Data protection & privacy law in Chile (2026)
Data protection in Chile: comprehensive law.
Chile has had a general, cross-sector personal-data protection law in force since 1999 (Law 19.628), and personal-data protection is a constitutional right (Art. 19 No. 4). On 13 December 2024 Chile published Law 21.719, a comprehensive GDPR-aligned reform that creates an independent supervisory authority (the APDP), expands data-subject rights, and adds strong enforcement; it enters into full force on 1 December 2026 after a 24-month transition. As of May 2026 the modernized regime is enacted but not yet enforceable, so Law 19.628 remains the operative law while organizations prepare for the new obligations.
Legal framework
Currently Law No. 19.628 (1999, 'sobre protección de la vida privada'), grounded in Constitution Art. 19 No. 4; comprehensively overhauled by GDPR-style Law No. 21.719 (published 13 Dec 2024), which enters into force 1 December 2026 and creates the Agencia de Protección de Datos Personales (APDP).
Key points: data & privacy in Chile
Existing in-force law
Law 19.628, in force since 18 August 1999, regulates the processing and protection of personal data of natural persons across both private and public bodies, and grants access, rectification, cancellation and opposition (ARCO) rights. It will be renamed and substantially replaced when Law 21.719 takes effect.
Constitutional basis
A 2018 constitutional reform added protection of personal data to Article 19 No. 4 of the Political Constitution, which guarantees respect and protection of private life and of the person's personal data, to be regulated by law.
GDPR-style reform (Law 21.719)
Law 21.719, published in the Diario Oficial on 13 December 2024, modernizes Chile's regime along GDPR lines, lawful bases for processing, expanded data-subject rights (access, rectification, erasure, portability, objection, and rights regarding automated decision-making/profiling), DPIAs, and records of processing activities. Full entry into force is 1 December 2026.
Supervisory authority
Controller obligations
The new law imposes transparency/clear-information duties, a record of processing activities, security measures, mandatory data-breach notification to the APDP (and to affected individuals for sensitive data, minors under 14, or financial/banking data at high risk), and appointment of a Data Protection Officer for certain controllers.
Enforcement and penalties
Infringements are graded minor/serious/very serious, with fines up to 20,000 UTM; for large companies that repeatedly commit serious or very serious breaches, fines may instead reach a percentage of prior-year annual revenue (up to 2% / 4%). Cross-border transfers follow a layered GDPR-style framework (adequacy, contractual clauses/BCRs, certifications).
Timeline of decisions
- Law · officialLaw 21.719 Enters Full Force; Personal Data Protection Agency Begins Operations
Chile's GDPR-aligned data protection reform takes full legal effect and the newly created Agencia de Protección de Datos Personales (APDP), Chile's first dedicated, independent supervisory authority, commences operations with powers to issue binding instructions, conduct inspections, and impose administrative fines. The 24-month transitional window that began with the law's December 2024 publication expires on this date.
Biblioteca del Congreso Nacional de Chile
- Law · officialData Protection Law No. 21.719 Published, Includes Automated-Decision Rights
Chile published a comprehensive overhaul of its data protection regime, creating an autonomous Personal Data Protection Agency (Agencia de Protección de Datos Personales) and establishing in Art. 8 bis an explicit right to explanation for automated decisions with legal or significant effects, directly applicable to AI systems. Full entry into force is set for 1 December 2026.
Biblioteca del Congreso Nacional de Chile
- DecisionConstitutional Tribunal Clears Law 21.719
Chile's Constitutional Court reviewed and approved Bills 11144-07 and 11092-07 (jointly constituting the Data Protection Act), removing the final institutional hurdle before presidential promulgation. The ruling confirmed the law's compatibility with constitutional guarantees after over eight years of legislative debate.
OneTrust DataGuidance
- Enforcement · officialSERNAC Files Infraction Lawsuit Against Worldcoin for Unlawful Biometric Data Collection
Chile's consumer protection agency SERNAC filed a formal complaint against Worldcoin (Grupo Optimistic SpA) at the 2nd Local Police Court of Las Condes for collecting iris scans without adequate consent, including from minors. SERNAC later obtained a precautionary order suspending biometric data collection from minors, the case became a landmark test of existing privacy rules against novel biometric technologies in the run-up to Law 21.719.
SERNAC (Servicio Nacional del Consumidor)
- LawLaw 21.096, Personal Data Protection Elevated to Constitutional Right
Law 21.096 amended Article 19 No. 4 of the Chilean Constitution to explicitly recognise personal data protection as a fundamental right, providing the constitutional foundation needed for the subsequent GDPR-equivalent legislative overhaul (Law 21.719) and European adequacy discussions.
Future of Privacy Forum
- Law · officialBill to Reform Law 19.628 Introduced in Senate (Boletín 11144-07)
The Chilean government submitted a comprehensive legislative bill in the Senate to replace the 1999 data protection law, launching more than eight years of parliamentary debate. The bill proposed creating a supervisory authority and aligning the framework with the EU GDPR and other emerging international standards.
Biblioteca del Congreso Nacional — Historia de la Ley
- LawLaw 19.628 Enacted, Chile's First Personal Data Protection Law
Law 19.628 on the Protection of Private Life established the first general data-protection framework in Chile, creating data-subject rights and obligations for data controllers. Critically, it created no independent enforcement authority, a structural gap that persisted for 25 years until Law 21.719 in 2024.
DLA Piper Data Protection Laws of the World
Sources
Next for Chile: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 25 May 2026. Methodology & how to cite · State of Technology Regulation 2026