Chilean personal data protection law implementation

Chile is considering a delay in the implementation of Law No. 21.719, the new Personal Data Protection Law. Originally set to take effect on December 1, 2026, the government has cited difficulties in establishing the necessary regulatory infrastructure, specifically the lack of an operational Data Protection Agency (APDP) following the Senate's rejection of proposed council candidates.

By late August, the government proposed postponing the law’s implementation until December 1, 2027. This extension is intended to allow public agencies and private entities more time to prepare and to ensure the Data Protection Agency is fully functional. The proposal includes plans to strengthen the agency by increasing its Board of Directors from three to five members and expediting the appointment process to facilitate the development of secondary regulations.

As of early September 2026, a new legislative project seeks to formalize these modifications. This project proposes that the five members of the Board of Directors must have exclusive dedication to their roles. While proponents argue the delay is necessary to ensure the Agency is properly installed and capable of setting standards before inspections begin, critics suggest the move could extend the ‘grace period’ for compliance for five years or more, potentially weakening privacy rights.

Implementation challenges remain significant. A survey by the University of Chile indicated that only 29.11% of surveyed organizations have a clear data protection strategy, while over 54% do not perform impact assessments. The law introduces strict standards for managing sensitive information and imposes significant economic sanctions for non-compliance, with penalties for repeat offenders reaching up to 4% of a company’s annual revenue.