Chile Data Protection Law Guide: Law 21,719, the New Agency and Security Duties

Chile is weeks away from replacing one of Latin America's oldest and weakest privacy laws with a GDPR-style regime that has a dedicated regulator, breach notification and revenue-based fines. Law 21,719, published in the Diario Oficial on 13 December 2024, rewrites Law 19,628 of 1999 and creates the Agencia de Protección de Datos Personales, with the new rules taking effect on 1 December 2026. This guide covers scope, the obligations security teams will operate, the timeline, enforcement, what the law means for AI agents and machine credentials, and a phased plan for the final weeks before the start date. It also briefly places the Framework Cybersecurity Law 21,663 and its separate incident reporting regime alongside it. It is for security, privacy and engineering leads with processing in Chile.

Key takeaways

• The start date is 1 December 2026: the first transitory article brings the amendments into force on the first day of the 24th month after publication, which official government sources give as 1 December 2026. A government bill filed on 1 September 2026 (Boletín 18.623-07) would move it to 1 December 2027, but as of 21 October 2026 it was still in its first stage in the Senate.
• Security is a provable duty: the new Art. 14 quinquies requires measures that ensure confidentiality, integrity, availability and resilience, and puts the burden on the controller to show those measures existed and worked when an incident happens.
• Breaches go to the Agency without undue delay: Art. 14 sexies requires reporting by the most expeditious means possible when there is a reasonable risk to data subjects, and direct notice to individuals when sensitive data, data of children under 14 or financial data is affected.
• Fines now scale with size: infractions are graded minor, serious and very serious, with fines up to 5,000, 10,000 and 20,000 UTM, and large companies can face 2% or 4% of annual revenue, according to DLA Piper's summary.
• Two regulators, two clocks: organisations covered by Law 21,663 also report significant cyber incidents to the national CSIRT under ANCI, with an early alert within 3 hours, so one incident can trigger both regimes.

Scope: who and what is covered

Law 21,719 amends Law 19,628, which is renamed the Law on the Protection of Personal Data, and applies to processing of personal data by private and public bodies. The current law has no regulator, no breach notification and modest fines; the reformed law brings Chile close to the GDPR model, including a public sector chapter and an independent agency. The amendments also touch Law 20,285 on transparency and Law 19,496 on consumer protection.

Territorial reach: the reform extends the law to some processing by controllers outside Chile. The precise tests were not confirmed from the primary text for this guide, so foreign groups serving people in Chile should check the article directly with counsel rather than assume they are out of scope.

Key obligations

Rights and transparency

Data subjects gain rights of access, rectification, deletion (supresión), opposition and portability, can withdraw consent, and can complain to the Agency if a request is refused or unanswered. Controllers must explain automated decisions and profiling, including the logic applied and expected consequences, and disclose transfers to third countries and whether those countries offer adequate protection. Art. 14 ter requires public information on processing policies, security measures, retention periods and data sources, and identification of the prevention officer on the website where one exists.

Security duty (Art. 14 quinquies)

The controller must adopt security measures appropriate to the state of the art, implementation costs, the probability and severity of the risks, and the nature of the data. The measures must ensure the confidentiality, integrity, availability and resilience of processing systems. The article gives examples that match GDPR Art. 32: pseudonymisation and encryption, the ability to restore availability and access after an incident, and regular testing of the measures' effectiveness. Critically, in the event of an incident or dispute the controller must prove that the measures existed and were working.

Breach notification (Art. 14 sexies)

• Trigger: a breach of security measures causing destruction, leakage, loss, alteration or unauthorised access to personal data, where there is a reasonable risk to data subjects' rights and freedoms.
• To the Agency: by the most expeditious means possible and without undue delay. The law sets no fixed number of hours; expect the Agency's regulations to give more detail, and plan for a GDPR-like 72 hour working target.
• To data subjects: required where the breach concerns sensitive data, data of children under 14, or data on financial, economic, banking or commercial obligations. Notice must be individual and in clear language; if that is not possible, through a notice in a national mass-circulation medium.
• Record: the controller must keep a record of breaches. Keep below-threshold incidents in it with the reasoning.
• Processors: must report breaches to the controller (Art. 15 bis), so contracts need a short internal deadline.

