Chile’s new data protection law: what foreign companies must do before it applies.

Law 21,719 gives Chile a GDPR-style regime with real fines, and it reaches companies selling into Chile from abroad. Here is who is covered, what changes on day one, how transfers to Paraguay work, and what to have ready by December.

Chile moves from a 1999 law to a GDPR-style regime.

Chile’s Law 21,719 replaces the old personal data law of 1999 — a law with few duties and almost no enforcement — with a modern regime close to the EU’s GDPR: legal bases for every processing, a full set of rights, breach notification, international transfer rules, a dedicated regulator and fines that can reach a share of revenue.

It also reaches companies with no office in Chile. A Paraguayan company selling online to Chilean customers, running a platform with Chilean users or targeting Chilean audiences with ads is subject to it in the same way as a Chilean company. This guide covers what applies to a foreign company, what it must have in place on day one, and what can wait.

1 December 2026 — unless Congress moves it.

The law was published on 13 December 2024 with a two-year transition, so it applies from 1 December 2026. As we write, that date is under pressure. The new Personal Data Protection Agency does not yet have its board — the Senate rejected the first slate of nominees in May 2026 — and a bill filed on 31 August 2026 proposes moving the start to 1 December 2027. Some senators prefer a shorter delay of around six months.

Our advice is to plan for December 2026. If the date slips, the work is not wasted: the duties stay the same, and the first year of a new regulator tends to be about guidance, complaints and well-publicised early cases. A company that cannot show any effort at that point is the easiest target.

Law and practice: Law 21,719, published in the Diario Oficial on 13 December 2024, transitory article 1; bill Boletín 18,623-07 (August 2026). Check the status in Congress before you rely on any date.

Extraterritorial reach, as in the GDPR.

A foreign controller does not have to appoint a representative in Chile. It must, however, give the Agency and data subjects an email address or other electronic channel through which they can reach it, and keep it working. For most foreign companies that means a privacy contact on the website and in the privacy notice — and someone who actually reads it.

Law and practice: Law 19,628 as amended by Law 21,719, art. 1 bis (territorial scope) and art. 14 (duties of the controller, including the communication channel).

Every processing needs a reason the law accepts.

Consent remains the default, and it must be free, informed, specific and unambiguous; it can be withdrawn at any time. But Chile now accepts other bases, close to the GDPR list: performance of a contract, legal obligations, vital interests, public interest, and the controller’s legitimate interest — provided it does not override the person’s rights.

• ✓

  Sensitive data

  Wider than in Europe: it includes socioeconomic status and gender identity, as well as health, biometrics, beliefs and sexual life. As a rule it needs express consent.

• ✓

  Children

  Under 14, a parent or guardian consents. Sensitive data of adolescents under 16 also needs parental consent.

• ✓

  Marketing

  Legitimate interest can support it, but people can object at any time and you must stop.

• ✓

  Publicly available data

  No longer a free-for-all: its use must still be compatible with why it was published.

Law and practice: Law 19,628 as amended, arts. 12 and 13 (lawful bases) and the rules on sensitive data and children’s data.

Six rights, short deadlines.

The deadlines are tighter than the GDPR’s month-plus-two. A foreign company should be able to receive a request in Spanish, verify the person, find their data across systems and answer within 30 days. If a request is refused or ignored, the person can complain to the Agency.

Law and practice: Law 19,628 as amended, the chapter on data subject rights, including art. 8 bis (automated decisions).

Notify without undue delay — there is no 72-hour clock.

When a security breach causes a reasonable risk to people’s rights, the controller must notify the Agency “without undue delay”. Unlike the GDPR, the law sets no fixed number of hours; the Agency is expected to set out the practice. If the breach involves sensitive data, data of children under 14 or financial data such as bank or card details, the affected people must be told as well, in clear and simple language.

In practice, that means an incident procedure decided in advance: who assesses the breach, who signs the notice, which template goes to the Agency and which to customers. Working out the answers during the incident is how a breach turns into a fine.

Law and practice: Law 19,628 as amended, art. 14 sexies (security breaches).

Sending Chilean data abroad — including to Paraguay.

Personal data may be transferred abroad freely to countries the Agency recognises as adequate. Elsewhere you need a safeguard: contractual clauses, binding corporate rules, a certified model or one of the listed exceptions such as consent or contract performance.

Paraguay has not been recognised as adequate, and no country list has yet been published. The Ministry of Finance released model contractual clauses in December 2025; EU standard contractual clauses are not automatically accepted, so a group already using them should check them against the Chilean model. A Paraguayan company hosting Chilean customer data in Paraguay, the US or Brazil should have clauses with every processor and group company involved.

Law and practice: Law 19,628 as amended, arts. 27 and 28 (international transfers). Transfers inside one group need the same safeguards.

No mandatory DPO — but an incentive to have one.

Appointing a data protection officer is voluntary. It becomes necessary if you want a certified infringement prevention model: a DPO, a risk map, internal policies, training and a reporting channel, certified by an entity registered with the Agency. Under the regulation issued in September 2026, a certificate lasts three years. A working model is a mitigating factor if you are fined.

For a foreign company with modest Chilean activity, a full certified model is usually more than needed. What pays its way is the core: a record of processing, a privacy notice in Spanish, processor contracts, an incident procedure and a named person accountable for all of it.

Law and practice: Law 19,628 as amended, art. 50 (DPO and prevention model), art. 36 (mitigating factors); Supreme Decree 662 of 2026 on certification.

Fines in UTM, and a public register.

The Agency can also order processing to stop for up to 30 days for repeated very serious infringements. Sanctions go into a public National Register of Sanctions for five years — a reputational cost a Chilean client or bank will notice. Fines rise by 50% if the company does not fix the problem within the time it is given.

Small and medium companies get lighter treatment: proportional standards and, for a first minor infringement, the option of a written warning with twelve months to comply. The revenue-based fines apply only to large companies that repeat very serious infringements.

Law and practice: Law 19,628 as amended, the rules on infringements, sanctions and the public register. UTM CLP 72,151 for October 2026.

What a foreign company needs by December.

Straight answers.

Go deeper.