The law in plain language
Law 21.719 modernizes Chile's former Law 19.628 on the protection of private life. It sets rules for processing personal data, expands people's rights and creates the Personal Data Protection Agency, which supervises and can impose penalties.
It was published in the Official Gazette on 13 December 2024 and applies from 1 December 2026 (first transitory article).
It applies to any person, company or public body that decides why and how personal data is processed: the law calls it the «data controller» (art. 2, letter n).
Key concepts
These are the words you will see again and again:
- Personal data
- Any information about an identified or identifiable person: name, RUT (Chilean ID number), email, phone, address and much more (art. 2, letter f).
- Sensitive data
- Health and biometric data, ethnic origin, socioeconomic status, beliefs, sexual orientation, political or union affiliation, among others. Stricter rules apply (art. 2, letter g).
- Data subject
- The person the data is about: your client, your employee, your patient.
- Controller
- Whoever decides why and how the data is used. Usually, your company.
- Processor
- A third party that processes data on behalf of the controller, such as a software or cloud provider (art. 2, letter x).
- Pseudonymization
- Processing data so it can no longer be attributed to a person without additional information, kept separately and protected (art. 2, letter l).
The principles you must follow
All data processing must follow these principles (art. 3):
- Lawfulness and fairness
- Process data only on a legal basis: the data subject's consent or another basis the law allows.
- Purpose limitation
- Use data only for specific, explicit and lawful purposes.
- Proportionality
- Use only the data needed, and only for as long as needed.
- Quality
- Keep data accurate, complete and up to date.
- Accountability
- Whoever processes data is legally responsible for meeting the law's principles and duties.
- Security
- Protect data against unauthorized access, loss or leaks.
- Transparency and information
- Explain to people what is done with their data.
- Confidentiality
- Keep data secret, even after the relationship with the data subject ends.
People's rights
Everyone can request access, rectification, erasure, objection, portability and blocking of their data (art. 4). These rights cannot be waived.
Your company must answer within 30 calendar days of receiving the request, extendable only once for another 30 (art. 11).
What your company has to do
Beyond the principles, the law sets specific duties for the controller:
- Inform
- Keep publicly available, on its website or another medium, its data processing policy, a channel to exercise rights, what data it processes, why and on what legal basis (art. 14 ter).
- Privacy by design and by default
- Apply technical and organizational measures from the start, and process by default only the data strictly needed (art. 14 quáter).
- Security
- Adopt security measures that match the risk and the type of data (art. 14 quinquies).
- Report breaches
- Notify the Agency without undue delay when a breach creates a reasonable risk, and keep a record of those notices. If it affects sensitive data, data of children under 14 or financial data, the people affected must also be notified (art. 14 sexies).
- Oversee processors
- Anyone processing data on your company's behalf must follow your instructions by contract. If they use it for something else, they become liable as a controller (art. 15 bis).
- Assess the impact
- When processing may create a high risk —for example, automated decisions with significant effects or large-scale processing— an impact assessment is required before starting (art. 15 ter).
Using AI with client data
When someone pastes a client's name, RUT or diagnosis into an AI chat, your company is handing that data to a third party: the AI provider. Often the provider also processes it outside Chile.
The law does not forbid using AI, but these situations have rules: disclosing data to third parties requires a legal basis, and international transfers are only lawful to countries with adequate protection or with safeguards such as contractual clauses (arts. 27 and 28). Processing unnecessary data, disclosing it without consent when consent is required or transferring it abroad outside the rules are serious infringements (art. 34 ter).
Infringements and penalties
Infringements are classified as minor, serious and very serious (arts. 34 bis, 34 ter and 34 quáter). Fines have these caps (art. 35); the UTM is Chile's monthly tax unit:
- Minor
- Written warning or a fine of up to 5,000 UTM.
- Serious
- Up to 10,000 UTM. For example: processing data without a legal basis, using unnecessary data, failing on security measures or transferring data abroad outside the rules.
- Very serious
- Up to 20,000 UTM. For example: fraudulent processing, knowingly misusing sensitive data or data of minors, or deliberately hiding a breach.
- If you don't fix it
- The Agency sets the measures to adopt; if they are not adopted within 60 days, the fine increases by 50% (art. 35).
- Repeat offenses
- Being penalized two or more times within 30 months allows fines of up to three times the amount. For companies that are not small businesses, in serious or very serious infringements, the fine can reach 2% or 4% of annual revenue (arts. 35 and 36).
- Suspension
- For repeated very serious infringements within 24 months, the Agency can suspend data processing for up to 30 days (art. 38).
- Public registry
- Penalized companies are listed in the National Registry of Sanctions and Compliance, public for five years (art. 39).
Timeline
13 December 2024: the law is published.
1 December 2026: it comes into force. During the first 12 months, the Agency may impose only a written warning on small businesses (sixth transitory article).
A bill (no. 18.623-07) proposes postponing the entry into force to 1 December 2027. As of 16 October 2026 it is still under review in the Senate: until it is approved and published, the date in force is 1 December 2026.
Where to start
A practical checklist to prepare your company:
- 1. Inventory
- What personal data you process, about whom, why and where it is stored.
- 2. Legal basis
- On what grounds you process each group of data: consent, contract, legal obligation or another.
- 3. Informing people
- A clear privacy policy and notices wherever you collect data.
- 4. Security and AI use
- Security measures that match the risk, and a policy on which AI tools may be used and how.
- 5. Rights and breaches
- A procedure to answer requests on time and a plan to report breaches.
- 6. Providers
- Contracts with your processors, including AI and cloud providers.
Frequently asked questions
Does it apply to small businesses?
Yes: it applies to every data controller. The Agency will set differentiated standards by company size (art. 14 septies), and in the first year small businesses may receive only a written warning.
Does the law forbid ChatGPT or other AI tools?
No. It requires data processing to have a legal basis, be proportionate and secure, and disclosures and transfers to follow the rules.
Does using ChatPrivIA make my company compliant?
Not by itself: no tool complies on your company's behalf. ChatPrivIA helps with AI use: real data does not reach the provider and there is a record of what was protected.
Where can I read the full law?
At the Library of the National Congress of Chile; the link is in the sources at the end of this guide.