Chile delays Data Protection Law 21.719 to 2027

Update September 16, 2026: The Executive Branch submitted a bill to the Senate to push back the effective date of Personal Data Protection Law No. 21.719 from Dec. 1, 2026, to Dec. 1, 2027. At the same time, debate over the Agency remains open because it has still not been established, and the Senate had already rejected the first proposal to appoint its board in May 2026.

The Chilean government has sent Congress an urgent bill to delay the start of Personal Data Protection Law 21.719 until Dec. 1, 2027. The proposal also moves up the launch of the future Personal Data Protection Agency and extends a lighter-sanctions period through December 2028, mainly written warnings, before the harsher penalty regime takes full effect.

What changes with the delay?

The proposal does more than shift the general effective date. According to the materials reviewed, it includes an institutional overhaul for the Personal Data Protection Agency and a longer transition period for sanctions, with the stated goal of giving regulators and operators more time to prepare.

How will the Agency be reorganized?

The bill would expand the future Personal Data Protection Agency's governing board from three members to five, with full-time dedication, a higher quorum for meetings, and staggered renewal rules, according to Peritum's analysis. Compliance Latam also says the first board appointments would have to be made no later than 12 months before the new effective date.

That earlier timetable is meant to ensure the body is in place before full enforcement begins. The idea is for it to issue secondary regulations and set compliance standards in advance, rather than start issuing penalties without a complete operating framework.

Diario Estrategia notes that the Personal Data Protection Agency has not yet been constituted and that the Senate rejected the Executive Branch's first proposal to form its board in May 2026. The outlet adds that the government has proposed delaying implementation of Law 21.719 until December 2027 while seeking to have the Agency operating by the end of 2026, even though the law requires the board to be constituted before the new regime takes effect.

What happens with sanctions and compliance?

Hivos, through EU SEE, said the bill would also keep a more flexible regime in place through December 2028, with lighter sanctions such as written warnings before fines and more serious penalties are fully activated. Arco Legal, in the same vein, said the government is justifying the extra year by pointing to the need for proper institutional, regulatory, and operational conditions.

For companies, the extension does not erase preparation work. Wagner Solutions warned that it could create a false sense of security, because data mapping, contract reviews, and the adjustment of international transfers remain urgent in a framework aligned with the GDPR. The outlet also stressed that the regulatory change is significant enough that the extra year should be read as adjustment time, not idle time.

How are companies and analysts reading it?

EstadoDiario described the delay as an "awkward necessity" and said the law had already allowed nearly two years for implementation. In that reading, the new extension to December 2027 reflects a lack of institutional and regulatory conditions, even if it means a setback for the effective protection of personal data.

The practical impact is visible in adoption data. BioBioChile reported that more than half of companies in Chile say they are not ready to comply with the new law. In that context, the extra year looks more like a period of adjustment than real breathing room to postpone compliance decisions.

Portal Innova also reported that the Executive Branch submitted the bill to the Senate to move the effective date from Dec. 1, 2026, to Dec. 1, 2027. The debate is no longer about whether the law will apply, but about how to reach that date with a constituted Agency and real enforcement capacity.