Chile's Senate advances data privacy reform

The Chilean Senate approved in first constitutional review a bill amending Law No. 21,719 on the protection and processing of personal data, along with the creation of the Personal Data Protection Agency. The measure now moves to the Chamber of Deputies, and until it is approved and published as law, the effective date of Law No. 21,719 remains December 1, 2026.

What did the Constitutional Committee decide?

The Senate’s Constitutional, Legislation, Justice and Regulation Committee reviewed Bill No. 18,623-07 and agreed to approve it, sending it to the Finance Committee. According to information available from the Chilean Senate, that legislative step was recorded on October 28, 2026.

The proposal aims to adjust the rollout of the new personal data framework before the law takes effect. In parallel, a legal analysis by Garrigues said the bill also changes the process for the first appointment of the governing board of the Personal Data Protection Agency.

If the initiative passes without changes, that first appointment would have to be made no later than nine months before October 15, 2027, according to Garrigues. For now, the only confirmed legislative milestone is that the effective date of Law No. 21,719 does not change until the bill completes its process and is enacted.

What changes for AI agents?

A parliamentary motion, Bill No. 18,820-19, proposes amending Law No. 21,663, the Framework Cybersecurity Law, to require private institutions that operate AI agents to meet identification, traceability, logging, and control obligations. The text was sponsored by Senators Paulina Núñez and Paulina Vodanovic, along with Senators Iván Flores, Manuel José Ossandón, and Matías Walker.

According to Diario Constitucional, the proposal would require private institutions covered by Article 4 of Law No. 21,663 to assign each agent a verifiable digital identity, define its permissions in advance, and keep records of its actions. It also foresees an effective date 12 months after publication in the Official Gazette.

The technical detail released by TWUN adds that, before deployment, each agent’s authorizer must be recorded, along with the resources it can access, the actions it can perform, its limits, and the validity period of its permissions. The proposal also calls for model-independent mechanisms to supervise, suspend, or revoke access.

What does it require from vital operators?

For institutions classified as vital operators, the proposal includes an up-to-date registry of agents with access to production systems and an internal log of near-incidents tied to loss of control. TWUN also says those entities would need to integrate the agent registry into their information security management system and document control assessments.

In that way, the motion extends the document-and-trace logic already present in the Framework Cybersecurity Law into the AI space. No legislative debate date in the chamber has been announced for the initiative.