Cybersecurity law & regulation in Chile (2026)

Legal framework

Ley Marco de Ciberseguridad No. 21.663 (April 8, 2024), enforced by the Agencia Nacional de Ciberseguridad (ANCI)

Key points: cybersecurity in Chile

1. 01ANCI establishment

   The Agencia Nacional de Ciberseguridad (ANCI) was created by Law 21.663 as a decentralized, technically specialized public body. It commenced operations on January 1, 2025, and holds regulatory, supervisory, standard-setting, and sanctioning powers over both public and private entities in scope.

   anci.gob.cl anci.gob.cl

2. 02Entry into force timeline

   The law was promulgated March 26, 2024, and published in the Diario Oficial on April 8, 2024. Core obligations for essential service providers applied from January 1, 2025; provisions governing OVI designation, OVI-specific duties, and the sanctions regime entered into force on March 1, 2025.

   loc.gov bcn.cl

3. 03Mandatory incident reporting

   All in-scope public and private institutions must report significant cybersecurity incidents to the ANCI's National CSIRT within 3 hours of detection, provide a progress update within 72 hours, and submit a final report within 15 days. Reports are filed through the ANCI portal at portal.anci.gob.cl.

   allende.com hunton.com

4. 04Two-tier regulated entity classification

   The law distinguishes Essential Service Providers (energy, healthcare, transport, banking, telecoms, water/sanitation, IT sectors) from Operators of Vital Importance (OVIs), who face stricter obligations including continuous risk management, security audits, and mandatory participation in national cybersecurity exercises.

   trade.gov practiceguides.chambers.com

5. 05OVI designation, final list (December 2025)

   On December 17, 2025, ANCI published the final first-group list designating 915 public and private institutions as OVIs across electricity, telecoms, banking/payments, digital services, healthcare, and public administration sectors.

   carey.cl

6. 06Penalties for non-compliance

   Serious infringements by Essential Service Providers carry fines up to 10,000 UTM (~USD 725,000). For OVIs the ceiling rises to 40,000 UTM (~USD 2.9 million). Repeat or especially grave violations by OVIs can result in temporary suspension of operations.

   allende.com dacbeachcroft.com

Timeline of decisions

1. 1 Dec 2025Guidance · official
   ANCI Issues General Instructions 2-4 Clarifying Framework Law Obligations

   ANCI published three general instructions in the final weeks of 2025 clarifying supplementary registration procedures for essential-service providers, the 60-day deadline to appoint a Cybersecurity Delegate for Vital Importance Operators, and mandatory measures to contain incident propagation. They operationalize Law 21.663's compliance requirements across regulated entities.

   ANCI – Agencia Nacional de Ciberseguridad

2. 4 Jun 2025Guidance · official
   ANCI Instrucción General N°1: Essential Services Must Register on Incident-Reporting Platform

   ANCI's inaugural general instruction imposed a mandatory registration obligation on all entities providing essential services, requiring enrollment in the ANCI incident-reporting platform. It was the first direct private-sector compliance deadline enforceable under the Cybersecurity Framework Law.

   ANCI – Agencia Nacional de Ciberseguridad

3. 1 Mar 2025Law · official
   Cybersecurity Framework Law (Ley 21.663) Key Articles Enter Into Force

   Core provisions of Chile's first standalone cybersecurity law took effect, imposing mandatory risk management, cybersecurity-officer designation, and incident-reporting duties on Operators of Vital Importance (OVI), including AI-reliant critical-infrastructure operators, supervised by ANCI with fines up to 40,000 UTM.

   Agencia Nacional de Ciberseguridad (ANCI)

4. 1 Mar 2025Law · official
   Cybersecurity Framework Law 21.663: Core Enforcement Provisions Enter Force

   Key articles of the Cybersecurity Framework (DFL N°1-21.663, published December 2024) became operative, imposing mandatory incident-reporting duties and minimum security standards on designated 'essential services' and 'vital operators'. The Agencia Nacional de Ciberseguridad (ANCI) activated its supervisory and sanctioning powers, directly complementing data-breach obligations under Law 21.719.

   Agencia Nacional de Ciberseguridad (ANCI)

5. 1 Mar 2025Law · official
   Vital Importance Operator Classification and Mandatory Incident-Reporting Obligations Enter Into Force

   The provisions of Law 21.663 governing the designation of Vital Importance Operators (OIVs), including their specific cybersecurity duties and mandatory incident notification timelines, became enforceable, completing the phased entry into force of Chile's Cybersecurity Framework Law.

   ANCI – Agencia Nacional de Ciberseguridad

6. 1 Jan 2025Law · official
   Cybersecurity Framework Law 21.663 Enters into Force, ANCI Becomes Operational

   The operative provisions of Law 21.663 take effect, making ANCI (Agencia Nacional de Ciberseguridad) functional as Latin America's first dedicated national cybersecurity regulator, with authority to issue binding regulations, conduct audits, and sanction critical infrastructure operators in both public and private sectors.

   Agencia Nacional de Ciberseguridad (ANCI)

7. 1 Jan 2025Decision · official
   ANCI Becomes Operational; General Provisions of Law 21.663 Take Effect

   Chile's National Cybersecurity Agency (ANCI) formally commenced operations, making Chile the first Latin American country with a dedicated autonomous cybersecurity regulator. General provisions of the Cybersecurity Framework Law simultaneously entered into force, establishing the new regulatory architecture governing public and private sector entities.