Compare Chile's approach with other jurisdictions in the Breach Notification Laws by Country Guide.

Impact assessments, processors and transfers

• Impact assessment (Art. 15 ter): required before processing likely to pose a high risk, and always for systematic and exhaustive profiling with significant effects, large-scale processing, systematic monitoring of publicly accessible areas, and sensitive data processed under a consent exception. See the DPIA Guide.
• Processor contracts (Art. 15 bis): must set the object, duration, purpose, types of data and categories of data subjects. The Agency will publish model contracts.
• International transfers: lawful to a country with adequate protection, under contractual clauses, binding corporate rules or other instruments with adequate safeguards, or under a compliance model or certification adopted by exporter and recipient (DLA Piper summary). See the International Data Transfers Map.
• Prevention model and DPO: an infraction prevention model (Art. 49) is voluntary; if adopted it must include a data protection delegate with sufficient means and autonomy (Art. 50). A model certified by the Agency is recorded in the national register and counts in the controller's favour.

The Framework Cybersecurity Law alongside it

Law 21,663, published on 8 April 2024, created the Agencia Nacional de Ciberseguridad (ANCI) and a national CSIRT. It covers providers of essential services (including electricity, fuels, water, telecommunications, finance and health) and operators of vital importance designated by ANCI. Art. 9 requires an early alert within 3 hours of learning of a significant incident, an update within 72 hours (24 hours for an operator of vital importance whose essential service is affected), and a final report within 15 calendar days of the early alert. Reports go to the national CSIRT through its reporting channel. A ransomware attack on a hospital database can therefore require a 3 hour ANCI alert and, separately, a report to the data protection Agency and letters to patients. See the Incident Response Guide for running parallel notification tracks.

Timeline and current status

Status as of October 2026: government sources, including Decree 12 of 2025 and a January 2026 report, still give 1 December 2026 as the start date. A postponement bill to 1 December 2027 (Boletín 18.623-07) was in the Senate Constitution Committee as of 21 October 2026; until a law amending the first transitory article is published, 1 December 2026 applies. Whether every implementing regulation and the Agency's council are in place by that date was not confirmed for this guide, so check the BCN text and the Agency's announcements before relying on procedural detail.

Enforcement and penalties

The Agency supervises compliance, handles complaints, issues instructions and model contracts, certifies prevention models and imposes sanctions. Fines are expressed in UTM (Unidad Tributaria Mensual, an inflation-indexed monthly unit).

Figures in this table come from DLA Piper's summary of the law and were not checked against the article text for this guide. Sanctioned controllers are entered in the public Registro Nacional de Sanciones y Cumplimiento, which also lists certified prevention models, and accessory sanctions such as suspension of processing are available. The register is a reputational lever in procurement as much as a legal one.

What it means for AI agents and non-human identities

• Proof of security covers machine access: under Art. 14 quinquies the controller must prove its measures worked. If an exposed service account key opened the database, the evidence trail on that credential (owner, scope, rotation, last use) is the defence. See the Secrets Management Guide.
• Agents trigger impact assessments: an agent that profiles customers or makes decisions with significant effects falls in the Art. 15 ter mandatory cases, and the controller must also explain the logic of automated decisions. See the Agentic AI Identity Guide.
• AI vendors are processors: an external model provider or agent platform processing personal data needs an Art. 15 bis contract, a ban on unauthorised subcontracting and a breach reporting clause.
• Financial data raises the stakes: fintech agents and integrations touching banking or commercial obligation data put a breach straight into the data subject notification tier.
• Logs for two regulators: the same identity and access logs support both the Agency's breach report and the ANCI 72 hour update with indicators of compromise. See the AI Agent Audit Trails for Regulators Guide.

