Chile's Ley 21.719: new data protection, with an agency and fines
Ley 21.719 — Chile's new personal data protection law · Updated: julio de 2026
What is it, and what does it require of you?
Ley 21.719 is Chile's new personal data protection law, aligned with the European GDPR standard. It takes effect in December 2026 and creates a supervisory authority for the first time — the Personal Data Protection Agency — with fines of up to 20,000 UTM and an infringement prevention model that acts as a mitigating factor.
Who does it apply to?
To every public or private organisation processing personal data of people in Chile, whatever its size. Companies with European parents or subsidiaries already know the model: Ley 21.719 brings the GDPR's principles, rights and obligations to Chile.
Key dates
See also the Spain–Latin America compliance calendar.
Penalties
Compliance checklist
- Build your record of processing activities: what data you process, for what, and on what lawful basis.
- Prepare your rights procedures (access, rectification, erasure, objection, portability) with deadlines.
- Define your breach protocol and how you notify the Agency.
- Put an infringement prevention model in place: the law recognises it as mitigation — and it can be certified.
- Review international transfers and your processor contracts.
- Document everything with dated evidence: the Agency's first move will be to ask for proof.
- A live record of processing and impact assessments with versioning — the same core our GDPR clients have used since 2018.
- Rights requests with automatic deadlines and a file per request.
- A breach protocol with a clock and evidence of every step.
- An operating infringement prevention model: controls, owners and evidence — not a manual in a drawer.
Frequently asked questions
When does Ley 21.719 take effect?
In December 2026, twenty-four months after publication. From that date the Personal Data Protection Agency can inspect and impose penalties.
What fines does Ley 21.719 set?
Up to 5,000 UTM for minor infringements, 10,000 UTM for serious ones and 20,000 UTM for very serious ones, doubled for repeat offences.
What is the infringement prevention model?
A compliance programme (policies, controls, an officer, a channel, evidence) that the law itself recognises: holding a certified one mitigates liability. It's the data-protection equivalent of a criminal risk prevention model.
How close is Ley 21.719 to the GDPR?
On nearly everything that matters: lawfulness and minimisation, data subject rights, controller and processor duties, breach notification, and an authority with enforcement powers. If you already comply with GDPR you're 80% of the way there — and if you don't, you can implement both on the same system.
For information only — this is not legal advice. Check dates and thresholds with your adviser.
This obligation is organised with an international management system standard. If your group is already certified, you have half the road done — and the same holds in the other countries where you operate.