   ANCI – Agencia Nacional de Ciberseguridad

8. 8 Apr 2024Law · official
   Cybersecurity Framework Law 21.663 Published in the Diario Oficial

   Chile enacted its first comprehensive Cybersecurity Framework Law, promulgated March 26 and published April 8, 2024, creating the ANCI as an autonomous regulator, defining Critical Information Infrastructure and essential services (energy, finance, healthcare, transport, telecoms), mandating incident reporting, and imposing proportional cybersecurity obligations on both public and private sectors.

   Biblioteca del Congreso Nacional de Chile

9. 4 Dec 2023Decision · official
   National Cybersecurity Policy 2023-2028 Enacted via Decree N°164

   Decree N°164 published in the Diario Oficial adopted Chile's second National Cybersecurity Policy. Its five strategic axes, resilient infrastructure, digital rights, security culture, international cooperation, and institutional development, replaced the 2017-2022 policy and served as the political blueprint for Law 21.663.

   ANCI – Agencia Nacional de Ciberseguridad

10. 25 Sept 2022Incident · official
    LockBit Black Ransomware Attacks Chile's Poder Judicial

    A LockBit Black ransomware campaign propagated through the Poder Judicial's network on September 25, 2022, infecting more than 100 computers. CSIRT issued a critical cybersecurity alert; the Judiciary filed criminal complaints. The high-profile attack on the national court system intensified congressional urgency to pass the pending Cybersecurity Framework Law.

    CSIRT Nacional de Chile

11. 20 Jun 2022Law · official
    Law 21.459 on Computer Crimes Enters into Force, Budapest Convention Alignment

    Law 21.459 repealed and replaced the outdated 1993 Law 19.223, criminalising unlawful access, interception, computer sabotage, malware trafficking, credential abuse, and computer fraud; it also extended corporate criminal liability and introduced aggravated penalties when victims are minors. The reform fulfilled Chile's commitments under the Budapest Convention on Cybercrime.

    Agencia Nacional de Ciberseguridad (ANCI)

12. 7 Sept 2020Incident · official
    REvil/Sodinokibi Ransomware Forces Closure of All BancoEstado Branches

    Chile's state-owned BancoEstado was struck by REvil (Sodinokibi) ransomware after a malicious Office attachment was opened by an employee, infecting an estimated 14,000 computers and forcing closure of all 400+ branches. The largest cyberattack on Chilean financial infrastructure to date triggered a Senate inquiry and catalyzed calls for comprehensive cybersecurity legislation.

    Senado de la República de Chile

13. 1 Jan 2018Decision · official
    Government CSIRT Formally Established Under Ministry of Interior

    Chile established the Government Computer Security Incident Response Team (CSIRT) under the Ministry of the Interior, providing the state with a dedicated operational cyber-defense capability for public administration and critical infrastructure. Public agencies were required to report cybersecurity incidents to CSIRT within three hours of confirmation.

    CSIRT Nacional de Chile

14. 1 May 2017Decision · official
    National Cybersecurity Policy 2017-2022 Adopted, Chile's First

    The Interministerial Committee on Cybersecurity launched Chile's inaugural National Cybersecurity Policy, establishing five objectives: a free, open, secure, and resilient cyberspace; protection of individuals' rights; a security culture; coordinated incident response; and international engagement. It created the institutional and policy foundations for subsequent legislation.

    Gobierno Digital de Chile

15. 1 Jan 2015Decision · official
    Interministerial Committee on Cybersecurity (CICS) Created

    Chile established the Comité Interministerial sobre Ciberseguridad (CICS), comprising representatives of Interior, Defense, Foreign Affairs, Justice, Economy, Finance, Telecommunications, and the National Intelligence Agency. CICS was mandated to propose a national cybersecurity policy to the President, marking Chile's first formal inter-agency cybersecurity governance structure.

    Biblioteca del Congreso Nacional de Chile

16. 7 Jun 1993Law · official
    Law 19.223 Enacted, Latin America's First Computer Crimes Statute

    Chile became a regional pioneer by enacting Law 19.223, which criminalised computer sabotage and computer espionage in four articles drafted before the mass-market internet era. Though groundbreaking for its time, the law remained unchanged for nearly three decades until it was superseded by Law 21.459 in 2022.

    Agencia Nacional de Ciberseguridad (ANCI) — Normativa

17. 7 Jun 1993Law · official
    Law 19.223 Enacted, Chile's First Computer Crimes Law

    Chile enacted Law 19.223, one of the first computer crimes statutes in Latin America. Its four articles criminalized computer sabotage and computer espionage but covered a narrow range of conduct. The law's inadequacy in addressing modern threats, it went unamended for 29 years, ultimately drove Chile to replace it with Law 21.459 in 2022.

    Biblioteca del Congreso Nacional de Chile

Sources

1. 1.anci.gob.cl/en/news/chile-enacts-cybersecurity-law-creates-cybersecurity-agency/
2. 2.anci.gob.cl/normativa/ley-marco-ciberseguridad/
3. 3.bcn.cl/leychile/navegar?idNorma=1202434
4. 4.loc.gov/item/global-legal-monitor/2025-01-30/chile-framework-law-on-cybersecu
5. 5.hunton.com/privacy-and-information-security-law/chile-cybersecurity-framework-la
6. 6.allende.com/en/privacy-and-cybersecurity/chile-implements-mandatory-reporting-of-
7. 7.carey.cl/en/anci-publishes-final-list-of-operators-of-vital-importance-oiv
8. 8.trade.gov/market-intelligence/chile-information-technology-new-cybersecurity-fr
9. 9.practiceguides.chambers.com/practice-guides/cybersecurity-2025/chile
10. 10.dacbeachcroft.com/en/What-we-think/Stepping-up-in-Latin-America-Chile-enacts-a-new-Cybe