Chile delays personal data law to 2027

Update Sept. 8, 2026: this note adds new details on Paraguay's Law 7.593/2025, its vacatio legis, sanctions regime, rules on international transfers and incident-notification duties, as well as its impact on credit information and automated decisions.

Chile's government has introduced Senate bill 18,623-07 under urgent procedure to amend Law 21.719 on personal data protection and processing, and to push full enforcement from Dec. 1, 2026, to Dec. 1, 2027. The measure also keeps the Personal Data Protection Agency in place and proposes changes to its institutional design.

What would the Senate bill change?

The bill seeks to give the new personal data law one more year before full application. According to the material reviewed, the official rationale is to ensure the institutional and operational conditions needed, especially the launch of the Personal Data Protection Agency.

Specialized Chilean outlets also reported that bill 18,623-07 would expand the Agency's board from three to five members, set a minimum quorum of three, and allow a company's first violation during the first 12 months to be closed with a written warning.

Where do the law and reform stand?

Law 21.719 was published in the Official Gazette on Dec. 13, 2024, and was set to take effect on Dec. 1, 2026. The amendment bill is in the initial stage of Senate review, according to analysis from Chilean consulting firms and compliance practices.

BioBioChile and TrendTIC both said the requested delay does not mean abandoning the law, only extending the preparation window. TrendTIC stressed that the law remains in force and that data controllers must keep preparing for the 2026 date while the bill moves forward.

What does this mean for companies?

Companies that process personal data will remain under compliance expectations because the law already exists and the bill still has to make its way through Congress. Public debate in Chile is focused on the extra time needed to adapt processes, internal governance and implementation capabilities, especially given the lack of full operation of the new agency.

The Institute of Directors of Chile said the government is weighing a one-year delay precisely because of delays in getting the Personal Data Protection Agency up and running. At the same time, other local reports noted that companies need to take action and should not assume the postponement is already settled.

How does it compare with Paraguay?

Paraguay approved Law 7.593/2025, a rule inspired by the European Union's General Data Protection Regulation, with duties to inform data subjects, rules on communications and international transfers, and a sanctions regime that includes significant fines. The regional comparison is useful for Chile's current debate, where the discussion centers on the start date and the launch of the authority.

The Personal Data Coalition, made up of Paraguayan civil society groups, drove the process for four years before it became Law 7.593/2025. According to Derechos Digitales, the first draft bill was introduced in 2021 in the Chamber of Deputies, and the process included technical workshops, public consultations and collaborative legal review.

Based on the legal text and the technical analyses cited, full enforcement of the Paraguayan law is scheduled for Nov. 27, 2027, after a 24-month vacatio legis that leaves 2026 and 2027 as the mandatory adjustment period for public and private organizations.

What obligations does the Paraguayan law add?

Law 7.593/2025 adds principles such as lawfulness, transparency and data minimization, and it also sets concrete rules on security, international transfers and automated decisions. It also gives the National Personal Data Protection Agency authority to inspect and sanction.

EDYDSI says controllers must notify security incidents to the National Personal Data Protection Agency and to affected individuals within 72 hours of becoming aware of the event. The same analysis says international transfers are allowed only to jurisdictions with an adequate level of protection defined by the Agency, or through specific contractual safeguards if that standard is not met.

What happens if Paraguay's rules are violated?

The sanctions regime includes nine minor offenses and 37 serious offenses, with fines that may be applied separately or cumulatively. EDYDSI says penalties can reach 2,500 minimum daily wages for general violations, 5,000 when sensitive data is involved, and 10,000 when sensitive data belongs to minors.

The same source estimates the base fine of 2,500 minimum daily wages at about 292 million guaraníes. Meanwhile, MuchoTexto says the law also includes provisions on automated decisions that will matter for AI systems once it takes effect.

Which sectors does it affect most in Paraguay?

Coverage by Revista PLUS of the DATOS PY event added that Law 7.593/2025 will have a particular impact on credit information, credit bureaus and actors overseen by the Central Bank of Paraguay and the Consumer Protection Secretariat. The change points to specific regulatory adjustments in those segments once the law begins to apply.

The comparison leaves Chile still in the institutional implementation phase and Paraguay with a law already in place, a 24-month vacatio legis and a strong sanctions regime within its new personal data protection framework.