Chile Delays Data Protection Law to 2027

Update October 16, 2026: The executive renewed urgent review of the bill that changes the timeline for Law 21,719 and creates the Personal Data Protection Agency. Legislative tracking also added the critical infrastructure bill, which is still in the Senate under renewed urgent review.

Chile's government has proposed moving the effective date of Law No. 21,719 on personal data protection from Dec. 1, 2026, to Dec. 1, 2027, while the reform bill remains under consideration in the Senate. The current legal date stays in force until Congress approves the change and it is published in the Official Gazette.

What happened to Law 21,719 in Chile?

A secondary review said Bill 18,623-07 was still in its first constitutional stage in the Chilean Senate and at the first report stage in the Constitution, Legislation, Justice and Regulation Committee. It also noted that any delay would take effect only after parliamentary approval and publication of the law.

The executive renewed urgent review of the bill that amends Law No. 21,719 and creates the Personal Data Protection Agency, Bill No. 18,623-07, which was being discussed in the Senate's Constitution Committee, according to Gerencia Legal. A verification cited by Surtika said that as of Oct. 11, 2026, the bill was still in its first constitutional stage, with no reports, amendments, or votes recorded.

That material was also published by El Rancagüino under the headline "The law is delayed, the risks are not." The reference adds to the local debate over when Law 21,719 will take effect, although the baseline legislative status comes from the secondary analysis cited in the research material.

What obligations does the new law introduce?

Law No. 21,719 creates a Personal Data Protection Agency and sets new security, enforcement, and sanction obligations for organizations that process personal data in Chile. A legal analysis of the statute also identifies incident management and notification, privacy impact assessments, and international transfers as areas that require implementation.

The candidate develops those compliance duties in detail, including security, incident management and notification, privacy impact assessments, international transfers, and the enforcement and sanctions regime. That implementation still depends on the law actually taking effect and on internal preparation by the organizations it covers.

What political reactions did the delay draw?

Opposition sectors questioned pushing the effective date back by one year and proposed limiting the delay to six months, according to Conadecus. The same source said the current legal date remained Dec. 1, 2026, as long as Congress had not approved the change.

BITSUR said that, in addition to delaying the effective date of Law No. 21,719 to Dec. 1, 2027, the bill would extend to all controllers the option of issuing a written warning during the first 12 months, a power that is currently limited to smaller companies under the proposal described.

A practical implementation analysis also warned that the proposed delay is not yet law and that organizations should treat Dec. 1, 2026, as the binding date until any reform is published in the Official Gazette. That view matches the parliamentary status reported for Bill 18,623-07.

What movement took place in Brazil?

Brazil had several open fronts in its digital agenda. Bill 5.271/2026 was at an early stage in the Chamber of Deputies, and its provisions could still change during the legislative process, according to Lefosse Advogados. In the same vein, Bill 1.636/2026 was still moving through the lower house.

Bill 2.034/2026, introduced by Representative Camila Jara, was added to that mix. It includes fines set out in the Civil Rights Framework for the Internet and was waiting for a rapporteur to be named in the Communications Committee, according to DPL News. In the Brazilian Senate, Bill 3.780/2023 is listed as having finished its processing after the chamber notified the Chamber of Deputies that it had approved the text, revised as amended, and sent the bill for review.

What official framework accompanied that debate?

Brazil's Ministry of Justice and Public Security defended a regulatory approach to the digital environment based on risk prevention and institutional capacity. In its official statement, it cited Decrees 12.975 and 12.976, which spell out the duty of care and distinguish liability for third-party content, under a systemic logic, from the analysis of individual notices.

That position adds context to Brazil's debate over digital platforms and online liability at a time when Congress still has multiple open files on data, digital services, and sanctions.

What other bill remains open in Chile?

The country's critical infrastructure bill, Bill No. 16.143-02, was still in its first constitutional stage in the Senate and assigned to the National Defense Committee, with urgent review renewed by the executive on Oct. 6, 2026. Legislative tracking included it alongside the discussion over delaying Law 21,719.

That adds to the operational risk backdrop in Chile, where the Universidad Autónoma de Chile described the Framework Cybersecurity Law, Law No. 21.663, as a framework that created the National Cybersecurity Agency and established obligations for public and private entities that provide essential services, including protection measures and incident reporting.

Diario Financiero also reported that nearly one-third of ransomware victims in Chile and Latin America would be critical infrastructure organizations, including health care, banking, government, transportation, energy, water, and telecoms. That adds context to the operational exposure driving the legislative debate, but it does not change the bill's procedural status.