Chile’s data law takes effect in 2026

Update August 24, 2026: implementation of Law 21.719 in 2026 added a final report from the ministerial advisory commission, a practical government guide for public agencies, and several analyses detailing the scope of its new obligations and penalties. The timeline for full enforcement and the phased rollout for micro and small businesses were also clarified.

Chile’s Personal Data Protection Law, Law 21.719, will take full effect on Dec. 1, 2026, after a 24-month transition period from its publication in December 2024. That step will fully reform Law 19.628, create the Personal Data Protection Agency and bring the country’s framework in line with stricter privacy standards.

When does the new law take effect?

Law 21.719 takes full effect on Dec. 1, 2026, following a 24-month transition period from its publication in December 2024, according to reporting by La Tercera and XMS. That milestone marks the operational start of the new personal data protection regime.

Chile’s Judicial Academy included the law among its regulatory update resources and specified that the new statute, which transforms Law 19.628, begins on that date. FactorIT also warned that by mid-2026 most companies still did not have a comprehensive compliance plan, even though only a few months remained before enforcement.

What changes for public agencies and companies?

The new law applies to public agencies, individuals, legal entities and companies that process personal data of people in Chile, regardless of size or sector, according to EIPD Chile and Lawwwing. Ontier Chile adds that the regime reframes privacy rights for the digital environment.

The Ministry General Secretariat of the Presidency published a Practical Guide to help implement the new Personal Data Law, with technical and organizational guidance for public agencies. The document makes clear that the law will fully reform Law 19.628 and that the Personal Data Protection Agency will be the center of the new institutional model.

Ontier Chile says the law will introduce obligations such as impact assessments, a record of processing activities and stronger security duties for controllers and processors once it enters into force. GRC360 describes a phased rollout, with an initial stage around December 2025 to launch the agency and a second one around December 2026 to activate operational obligations such as expanded ARCO rights, appointment of a DPO and impact assessments.

What penalties does the law set?

Law 21.719 sets fines of up to 5,000 UTM for minor violations, 10,000 UTM for serious violations and 20,000 UTM for very serious violations, according to La Tercera. AGLAYA says serious conduct includes failing to report a security breach, processing data without a lawful basis or transferring it to countries without equivalent safeguards.

The same guide classifies as very serious the unlawful processing of sensitive data, the use of minors’ data without the required consent, the diversion or fraudulent sale of databases and obstruction of the agency. Surtika adds that during the first 12 months after full enforcement, the agency may issue only written reprimands to smaller companies, under the sixth transitional article.

What institutional framework does it create?

The law creates the Personal Data Protection Agency and gives it a three-member board appointed by the executive branch with Senate approval, according to the structure already described in the original report. That board will be able to issue interpretive rules, certify compliance programs and coordinate with other public bodies on data processing.

The government guide and Ontier’s analysis agree that the agency will be the center of the new institutional model. The ministerial advisory commission responsible for implementation delivered its final report to Minister Macarena Lobos on Jan. 30, 2026, with recommendations for rolling out the new system.

Why did the debate arrive before full enforcement?

Because implementation has already moved ahead through administrative and technical channels, even before the law begins to apply in full. The final report from the advisory commission, the government guide and specialized analyses show that preparation started early to avoid a sudden shift in December 2026.

In that context, the regulatory debate intersects with other changes in digital security and compliance. The Financial Market Commission began strictly enforcing reinforced client authentication rules for electronic transfers and digital payments, which forces banks to phase out coordinate cards and strengthen authentication mechanisms.

The original report already placed this law within a broader reordering of Chile’s digital regulatory environment, alongside the Cybersecurity Framework Law 21.663, the advance of the artificial intelligence bill and the processing of the deepfake bill. That map remains in place and now adds a personal data regime with penalties, technical obligations and its own enforcement structure.

A more demanding compliance framework

The result is a denser compliance environment for public agencies and companies that process data or rely on digital services. The new data law, Cybersecurity Law 21.663 and the authentication rules in the financial system all push in the same direction: tighter control over information handling and stricter requirements for the digital channels used to operate.

Sector analyses also point to an impact. Revista Gestión y Tendencias describes the law as a paradigm shift in Chile’s regulatory ecosystem, with expectations of more litigation, stronger technical capabilities at the new agency and adjustments in data-heavy industries such as finance, health care and retail.