Chile Personal Data Protection Law 21.719
Chile's new law governing how companies and entities process personal data. Here's what is already in force, what is coming, and how to prepare.
What Law 21719 is and who it applies to
Law N°21.719, published on December 13, 2024 and in full effect since December 1, 2026, is Chile's new personal data protection framework. It replaces the previous regime of Law 19.628 and draws on the GDPR standard, adapted to the local regulatory reality.
It applies to any organization — public or private, for-profit or not — that processes personal data of individuals in Chile, regardless of size, sector or whether the data is stored domestically or abroad.
Key dates
- Dec 13, 2024
Publication
The law is published in the Official Gazette after being passed by Congress.
- Jun 13, 2025
Decree 662
The regulation detailing the operational aspects of the law is published.
- Dec 1, 2026
Full effect
All obligations are enforceable and the Agency begins supervision.
What the law requires you to do
Beyond ARCO+ request handling, the law requires a set of operational obligations. These are the ones every legal or compliance team must have in place before December 1, 2026.
Maintain a Record of Processing Activities (RAT)
Document every personal data processing: legal basis, purpose, data categories, retention period and processors.
Read: What is a RAT and how to build oneRespond to ARCO+ requests within 30 calendar days
Receive, route and respond to Access, Rectification, Cancellation, Opposition, Portability and Blocking requests within the legal deadline.
Read: An ARCO+ request just landed on your deskRetain RUTs and other identifiers with legal basis
Every data point you retain needs a documented purpose and a defined retention period. RUTs can no longer be kept 'just in case'.
Read: Do you keep your clients' RUTs?Manage granular consents
Where the legal basis is consent, it must be free, informed, specific and revocable. Each purpose separately.
Notify security incidents to the Agency
Any incident affecting personal data must be reported within defined deadlines. Opacity is no longer an option.
The ARCO+ rights any individual can exercise
Law 21719 extends the classic ARCO rights (Access, Rectification, Cancellation, Opposition) with two new ones: Portability and Blocking. Any individual can exercise them against your organization, without needing a lawyer.
Access
Know what data you hold on me and what you use it for.
Rectification
Correct inaccurate, incomplete or outdated data.
Cancellation
Delete my data when it is no longer needed for the purpose.
Opposition
Object to processing based on legitimate interest or direct marketing.
Portability
Receive my data in a structured format and transfer it to another provider.
Blocking
Temporarily suspend processing while a dispute is resolved.
Fines and sanctions
The Personal Data Protection Agency has the power to impose tiered administrative sanctions by severity, plus proportional-to-revenue fines for repeat offenders.
- Minor offenses
- Up to 5,000 UTM (~ $350M CLP)
- Serious offenses
- Up to 10,000 UTM (~ $700M CLP)
- Very serious offenses
- Up to 20,000 UTM (~ $1,400M CLP)
- Repeat offenders (proportional to revenue)
- 2% – 4% of annual revenue
Who supervises
The Personal Data Protection Agency is the autonomous and independent body created by the law itself. It begins its supervisory functions from the first day of effect (December 1, 2026) and can act on its own initiative or following complaints from any data subject.
Request your demo.
Get practical guidance on compliance
Law 21719 comes into full effect on December 1, 2026 — and getting ready takes weeks.
Request a 20-minute demo and get practical guidance on compliance and consent under Chile's Personal Data Protection Law 21719. We'll reach out within 24 hours to schedule it.
Customers who join before Oct 1, 2026 get founders' pricing.
Done! We'll review your request.
Check your inbox — we'll email you within 24 hours to schedule your demo.
In the meantime, you can review the plans or read the frequently asked questions.