Chile cybersecurity and data protection regulation

Chile is undergoing a regulatory transition focused on cybersecurity and data privacy. The implementation of the Framework Cybersecurity Law and the consolidation of the National Cybersecurity Agency (ANCI) require public and private institutions to improve their ability to prevent, detect, and respond to digital incidents.

Critical sectors such as energy, transport, health, telecommunications, and finance are under pressure to move toward operational resilience. Additionally, the Personal Data Protection Law introduces requirements for Data Protection Impact Assessments (DPIA) for the ‘massive or large-scale processing of data.’ However, the current lack of a specific numerical threshold for what constitutes ‘massive’ processing leaves organizations to justify their assessment decisions until a future Data Protection Agency provides clearer criteria.

Recent legislative developments indicate a potential delay in this transition. The Chilean government has submitted a project to the Senate to postpone the implementation of Law 21.719, the new personal data protection law, by one year. If approved, the effective date would shift from December 2026 to December 2027. This delay is attributed to the need to consolidate institutional structures, specifically the creation of a regulatory agency, the expansion of the agency’s board, and the expiration of legal deadlines for appointing leadership.

Data protection professionals have expressed concern regarding this postponement, noting that Chile has commitments to the OECD and seeks recognition from the European Union for adequate data protection to facilitate technological investment. Until the new law becomes active, the 1999 Law 19.628 remains in effect without a specialized enforcement body.