Chile's Law 21719 requires you to document consent and the processing of personal data from the source and respond to every ARCO+ request within 30 days with audit-ready evidence. ARCO Legal guides you on both fronts: Preventive compliance —mapping, registry, policies, DPIA, DPA— and ARCO+ request management with deadlines, owners, legal responses, traceability and audit-ready evidence.
Founders' pricing guaranteed for customers who join before October 1, 2026.
Most Chilean companies will receive their first ARCO+ request without knowing who is responsible, where the data is, or that the clock is already ticking.
The request arrives via email, WhatsApp or the generic contact form. Nobody knows the 30-day clock has already started.
The data subject requests access. Your team hunts through the CRM, HR tools and Google Drive. Hours of manual work and the risk of an incomplete response.
The deadline expires without anyone noticing. A single out-of-time response is an independent infraction in front of the Agency.
ARCO Legal closes all three fronts.
A single dashboard to receive, assign, manage and respond to Access, Rectification, Cancellation, Opposition, Portability and Blocking requests. The system automatically calculates legal deadlines in calendar days and alerts your team before each one expires.
Every company gets its own public URL where data subjects can submit ARCO requests directly, simply and securely. No phone calls, no lost emails, no paper.
In accordance with Law 21719
Every request follows a predefined flow with clear stages. None is left unanswered or lost along the way: the system logs every move, who did it and when.
Automatic notifications before every deadline. Configure how many days in advance you want to be alerted.
Every action is recorded with a timestamp, the responsible user and the evidence. Ready for inspection.
Manage multiple RUTs or related companies from a single panel. Ideal for holdings and groups.
When each request is closed, the system generates a receipt with the date, deadline and response delivered. Evidence ready to present to the Agency.
Enter your company's name, RUT and logo. Define who is responsible for handling ARCO requests in your organization. It takes less than 10 minutes.
Get your branded URL (yourcompany.arco.legal) and publish it on your website, privacy policy and customer communications. Data subjects can submit requests 24/7.
Requests land on your panel. The system prioritizes them by deadline, assigns them to your team and alerts you before every due date. Your team responds, logs and closes every request with a compliance receipt.
Updated:
Chile's Law 21719 on Personal Data Protection requires every organization processing personal data of individuals to have a mechanism to receive and manage ARCO+ requests. Full enforcement takes effect on 1 de diciembre de 2026 (Art. 1 trans.).
Infractions are classified by severity: minor up to 5,000 UTM, serious up to 10,000 UTM, very serious up to 20,000 UTM (~USD 1.4M). Repeat offenders can be sanctioned with 2–4% of annual revenue (Art. 52). The supervising body is the Personal Data Protection Agency, autonomous and independent, with sanctioning powers from day one. Don't wait to be audited.
Comply todayAn ARCO+ request is the legal mechanism by which a person exercises their rights of Access, Rectification, Cancellation, Opposition, Portability and Blocking over their personal data. Law 21719 requires every organization processing personal data of individuals in Chile to have a formal process to receive and respond to them.
Every organization processing personal data of individuals in Chile is required, regardless of size or sector: retail, healthcare, fintech, education, logistics, SaaS, and any business that collects emails, RUTs, phone numbers or other identifying data.
Law 21719 sets a maximum of 30 calendar days from receipt of the request. Missing this deadline can be considered an infraction and lead to administrative sanctions.
Law 21719 sets a scale by severity: minor offenses up to 5,000 UTM (~$350M), serious up to 10,000 UTM (~$700M), and very serious up to 20,000 UTM (~USD 1.4M). Repeat offenders can be sanctioned with 2–4% of annual revenue. Each request not answered in time is an independent infraction.
Initial setup takes less than 10 minutes: enter your company details, define the responsible users and get the public form URL. That same day, data subjects can start submitting requests.
No. ARCO Legal automates the processes the law requires: intake of requests, calculation of deadlines in calendar days, assignment to owners and logging of responses. No ongoing legal counsel is required to operate the system.
Data is stored on cloud servers with encryption in transit and at rest. For companies in regulated sectors (banking, healthcare, government) that require data to reside in their own infrastructure, ARCO Legal offers on-premise deployment as part of the Enterprise plan.
The Personal Data Protection Agency is the autonomous and independent body in charge of supervising and sanctioning non-compliance with Law 21719. It has sanctioning powers from the first day of enforcement and may initiate investigations on its own or following data subject complaints.
Law 21719 comes into full effect on December 1, 2026.
Set up your company in less than 10 minutes. No credit card. If you'd rather have a guided walkthrough, we'll book you a free 20-minute demo.
Customers who book a demo before Oct 1, 2026 get founders' pricing.
Check your inbox — we'll email you within 24 hours with access to your free trial.
In the meantime, you can review the plans or read the frequently asked questions.