Snap Compliance
Solution Partners Consulting Partners
Contact us

Language

EN ES PT
Start free
Law 21.719 · Decree 662 · Chile

Reach December 1, 2026 with your personal data in order and the evidence ready for the Agency

Law 21.719 rewrites Law 19.628 and binds every company that processes data of people in Chile: legal bases, responses to data subjects, security, breach notices and fines of up to 20,000 UTM. See what it requires of you and how Snap Compliance helps you comply.

See what it requires Talk to a specialist

At a glance

What it regulates

Personal data

Any processing of data about natural persons carried out by a natural or legal person, including public bodies. It amends Law 19.628, renamed «on the protection of personal data» (art. 1).

Who it binds

Controllers and processors

Whoever decides the purposes and means of processing and whoever processes data on their behalf, with no size threshold. Also companies with no presence in Chile that offer goods or services to people in Chile or monitor their behavior (art. 1 bis).

Authority

Agencia de Protección de Datos Personales

An autonomous public corporation created by the law to oversee compliance: it issues general instructions, resolves data subjects' complaints, imposes sanctions and certifies infringement prevention models (arts. 30, 30 bis and 51).

Effective date

December 1, 2026

The law was published in the Diario Oficial on December 13, 2024, and its amendments to Law 19.628 take effect on December 1, 2026. Decree 662, which regulates the infringement prevention model, was published on September 9, 2026.

Read the official text: Ley 21.719

What it requires

What Law 21.719 requires of you

The principles of lawfulness, purpose limitation, proportionality, quality, accountability, security, transparency and confidentiality (art. 3) translate into concrete duties, and for each one the controller must be able to prove compliance.

A legal basis for every processing activity

Free, informed, specific and revocable consent, or another legal basis: a legal obligation, a contract or pre-contractual steps, legitimate interest or the defense of a right. Sensitive data require express consent except in the cases the law lists (arts. 12, 13 and 16).

Ongoing information and transparency

Publish on your website or an equivalent medium the processing policy with its date and version, the data processed, purposes and bases, recipients, international transfers, retention periods, security measures and any automated decisions used (art. 14 ter).

Answer data subjects on time

Handle access, rectification, erasure, objection, portability and blocking within 30 calendar days, extendable once, and temporary blocking within 2 business days, through simple mechanisms and keeping proof of every response (arts. 4 to 11).

Protection by design and security

Technical and organizational measures by design and by default, and security proportionate to risk —pseudonymization and encryption, confidentiality, integrity, availability and resilience, recovery after incidents and regular testing—. After an incident, the controller must prove they existed and worked (arts. 14 quáter and 14 quinquies).

Report security breaches

Notify the Agency without undue delay when there is a reasonable risk to data subjects and record every case; if it affects sensitive data, data of children under 14 or data on financial or commercial obligations, also notify each data subject (art. 14 sexies).

Impact assessment for high-risk processing

Before starting, whenever there is profiling with significant legal effects, large-scale processing, systematic monitoring of public areas or sensitive data without consent. Failing to do it when required is a very serious infringement (arts. 15 ter and 34 quáter).

Written contracts with processors and for transfers

Processing on your behalf requires a contract setting out its object, duration, purpose, data and data subjects; the processor cannot subcontract without written authorization and deletes or returns the data at the end. Every transfer to another controller is also documented in writing (arts. 15 and 15 bis).

International transfers with safeguards

Only to countries the Agency declares adequate, or under contractual clauses, binding corporate rules or certifications that provide adequate safeguards; without them, only specific, non-recurring transfers (arts. 27 and 28).

Consequences

Infringements and sanctions

Infringements are classified as minor, serious and very serious (arts. 34 bis to 34 quáter). The Agency may impose a written warning or a fine of up to 5,000 UTM for minor ones, up to 10,000 UTM for serious ones and up to 20,000 UTM for very serious ones, and sets corrective measures that must be adopted within 60 days, with a 50% surcharge if they are not (art. 35). Repeat offenses —two or more sanctions in 30 months— allow up to triple the fine, and a company that is not small and reoffends with a serious or very serious infringement risks up to 2% or 4% of its annual revenue from its line of business. Repeated very serious infringements within 24 months allow processing to be suspended for up to 30 days (art. 38), and every sanction remains five years in the Registro Nacional de Sanciones y Cumplimiento (art. 39). Affected data subjects may also claim damages (art. 47). During the first year in force, the Agency may issue small companies a written warning instead of a fine (sixth transitory article).

How we help

How Snap Compliance helps you

Start with the free Law 21.719 Assessment: a guided questionnaire across 16 domains that gives you an overall rating, blocking findings, estimated exposure to fines, an action plan in four waves and which documents close each gap. The Law 21.719 Toolkit brings together 38 editable Word documents, in Spanish and for a one-time payment, organized in eight phases: from the processing inventory to the certification file for the infringement prevention model. To run compliance over time, Compliance Agent adds Law 21.719 to its catalog of regulations and risks, with the risk matrix Decree 662 calls for, assessments, KRIs, tracked action plans and monitoring of regulatory changes. And the Anonymous Whistleblowing Channel is designed for the internal reporting with identity protection that the regulation requires of the model.

