Data protection and regulatory shifts in Dominican Republic and Chile

Legal developments regarding data protection and corporate liability are emerging in the Dominican Republic and Chile.

In the Dominican Republic, new provisions in the Penal Code (Law 44-26) will take effect on November 5, 2026. While written employee consent remains necessary for biometric data processing under Law 4-23, companies will now face criminal liability for the offenses of subordinates if they fail to fulfill duties of direction, control, and supervision. To protect against third-party claims and state action, businesses are advised to implement robust compliance programs, including codes of conduct and whistleblowing channels, rather than relying solely on signed consent.

In Chile, the government is evaluating a potential delay to the implementation of the new Personal Data Protection Law, originally scheduled for December 1, 2026. The delay follows the Senate's rejection of the Executive's proposed candidates for the regulatory council and the expiration of the legal deadline to appoint the board of the future Data Protection Agency. Concerns have been raised regarding potential efforts to relax exclusivity requirements for council members, which critics argue could undermine the regulator's independence.