Chile delays personal data law to 2027

Chile’s government has sent Senate Bill 18.623-07, under urgent review, to amend Law 21.719 on personal data protection and processing, and push full enforcement from Dec. 1, 2026, to Dec. 1, 2027. The proposal also preserves the creation of the Personal Data Protection Agency and introduces changes to its institutional design.

What changes does the bill sent to the Senate introduce?

The bill seeks to give lawmakers and regulators one more year for the full rollout of the new personal data law. According to the materials reviewed, the official explanation centers on the need for the institutional and operational conditions required to put the Personal Data Protection Agency in place.

In addition, specialized Chilean outlets reported that Bill 18.623-07 would expand the agency’s governing council from three members to five, set a minimum quorum of three, and allow the first violation by companies during the law’s first 12 months to be resolved with a written warning.

What stage are the law and the reform in?

Law 21.719 was published in the Official Gazette on Dec. 13, 2024, and was set to take effect on Dec. 1, 2026. The bill that would modify it is in the early stages of Senate review, classified as pending, according to analyses from Chilean consulting and compliance firms.

BioBioChile and TrendTIC both said the proposed delay does not mean abandoning the rule, only extending the timeline while preparation continues. TrendTIC stressed that the current law remains in force and that data controllers should keep preparing for the 2026 date while the bill moves forward.

What impact does this have on companies?

Companies that process personal data will still be expected to comply, because the law already exists and the bill has not yet cleared Congress. Public discussion in Chile is centered on the extra time needed to adjust processes, internal governance, and implementation capacity, especially since the new agency is not yet fully operational.

The Chilean Institute of Directors said the government is weighing a one-year delay precisely because of setbacks in launching the Personal Data Protection Agency. At the same time, other local reports have stressed that companies need to take action and should not assume the postponement is already settled.

How does this compare with Paraguay?

Paraguay approved Law 7,593/2025, a statute inspired by the European Union’s General Data Protection Regulation, with duties to inform data subjects, rules on communications and international transfers, and a penalty regime that includes significant fines. The regional comparison offers a contrast with Chile, where the debate now focuses on the start date and the authority’s launch.

According to Lawwwing’s analysis, Paraguay’s regime can reach fines of up to 5,000 daily jornales when sensitive data is affected, and up to 10,000 daily jornales if that data belongs to children and adolescents. In the available summary, full enforcement of that general personal data protection law is expected in 2027.

The comparison leaves Chile still in the institutional implementation phase, while Paraguay already has a law outlined with a strong sanction regime under its new general personal data protection framework.