Snap Compliance modules

Law 21.719 Assessment (Chile) Law 21.719 Toolkit · Chile Corporate Governance Management Anonymous Whistleblowing Channel

Other regulations in Chile

Ley 19.913 · UAF

Law 19.913: anti-money laundering compliance in Chile

Ley 20.393 · Ministerio Público

Law 20.393: corporate criminal liability in Chile

Ley 21.663 · ANCI

Law 21.663: Chile's Cybersecurity Framework Law

All regulations in Chile

What people ask us most about Law 21.719

When does Law 21.719 take effect and who does it apply to?
Its amendments to Law 19.628 take effect on December 1, 2026, under its first transitory article. They apply to any processing of data about natural persons carried out by a natural or legal person, including public bodies (art. 1). Under article 1 bis they also reach anyone who, without being established in Chile, offers goods or services to people in Chile or monitors their behavior. The free Law 21.719 Assessment shows you how far you still have to go.
Can an entity process its customers' data for due diligence without asking for their consent?
Yes, when processing is necessary to meet a legal obligation (art. 13, letter b), such as those Law 19.913 imposes on its reporting entities, and the controller must be able to prove that lawfulness. But the law counts socioeconomic status among sensitive data (art. 2, letter g), which may be processed without consent only in the cases of article 16, for example when the law expressly authorizes or requires it. In Due Diligence, the entity is the controller and Snap Compliance acts as processor.
What counts as sensitive personal data under Law 21.719?
Data revealing ethnic or racial origin, political, trade union or professional affiliation, socioeconomic status, ideological or philosophical beliefs, religious beliefs, health, biological profile, biometric data, and sex life, sexual orientation or gender identity (art. 2, letter g). As a rule they require express consent (art. 16), and biometric data also require informing the system used, the purpose and the period (art. 16 ter). Compliance Agent records them as a risk and assesses their controls.
What rights do data subjects have and how long does a company have to respond?
Access, rectification, erasure, objection, portability and blocking (art. 4), plus the right not to be subject to solely automated decisions (art. 8 bis). The controller acknowledges receipt and responds within 30 calendar days, extendable once by another 30, and temporary blocking within 2 business days (art. 11). Rectification, erasure and objection are always free; access, at least once per quarter (art. 10). If refused or unanswered, the data subject may complain to the Agency. Compliance Agent tracks each action plan until it is closed.
What does Law 21.719 require for automated decisions and profiling?
Data subjects may object to decisions based on automated processing of their data, including profiling, that produce legal effects or significantly affect them (art. 8 bis), unless there is a contract, express consent or a law. Even then they are entitled to information, an explanation, human intervention and review. Systematic evaluation based on profiling also requires a prior impact assessment (art. 15 ter). In Scan Agent and AML Monitoring, the entity decides on each match and alert, and Snap explains the logic applied.
When must a security breach be reported under Law 21.719?
When it causes the destruction, leak, loss, alteration of or unauthorized access to personal data and there is a reasonable risk to data subjects: it is reported to the Agency through the fastest means and without undue delay, and recorded (art. 14 sexies). If it affects sensitive data, data of children under 14 or data on economic, financial, banking or commercial obligations, each data subject is also notified. Deliberately omitting it is a very serious infringement (art. 34 quáter). Compliance Agent turns each gap into a tracked action plan.
What obligations does a provider processing personal data on behalf of another company have?
It is a processor (art. 15 bis): it processes data only according to the assignment and the controller's instructions, under a contract that sets the object, duration, purpose, types of data and data subjects. It cannot subcontract without written authorization, keeps the data confidential, applies security measures, reports breaches to the controller and, at the end, deletes or returns the data. If it departs from the assignment, it is liable as a controller. In Compliance OS, Snap Compliance plays that processor role for its customers' data.
When can personal data be transferred outside Chile?
When the destination country has an adequate level of protection declared by the Agency, or when the transfer is covered by contractual clauses, binding corporate rules or a compliance model or certification with adequate safeguards (arts. 27 and 28). Without them, only specific, non-recurring transfers are allowed, for example with express consent from the data subject. Transferring in breach of the law is a serious infringement, and very serious if done knowingly. The Law 21.719 Assessment shows your gaps and which document closes each one.
What fines does Law 21.719 provide for?
A written warning or a fine of up to 5,000 UTM for minor infringements, up to 10,000 UTM for serious ones and up to 20,000 UTM for very serious ones (art. 35). Repeat offenses allow up to triple, and a non-small company reoffending with a serious or very serious infringement risks up to 2% or 4% of its annual revenue. Repeated very serious infringements can suspend processing for up to 30 days (art. 38). The Law 21.719 Assessment estimates your exposure against the legal ceiling.
Is a data protection officer mandatory, and who certifies the infringement prevention model?
The model is voluntary (art. 49) and so is the officer (art. 50), but appointing one is mandatory to certify the model (Decree 662, art. 6). The board or highest authority appoints them, with autonomy and sufficient resources; in SMEs the owner may act as officer. The Agency certifies the model for three renewable years and lists the entity in the Registro Nacional de Sanciones y Cumplimiento; certification mitigates liability (art. 36). The Law 21.719 Toolkit, in Spanish, goes as far as the certification file.

Would your program withstand a supervisor's review today?

We review with you where your institution stands against these rules and what it still needs to demonstrate compliance.

Talk to a specialist

Free self-assessment · Chile

How ready is your organization for Chile's Law No. 21.719?

Answer the questions that apply to your organization and see its blocking findings, its gaps by domain and its estimated exposure, with an action plan in Word. Available in Spanish.

16 domains · 45 to 90 minutes · save and resume 46 days until enforcement

Start the self-assessment (in Spanish)