Agency.

Sources

← Cartels, abuse of dominance and FNE investigations in Chile: conduct rules, fines, leniency and criminal collusionCorporate criminal liability in Chile: Ley Nº 20.393 after the Economic Crimes Law, crime prevention models and day fines →