Contents Knowledge map

Before you read

This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.

Chile

Open in Knowledge map

Sources last checked:

Chile’s Law 21.719 rewrites its 1999 privacy law and creates a new regulator, the Data Protection Agency.1 On Chile’s official legal record it takes effect on 1 December 2026.2

At a glance

Question Answer
Takes effect 1 December 2026, unless postponed2
Answer to a rights request Within 30 calendar days, extendable once3
Report a breach to the regulator As fast as possible, when there is a reasonable risk to people4
Highest fine 20,000 monthly tax units (UTM)5

What may change

A bill to postpone the start was approved by the Senate on 28 October 2026, moving the date to 15 October 2027, and went to the Chamber of Deputies.6 Until a law changes it, the date above stands.

Source note: the official records of this bill, at the Senate and the Chamber of Deputies, could not be reached. This section relies on a law firm’s report.

Who it covers

It applies to organisations established in Chile, and to those outside it that offer goods or services to people in Chile, paid or free, or monitor their behaviour there.7

Your rights

Right (ARCOP and more) What it lets you do
Access8 Confirm whether your data is used, and see it
Rectification9 Correct or complete your data
Cancellation (erasure)10 Have data deleted
Objection11 Oppose some uses
Portability12 Get a copy of your data
Automated decisions13 Oppose significant decisions made automatically, with exceptions
Blocking14 Have processing temporarily suspended

If the organisation refuses, you have 30 working days to complain to the Agency.3

Children

Using a child’s data requires consent from a parent or guardian. Teenagers follow the adult rules, except that sensitive data of those under 16 also needs that consent.15

Sending data abroad

A transfer is lawful in the cases the law lists, once the general requirements are met.16

Fines

Minor infringements bring a warning or up to 5,000 UTM, serious ones up to 10,000 and very serious ones up to 20,000.5

References

  1. Law 19.628 as replaced, Article 30: Data Protection Agency (in Spanish) ↩

  2. Law 21.719, Library of the National Congress of Chile (in Spanish) ↩ ↩2

  3. Law 19.628 as replaced, Article 11: Procedure before the controller (in Spanish) ↩ ↩2

  4. Law 19.628 as replaced, Article 14 sexies: Reporting security breaches (in Spanish) ↩

  5. Law 19.628 as replaced, Article 35: Sanctions (in Spanish) ↩ ↩2

  6. Garrigues (law firm), report on the Senate’s approval (secondary source, in Spanish) ↩

  7. Law 19.628 as replaced, Article 1 bis: Territorial scope (in Spanish) ↩

  8. Law 19.628 as replaced, Article 5: Right of access (in Spanish) ↩

  9. Law 19.628 as replaced, Article 6: Right of rectification (in Spanish) ↩

  10. Law 19.628 as replaced, Article 7: Right of erasure (in Spanish) ↩

  11. Law 19.628 as replaced, Article 8: Right to object (in Spanish) ↩

  12. Law 19.628 as replaced, Article 2(u): Portability (in Spanish) ↩

  13. Law 19.628 as replaced, Article 8 bis: Automated individual decisions (in Spanish) ↩

  14. Law 19.628 as replaced, Article 8 ter: Right to block processing (in Spanish) ↩

  15. Law 19.628 as replaced, Article 16 quáter: Children’s and adolescents’ data (in Spanish) ↩

  16. Law 19.628 as replaced, Article 27: International transfers (in Spanish) ↩