Chile's Law 21,719 on Personal Data

Executive summary

Chile’s Law No. 21,719 takes effect on Dec. 1, 2026, and introduces a structural change in personal data protection in Chile, with direct impact on public and private organizations that process information about people located in the country, including foreign companies operating from Brazil. The material reviewed shows the law effectively replaces the previous framework under Law No. 19,628, creates a specialized authority with oversight and sanction powers, and sets a two-year transition period for operational alignment.

The reform is not just about higher penalties. It also resets the compliance baseline. The research consolidates eight processing principles, expands the data subject rights catalog to the ARSOPB family, adds opposition to automated decisions, requires traceability in how data is handled, and obliges organizations to prove the full chain of collection, use, storage, and sharing. For sectors with high data volume, such as finance, healthcare, SaaS, and e-commerce, the regulatory jump is material.

On sanctions, the sources agree on a tiered system for minor, serious, and very serious violations, with fines of up to 5,000, 10,000, and 20,000 UTM. Several analyses add that repeat serious or very serious violations can raise the ceiling to three times the base, with references to a practical maximum of 60,000 UTM or, for certain companies not considered small, fines equal to 2% or 4% of annual revenue. The file also introduces the possibility of suspension of processing in certain cases and differentiated limitation periods of 3, 4, and 5 years.

The most sensitive technical dimension involves breaches, profiling, and automated decisions. The law requires notification to the Personal Data Protection Agency within 72 hours of the controller becoming aware of the incident, and notice to data subjects when risk is high. Several sources also note that certain high-risk processing activities will require impact assessments and additional controls in an environment that analysts compare with European rules, though with important differences in international transfers.

There are no signs of exploitation, malware, attacker infrastructure, or published IOCs in the material. The value of this research is regulatory and operational. The deadline is not a threat campaign, but a countdown to compliance that is already running for any organization processing personal data of Chilean residents, including cross-border providers in Brazil.

Context and background

Law No. 21,719 appears in the material as the deepest reform of Chile’s personal data protection regime in decades. Several analyses say it replaces and modernizes Law No. 19,628, in force since 1999, which is described as lacking its own enforcement body and effective penalties. Tecnom.ai characterizes those earlier sanctions as almost symbolic, a view several authors use to explain why the reform is treated as an institutional turning point.

The legislative process was also long. ESG Hoy says the bill began in 2017, was published in the Official Gazette on Dec. 13, 2024, and left a two-year implementation period before it takes effect. Exige tu Seguro and other outlets agree that the transitory first article sets Dec. 1, 2026, as the full application date, with a transition for companies and public agencies. In parallel, the AGPD urged caution about any delay and publicly noted that, as of August 2026, the effective date remained tied to that schedule.

The immediate backdrop is a legal architecture that shifts the center of gravity. Before, personal data disputes depended more on isolated litigation and fragmented oversight. Now, the new agency is empowered to investigate on its own initiative, handle complaints, and impose sanctions directly. The Universidad Central de Chile and Actualidad Jurídica highlight that shift as a move from a reactive model to one based on active accountability by data controllers.

The material also places the law in a broader regional conversation. Several texts present it as converging with GDPR-type standards, especially on data subject rights, impact assessments, breaches, and institutional oversight. At the same time, others stress that the Chilean law does not simply copy the European model, particularly on international transfers, where it keeps a logic of similar or higher standards rather than the GDPR’s essential equivalence test.

Table of key facts

Operation timeline

Attack chain and TTPs

This research does not describe a technical intrusion, phishing campaign, or software exploit. The material focuses on the regulatory framework of Law No. 21,719 and its compliance impact. There is therefore no classic attack chain, no exploitation sequence, and no forensic artifact that could be mapped to an incident response case.

The closest thing to an operational chain is the sequence of obligations the law activates for any personal data processing activity. First, the organization must identify a valid legal basis. Then it has to document purposes, minimization, security, transparency, and accountability. Later, it must enable rights exercise mechanisms, response within deadlines, documentary traceability, breach notification, and, for high-risk processing, impact assessments and additional controls.

