Chile delays data protection law to 2027

Update September 8, 2026: The bill has now been formally introduced in the Senate as bill 18.623-07, alongside Presidential Message No. 110-374, with urgent status. More details are also now known about the first appointment to the Board of Directors, its operating rules, and the interim scope of sanctions.

The Chilean government has introduced a bill in the Senate that would delay by one year the entry into force of Personal Data Protection Law 21,719, moving it from December 1, 2026 to December 1, 2027. The proposal also strengthens the structure of the future Personal Data Protection Agency and keeps the original law moving through the process until the reform is approved.

What changes with the delay?

The bill pushes the start of the law to 2027 and extends, for all covered entities, the option to close a first violation with a written warning during the first 12 months in force. According to Carey, the proposal removes the specific reference to smaller businesses in the sixth transitional article.

Anguita & Osorio had already noted that the bill is being handled under urgent procedure, which shortens debate time in committees and on the Senate floor. According to the same legal analysis, bill 18.623-07 was sent to the Constitution and Finance committees for review.

What happens with the future agency?

The proposal changes the institutional design of the future Personal Data Protection Agency and moves up the first appointment of its Board of Directors so it can happen no later than 12 months before the law takes effect. That would give the agency time to set up and issue secondary regulations before it begins enforcement.

According to Carey, the new Board of Directors will have five members, six-year terms with no re-election, staggered renewal every two years, exclusive dedication, and tighter incompatibility rules. The bill also raises the quorum for meetings to three members.

BioBioChile explained that, under the current rules, the agency should already have been operational by June 1, 2026 at the latest. In that original version, its top leadership was a three-member board appointed by the president with the Senate's two-thirds approval.

What does this mean for organizations?

The delay gives companies and other covered entities an extra year to adapt processes, governance, and compliance to the new law. Different analyses published on the bill agree that the change does more than move the effective date, it also reshapes the institutional transition of the future data authority.

Legal analysis firms said the combination of the delay until December 1, 2027 and the transitional sanctions regime amounts, in practice, to a soft launch that could last more than five years from the original publication of Law 21,719 in 2024. Obsidian Regulatory Intelligence also stressed that, until the bill is approved, the operative date remains December 1, 2026.

The debate has also drawn criticism. Representatives of the Association of Data Protection Professionals publicly questioned the delay, while opinion columns in outlets such as La Tercera backed it only if it turns into a verifiable plan to stand up the agency and issue secondary rules. Letters and columns in El Mostrador called it bad news for the country.

An academic from the Faculty of Economics and Business at the University of Chile warned that, even with the law in force, the new agency could take up to a year to operate fully because of a lack of authorities and operational capacity, an argument used to support the reform. At the same time, Chilean business media reported that the executive branch is seeking to ensure institutional and operational conditions for the gradual rollout of the new framework.

When will we know?

We will know when the Senate approves or rejects the bill that would push the entry into force of Law 21,719 to December 1, 2027. Until that happens, the operative date remains December 1, 2026.

The bill has already been formally introduced in the Senate with urgent status, so the next milestone depends on debate in committees and on the floor. In parallel, the text keeps the original law moving through the process and also adjusts the setup of the future Personal Data Protection Agency.