Compliance steps

1. Confirm exposure now: list processing of personal data of people in Chile, Chilean entities and processors, and check whether any entity is an essential service or designated operator of vital importance under Law 21,663.
2. Inventory and publish: build the record of processing with purposes, legal bases, data categories, retention, transfers and the human and machine identities with access, then publish the Art. 14 ter information. The Data Mapping and ROPA Guide gives the structure.
3. Close security gaps with evidence: map current controls to Art. 14 quinquies, prioritise encryption, least privilege and restore testing for stores holding sensitive and financial data, and keep test results.
4. Build the breach path: add a Chile branch to the incident runbook with the Agency report, the data subject notice tiers, the breach record, and a parallel ANCI track where Law 21,663 applies. Rehearse it in a tabletop starting from a leaked token.
5. Re-paper processors and transfers: update contracts to Art. 15 bis, add a processor breach notice clause of 24 to 48 hours, and record the transfer mechanism for each flow.
6. Run impact assessments: start with AI and profiling use cases, CCTV and large-scale customer processing.
7. Decide on a prevention model: it is voluntary, but a certified model and a delegate strengthen the position in any sanction proceeding.

Testing and rollback: pilot new rights-request handling and notices in one business unit before 1 December, confirm that requests are logged end to end, then extend. Keep old notices and policies archived so you can show what applied before and after the start date.

Small versus large organisations

Small companies get size-calibrated standards under Art. 14 septies and a first year in which the Agency may warn rather than fine, but the breach duty applies from day one. Large groups face revenue-based fines and should align the Chilean programme with their GDPR controls, adding the Spanish-language notices, the data subject notice tiers and the ANCI clock that GDPR programmes do not cover.

Measuring it

• Inventory coverage: percentage of systems processing Chilean personal data in the record of processing.
• Evidence readiness: share of Art. 14 quinquies controls with test evidence less than 12 months old.
• Notification time: hours from detection to Agency report in exercises, and minutes to ANCI early alert where applicable.
• Contract coverage: percentage of processors on Art. 15 bis compliant contracts.
• Rights timeliness: percentage of rights requests closed within the legal period.
• Machine credential hygiene: percentage of service accounts and agent credentials on personal data stores with an owner and rotation date.

Common failure patterns

• Waiting for the regulations: the core duties are in the law itself and apply on 1 December 2026 whether or not every regulation is final.
• Running one incident track: essential services report to ANCI within 3 hours and separately to the data protection Agency; a single runbook branch misses one.
• Security without proof: controls that exist but have no test record fail the burden of proof in Art. 14 quinquies.
• Missing the financial data tier: treating a breach of payment or debt data as low risk, when it requires direct notice to data subjects.
• Silent processors: contracts with no breach notice clause, leaving the controller unaware of a vendor incident.
• Ignoring non-human access: inventories that list human roles but not the API keys, integrations and agents reading personal data. See the API Key Management Guide.

Practitioner checklist

• Confirm 1 December 2026 readiness for every entity and processor handling personal data of people in Chile.
• Check whether any entity is an essential service or operator of vital importance under Law 21,663.
• Complete the record of processing and publish Art. 14 ter transparency information.
• Map controls to Art. 14 quinquies and keep dated test evidence.
• Add Agency notification, data subject notice tiers and the breach record to the incident runbook.
• Add the ANCI 3 hour, 72 hour and 15 day reporting track where Law 21,663 applies.
• Update processor contracts to Art. 15 bis with a short breach notice clause.
• Run impact assessments for AI, profiling and large-scale processing before go-live.
• Scope, rotate and log service accounts, API keys and agent credentials that reach personal data.

Standards and references

• Biblioteca del Congreso Nacional: Ley 21.719 que regula la protección y el tratamiento de los datos personales
• Biblioteca del Congreso Nacional: Ley 21.663 Ley Marco de Ciberseguridad
• Gobierno Digital de Chile: Guía práctica de implementación de la nueva ley de datos personales
• Diario Oficial: Decreto 12 de 2025, Comisión Asesora para la implementación de la nueva ley de protección de datos personales
• Agencia Nacional de Ciberseguridad: official website
• Senado de Chile: tramitación del Boletín 18.623-07
• Ministerio de Economía: Gobierno propone ampliar plazo para implementar nueva Ley de Protección de Datos
• DLA Piper: Data Protection Laws of the World, Chile
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev. 5

This guide summarises Chile's Law 21,719 reforming Law 19,628, and the incident reporting duties of Law 21,663, as of October 2026 and is not legal advice. Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Brazil LGPD Guide · Colombia Data Protection Law Guide · Argentina Data Protection Law Guide · GDPR Compliance Guide for Security Teams