That flow matters because it turns compliance into evidence. A published privacy policy is no longer enough. The sources consulted stress that the authority and data subjects will be able to demand proof of how each decision was made, under what basis, who was involved, and what security measure supported the processing. In that sense, the law’s operational chain looks more like continuous traceability than a simple compliance statement.

Regional impact

Regional overview

The entry into force of Law No. 21,719 in Chile has regional impact because it extends its reach to foreign organizations that process data about people in Chile, especially from Brazil. The consolidated material shows the effect is not limited to the Chilean local market, but also reaches e-commerce, SaaS, logistics, digital health, fintech, and any cross-border operation involving data from Chilean residents.

There is also a regulatory convergence with GDPR, but not full identity. The Chilean approach requires principles, rights, security, transparency, a specialized authority, and breach notification, while international transfers follow its own logic of similar or higher standards. For regional teams, that means reviewing transfer matrices, contracts, safeguards, and recipient-country criteria.

Chile

Chile is the core of the report’s legal analysis. Law No. 21,719 takes effect on Dec. 1, 2026, effectively replaces Law No. 19,628, and creates the Personal Data Protection Agency as an autonomous public-law body with powers to audit on its own initiative, investigate complaints, and directly sanction violations. The change is institutional and operational, because it requires proof of processing, not just a statement about it.

Article 3 sets out eight principles, lawfulness and loyalty, purpose, proportionality, quality, accountability, security, transparency and information, and confidentiality. The law also expands the classic rights catalog into the ARSOPB scheme, adds objection to automated decisions, and redefines treatment of data obtained from open sources, since it removes publicly accessible sources as an independent lawful basis.

On sanctions, the law distinguishes minor, serious, and very serious violations. Base fines reach 5,000, 10,000, and 20,000 UTM, with a written warning available in minor cases and suspension of processing under Article 38. Cifrid and other business summaries add that repeat serious or very serious violations can increase the fine up to three times, and some analyses place the practical ceiling at 60,000 UTM or up to 4% of annual revenue for large companies.

Breach notification also changes the standard. Cifrid says notice to the Agency must be made within 72 hours of the controller learning of the incident, with notice to data subjects when risk is high. The law also adds impact assessment obligations for high-risk processing, specific rules on profiling and automated decisions, and response deadlines for data subject requests that, according to SuperPyME, run from receipt acknowledgment to a decision within 30 calendar days, with one possible extension.

Brazil

Brazil appears in the material as the main neighboring country exposed to the practical extraterritorial reach of Law No. 21,719. Sinfopac, IA Governance, PCKZ Legal, AZ Abogados, Somos Forma, Francisco Moroso, Araya & Cía, and GDPRI all agree that any Brazilian organization processing data of Chilean people or residents, including SaaS, e-commerce, digital health, and logistics support, falls within the Chilean regime.

The relevance for Brazil is not abstract. The file says Brazilian companies will need to align governance, conditional access, processing records, impact assessments, and breach response with the Chilean authority. IA Governance adds that the Chilean regime requires a DPO, a record of processing activities, DPIA, and 72-hour notification, which means internal processes must be reviewed even if the company already complies with Brazilian frameworks or the GDPR itself.

International transfers are also central. GDPRI and the analysis by Actualidad Jurídica on Oliver Ortiz say Chile uses a logic of similar or higher standards, unlike the European essential-equivalence test. That affects data flows to and from Brazil when the operation includes data about Chilean people, because compatibility no longer depends only on contracts, but also on how the Chilean authority assesses the recipient country.

The impact is stronger in regulated sectors. Salutexa projects it onto healthcare and telemedicine, while DOE Actualidad Jurídica and ComplianceLatam do the same for fintech, advanced analytics, and automated scoring. For Brazil, the issue is not only Chilean legal exposure, but also the need to unify processes across jurisdictions with close, but not identical, standards.

Countries with no specific verifiable facts

No additional verifiable facts were identified in the research for Argentina, Paraguay, Bolivia, Peru, Colombia, Mexico, the United States, or Uruguay.