Chile Data Protection Law Takes Effect in 2026

Effective date and scope

Chile’s new Personal Data Protection Law will begin to take effect on Dec. 1, 2026. With that step, the country’s framework moves closer to international standards, including European ones, in privacy and data protection.

The law is part of a broader reshaping of Chile’s digital regulatory environment, which also includes the Cybersecurity Framework Law 21.663, progress on the artificial intelligence bill, and the bill on deepfakes moving through the legislative process.

New institutional structure

The design of the new Personal Data Protection Agency calls for a governing board made up of three commissioners, appointed by the executive branch with the Senate’s approval. That board will have the authority to issue interpretive rules, certify compliance programs, and coordinate with other public agencies on personal data processing.

That structure places the future agency at the center of enforcement, not only to set guidance but also to organize coordination among public entities on matters tied to personal data.

Companies, cybersecurity and compliance

The law’s entry into force overlaps with other obligations already affecting companies and financial institutions. Chile’s Financial Market Commission has begun strictly enforcing the Customer Strong Authentication rules for electronic transfers and digital payments, forcing banks to phase out coordinate cards and strengthen authentication mechanisms.

That shift fits into the broader evolution of digital security and anti-fraud rules. For organizations, the regulatory map is now shaped by privacy, cybersecurity, authentication requirements and, at the same time, new debates over artificial intelligence and deepfakes.

A more demanding compliance landscape

The result is a denser compliance environment for public agencies and companies that process data or rely on digital services. The new data law, the Cybersecurity Law 21.663 and the authentication rules in the financial system all point in the same direction, tighter control over how information is handled and greater demands on the digital channels used to operate.